Access bridge for access control methodology migration

1 . A computing system for implementing an access bridge to facilitate migration from a role-based access control management system to an attribute-based access control management system, the computing system comprising:

processing circuitry coupled to memory that stores instructions, which, upon execution by the processing circuitry, cause the processing circuitry to:

identify a role-based protected resource;

identify a set of user accounts permitted to access the role-based protected resource;

query a set of user account attributes associated with the identified set of user accounts;

coalesce the set of user account attributes to determine instances of each attribute among the identified set of user accounts;

generate a set of candidate attribute-based access control policies using the coalesced set of user account attributes, each candidate attribute-based access control policy generated based on a predetermined criterion;

for each of the candidate attribute-based access control policies, determine and provide information describing a number of user accounts that satisfy the candidate attribute-based access control policy, wherein the information describing the number of user accounts describes at least one user account not in the identified set of user accounts permitted to access the role-based protected resource;

implement an attribute-based access control policy from the set of candidate attribute-based access control policies; and

convert the role-based protected resource into an attribute-based protected resource associated with the implemented attribute-based access control policy.

2 . The computing system of claim 1 , wherein execution of the instructions further causes the processing circuitry to:

for each candidate attribute-based access control policy, determine and provide information describing a percentage of the identified set of user accounts that satisfy the candidate attribute-based access control policy.

3 . The computing system of claim 1 , wherein execution of the instructions further causes the processor to:

before implementing the attribute-based access control policy, adjust the attribute-based access control policy based on input from an administrator.

4 . The computing system of claim 3 , wherein execution of the instructions further causes the processor to:

determine and provide information describing a number of user accounts that satisfy the adjusted attribute-based access control policy.

5 . The computing system of claim 1 , wherein execution of the instructions further causes the processor to:

adjust the identified set of user accounts based on input from an administrator, wherein the set of user account attributes queried is based on the adjusted set of user accounts.

6 . The computing system of claim 1 , wherein the set of candidate attribute-based access control policies is generated using a machine learning model that determines relevant attributes to define the set of candidate attribute-based access control policies, wherein the machine learning model is trained using a previously implemented attribute-based access control policy.

7 . The computing system of claim 1 , wherein the predetermined criterion is based on a percentage of the identified set of user accounts that satisfy the candidate attribute-based access control policy.

8 . The computing system of claim 1 , wherein the predetermined criterion is based on a number of attributes that define the candidate attribute-based access control policy.

9 . A method for implementing an access bridge to facilitate migration from a role-based access control management system to an attribute-based access control management system, the method comprising:

identifying a role-based protected resource;

identifying a set of user accounts permitted to access the role-based protected resource;

querying a set of user account attributes associated with the identified set of user accounts;

coalescing the set of user account attributes to determine instances of each attribute among the identified set of user accounts;

generating a set of candidate attribute-based access control policies using the coalesced set of user account attributes, each candidate attribute-based access control policy generated based on a predetermined criterion;

for each of the candidate attribute-based access control policies, determining and providing information describing a number of user accounts that satisfy the candidate attribute-based access control policy, wherein the information describing the number of user accounts describes at least one user account not in the identified set of user accounts permitted to access the role-based protected resource;

implementing an attribute-based access control policy from the set of candidate attribute-based access control policies; and

converting the role-based protected resource into an attribute-based protected resource associated with the implemented attribute-based access control policy.

10 . The method of claim 9 , further comprising:

for each candidate attribute-based access control policy, determining and providing information describing a percentage of the identified set of user accounts that satisfy the candidate attribute-based access control policy.

11 . The method of claim 9 , further comprising:

before implementing the attribute-based access control policy, adjusting the attribute-based access control policy based on input from an administrator.

12 . The method of claim 11 , further comprising:

determining and providing information describing a number of user accounts that satisfy the adjusted attribute-based access control policy.

13 . The method of claim 9 , further comprising:

adjusting the identified set of user accounts based on input from an administrator, wherein the set of user account attributes queried is based on the adjusted set of user accounts.

14 . The method of claim 9 , wherein the set of candidate attribute-based access control policies is generated using a machine learning model that determines relevant attributes to define the set of candidate attribute-based access control policies, wherein the machine learning model is trained using a previously implemented attribute-based access control policy.

15 . The method of claim 9 , wherein the predetermined criterion is based on a percentage of the identified set of user accounts that satisfy the candidate attribute-based access control policy.

16 . A computing system for implementing an access bridge to enable migration from a role-based access control management system to an attribute-based access control management system, the computing system comprising:

a processor coupled to memory that stores instructions, which, upon execution by the processor, cause the processor to:

provide a user interface for converting a role-based protected resource into an attribute-based protected resource;

receive information describing a selected role-based protected resource from an administrator operating the user interface;

identify a set of user accounts permitted to access the role-based protected resource based on a role-based access control policy associated with the selected role-based protected resource;

generate a set of candidate attribute-based access control policies based on user account attributes associated with the identified set of user accounts;

for each of the candidate attribute-based access control policies, determine and provide information describing a number of user accounts that satisfy the candidate attribute-based access control policy, wherein the information describing the number of user accounts describes at least one user account not in the identified set of user accounts permitted to access the role-based protected resource;

receive information describing a selected attribute-based access control policy from the set of candidate attribute-based access control policies;

implement the selected attribute-based access control policy; and

convert the selected role-based protected resource into an attribute-based protected resource associated with the implemented attribute-based access control policy.