Identity context-based access control
Identity context-based access control is implemented by generating an identity context expression from user identity data. In particular, users are clustered based on combinations of one or more attributes. These clusters comprise one or more identity context(s). Preferably, an intersection of attribute sets of each user in the cluster is formed. In addition, an intersection of attribute sets of each user not in the cluster also is formed. If the attribute set that is common across the cluster of users is not a subset of the attribute set that is common across the rest of the users, then the attribute set forms a unique identity context expression. To reduce the number of roles used in role-based access control (RBAC), at least one role is replaced with an identity context expression. Run-time access control is then enabled.
1. An access control method, comprising:
generating at least one identity context by identifying combinations of a set of attributes common to a cluster of users;
replacing at least one role in an access policy with an expression associated with the at least one identity context to generate an identity context-based access policy; and
in response to an access request, applying the identity-based access policy to control access to a resource;
wherein at least one of the generating, replacing and applying steps are carried out in software executing in a hardware element.
2. The access control method as described in claim 1 wherein the set of attributes are identity attributes.
3. The access control method as described in claim 1 wherein the set of attributes correspond only to attributes that have common values across the cluster of users and not attributes that have values unique to a particular user in the cluster of users.
4. The access control method as described in claim 1 wherein the at least one role in the access policy is replaced with the expression if the identity context defines the cluster of users that have been determined to be assigned to the role.
5. The access control method as described in claim 1 wherein the at least one identity context represents an intersection of attribute sets of each user in the cluster.
6. The access control method as described in claim 1 wherein the expression is determined by identifying a set of attributes that is common across the cluster of users but is not a subset of an attribute set that is common across other users in a community of users that includes the cluster of users.
7. The access control method as described in claim 1 wherein the at least one identity context is associated with a set of possible identity contexts derived from the set of attributes.
8. Apparatus, comprising:
a processor;
computer memory holding computer program instructions that when executed by the processor perform a method of access control, the method comprising:
generating at least one identity context by identifying combinations of a set of attributes common to a cluster of users;
replacing at least one role in an access policy with an expression associated with the at least one identity context to generate an identity context-based access policy; and
in response to an access request, applying the identity-based access policy to control access to a resource.
9. The apparatus as described in claim 8 wherein the set of attributes are identity attributes.
10. The apparatus as described in claim 8 wherein the set of attributes correspond only to attributes that have common values across the cluster of users and not attributes that have values unique to a particular user in the cluster of users.
11. The apparatus as described in claim 8 wherein the at least one role in the access policy is replaced with the expression if the identity context defines the cluster of users that have been determined to be assigned to the role.
12. The apparatus as described in claim 8 wherein the at least one identity context represents an intersection of attribute sets of each user in the cluster.
13. The apparatus as described in claim 8 wherein the expression is determined by identifying a set of attributes that is common across the cluster of users but is not a subset of an attribute set that is common across other users in a community of users that includes the cluster of users.
14. The apparatus as described in claim 8 wherein the at least one identity context is associated with a set of possible identity contexts derived from the set of attributes.
15. A computer program product in a non-transitory computer readable medium for use in a data processing system, the computer program product holding computer program instructions which, when executed by the data processing system, perform a method of access control, the method comprising:
generating at least one identity context by identifying combinations of a set of attributes common to a cluster of users;
replacing at least one role in an access policy with an expression associated with the at least one identity context to generate an identity context-based access policy; and
in response to an access request, applying the identity-based access policy to control access to a resource.
16. The computer program product as described in claim 15 wherein the set of attributes are identity attributes.
17. The computer program product as described in claim 15 wherein the set of attributes correspond only to attributes that have common values across the cluster of users and not attributes that have values unique to a particular user in the cluster of users.
18. The computer program product as described in claim 15 wherein the at least one role in the access policy is replaced with the expression if the identity context defines the cluster of users that have been determined to be assigned to the role.
19. The computer program product as described in claim 15 wherein the at least one identity context represents an intersection of attribute sets of each user in the cluster.
20. The computer program product as described in claim 15 wherein the expression is determined by identifying a set of attributes that is common across the cluster of users but is not a subset of an attribute set that is common across other users in a community of users that includes the cluster of users.
21. The computer program product as described in claim 15 wherein the at least one identity context is associated with a set of possible identity contexts derived from the set of attributes.
22. Apparatus, comprising:
a processor;
computer memory holding computer program instructions executed by the processor to perform a role-based access control method for a community of users, the method comprising:
replacing a role in a role-based access control policy with an identity context expression representing a cluster of users that have been determined to be assigned to the role, the identity context expression having been determined by identifying a set of attributes that is common across the cluster of users but is not a subset of an attribute set that is common across other users in the community of users; and
applying the access control policy to determine whether access to a resource is permitted.