Computer-implemented method for role discovery and simplification in access control systems

1. A method of migrating an electronic access control system for a number of available electronic resources from an Access Control List to a Role-Based Access Control (RBAC) system, the method comprising, with a processor:

discovering a plurality of roles, wherein each of said roles is a biclique covering of a set of vertices of a first type and a corresponding set of vertices of a second type;

selecting a first role in said plurality and finding all roles in said plurality that have a set of vertices of said second type that is a subset of said set of vertices of said second type in said first role;

removing each of said subsets from said set of vertices of said second type corresponding to said first role;

reassigning said vertices of said first type to said roles such that original associations between said vertices of said first type and said vertices of said second type are maintained; and

performing access control for the available electronic resources using said roles and vertices in an RBAC system.

2. The method of claim 1 , further comprising:

determining if said first role is empty after said subsets are removed from said set of vertices of said second type corresponding to said first role; and

deleting said first role if said removal leaves said first role empty.

3. The method of claim 1 , further comprising:

repeating said selecting, finding, removing, and reassigning until a second stopping criterion is met; and

substituting said vertices of said second type for said vertices of said first type and said vertices of said first type for said vertices of said second type every other time a first stopping criterion is met.

4. The method of claim 3 , wherein said first stopping criterion comprises at least one of: a threshold of elapsed time and a determination that that no additional role exists having a set of vertices of said second type that is a subset of a set of vertices of said second type in another role.

5. The method of claim 3 , wherein said second stopping criterion comprises at least one of: a threshold number of iterations, a threshold amount of elapsed time, and a threshold degree of convergence of a number of said roles.

6. The method of claim 1 , wherein said vertices of said first type correspond to individual users and said vertices of said second type correspond to resources for which access is granted to said users, as specified by said roles.

7. A system for implementing a Role-Based Access Control (RBAC) system for a number of electronic resources, the system comprising:

digital memory configured to store at least a plurality of vertices of a first type, a plurality of vertices of a second type, and a plurality of biclique roles associating sets of said vertices of said first type with sets of said vertices of said second type; and

at least one processor in communication with said memory, said processor being configured to:

select a first role in said plurality of biclique roles and find all roles in said plurality of biclique roles that have a set of vertices of said second type that is a subset of said set of vertices of said second type in said first role;

remove each of said subsets from said set of vertices of said second type corresponding to said first role;

reassign said vertices of said first type to said roles such that original associations between said vertices of said first type and said vertices of said second type are maintained; and

perform access control for the available electronic resources using said roles and vertices in an RBAC system.

8. The system of claim 7 , wherein said processor is further configured to:

determine if said first role is empty after said subsets are removed from said set of vertices of said second type corresponding to said first role; and

delete said first role if said removal leaves said first role empty.

9. The system of claim 7 , wherein said processor further configured to:

repeat said selecting, finding, removing, and reassigning until a second stopping criterion is met; and

substitute said vertices of said second type for said vertices of said first type and said vertices of said first type for said vertices of said second type every other time a first stopping criterion is met.

10. The system of claim 8 , wherein said first stopping criterion comprises at least one of: a threshold of elapsed time and a determination that that no additional role exists having a set of vertices of said second type that is a subset of a set of vertices of said second type in another role.

11. The system of claim 9 , wherein said second stopping criterion comprises at least one of: a threshold number of iterations, a threshold amount of elapsed time limit, and a threshold degree of convergence of a number of said roles.

12. The system of claim 7 , wherein said vertices of said first type correspond to users and said vertices of said second type correspond to resources for which access is granted to certain of said users, as specified by said roles.

13. A computer program product comprising:

a non-transitory computer readable device having computer usable program code embodied therewith, the computer usable program code comprising:

computer usable program code configured to discover a plurality of roles, wherein each of said roles is a biclique covering of a set of vertices of a first type and a corresponding set of vertices of a second type;

computer usable program code configured to select a first role in said plurality and find all roles in said plurality that have a set of vertices of said second type that is a subset of said set of vertices of said second type in said first role;

computer usable program code configured to remove each of said subsets from said set of vertices of said second type corresponding to said first role;

computer usable program code configured to reassign said vertices of said first type to said roles such that original associations between said vertices of said first type and said vertices of said second type are maintained; and

computer usable program code configured to perform access control for the available electronic resources using said roles and vertices in an RBAC system.

14. The computer program product of claim 13 , further comprising:

computer usable program code configured to determine if said first role is empty after said subset is removed from said set of vertices of said second type corresponding to said first role; and

computer usable program code configured to delete said first role if said removal leaves said first role empty.

15. The computer program product of claim 13 , further comprising:

computer usable program code configured to repeat said selecting, finding, removing, and reassigning steps until a first stopping criterion is met;

computer usable program code configured to substitute said vertices of said first type with said vertices of said second type in said finding, removing, and adding steps every other time said first criterion is met.

16. The computer program product of claim 13 , further comprising:

computer usable program code configured to create a new role covering a set of permissions associated with a user account of said first type that are not yet covered with another role associated with said user account.

17. The computer program product of claim 16 , further comprising:

computer usable program code configured to assign said new role to said user account so that all permissions needed for said user account are covered.

18. The computer program product of claim 17 , further comprising:

computer usable program code configured to find other user accounts who need access to said permissions.

19. The computer program product of claim 18 , further comprising:

computer usable program code configured to assign said new role to said other user accounts.

20. The computer program product of claim 16 , wherein vertices of said first type are user accounts.