Method and system for evaluating access granted to users moving dynamically across endpoints in a network

1. A data processing system for modeling access of users to a real data communication network comprising:

a processing element;

random access memory for nonvolatile storage for a program set for modeling and for data associated with the modeling;

at least one input interface device for receiving configuration information about the real network;

said program set including a model of a portion of the real network, the model including a representation of an identity enforcement device and an element for modeling, as network locations, user roles of user devices of real users at indeterminate endpoints in the real network,

the model being configured to determine access that has been or is granted between members of the user roles and the model of the portion of the real network; and

an output interface device for extracting information from the model.

2. A method for modeling access of users to a real data communication network comprising:

modeling the data communication network, the data communication network including user devices at indeterminate endpoints, the modeling employing a processing element and random access memory for nonvolatile storage of a program set, the program set including a network model, a modeled identity enforcement device and models of user roles modeled as network locations; and

employing the models of the user roles to determine, from the modeling step, access that has been or can be granted by the modeled identity enforcement device to the modeled user role in the network model with respect to real user devices that are at indeterminate endpoints in a portion of the real network.

3. The method according to claim 2 wherein said employing step comprises:

utilizing a user role interface added to the modeled identity enforcement device as if network traffic originated at the user role interface.

4. The method according to claim 2 wherein the modeling step comprises:

obtaining configuration data of identity enforcement devices associated with the real users;

generating interface definitions for each user device from standard interfaces in order to establish a device interface;

and wherein the employing step comprises:

testing for identity groups and if none exists, outputting a device description of the user device.

5. The method according to claim 2 , wherein if identity groups exist in the identity enforcement device,

associating identity groups with access rules; then

generating identity groups as network interfaces for the modeled identity enforcement device, representing identity groups as if they are network endpoints connected to the identity enforcement device, and producing a device description for the identity enforcement device.

6. The method according to claim 5 wherein after said identity group generating step and prior to said testing step, attaching, to the identity interfaces, any access rules that were found to be associated with said identity group.

7. The method according to claim 2 wherein the user roles are decomposed into a first dynamic component and a second static component, the first dynamic component being an association of the user to the active network endpoint and the geographic and network location of the endpoint, and the second static component being rules applied to the user role.

8. The method of claim 7 wherein the user roles comprise rules, the rules being those that are applied to the user role such that only a static user role or a user role group is represented as an interface, in order to cause an appearance that the group of network users is connected at the location of the modeled identity enforcement device.