Computer-implemented method for role discovery in access control systems

1. A computer-implemented method for role discovery in access control systems, the method comprising:

selecting a user account according to a predetermined algorithm;

creating a new role covering a set of permissions including all permissions which the user account needs but is not yet covered by another role that the user account has;

giving the new role to the user account so that all permissions needed by the user account are covered;

finding any additional user accounts which still need the set of permissions covered by the new role; and

giving the new role to the additional user accounts, if any.

2. The computer-implemented method for role discovery of claim 1 , wherein the predetermined algorithm comprises selecting a user account having a fewest uncovered permissions from among user accounts having at least one uncovered permission.

3. The computer-implemented method for role discovery of claim 1 , wherein the predetermined algorithm comprises selecting a user account having a most uncovered permissions from among user accounts having at least one uncovered permission.

4. The computer-implemented method for role discovery of claim 1 , wherein the predetermined algorithm comprises a random selection of a user account from among user accounts having at least one uncovered permission.

5. The computer-implemented method for role discovery of claim 1 , wherein the method is repeated until there are no more users with uncovered permissions.

6. The computer-implemented method for role discovery of claim 5 , further comprising receiving an initial partial set of roles.

7. The computer-implemented method of claim 1 , further comprising:

a simplifying procedure to reduce a complexity of a discovered set of roles.

8. The computer-implemented method of claim 7 , wherein the simplifying procedure comprises:

finding a pair of roles with overlap in coverage;

creating a potential new role which covers said overlap;

considering a change where the potential new role is given to user accounts having either of said pair of roles and modifying said pair of roles to eliminate said overlap;

determining whether said change reduces said complexity; and

implementing said change if said change reduces said complexity.

9. The computer-implemented method of claim 7 , wherein the simplifying procedure comprises:

determining a proposed new role which is an over-approximation of existing permissions;

outputting the proposed new role to a supervising user; and

upon receiving approval of the proposed new role, creating the proposed new role and correspondingly canceling unnecessary existing roles.

10. The computer-implemented method of claim 7 , wherein the simplifying procedure comprises:

determining a proposed new role assignment which is an over-approximation of existing permissions;

outputting the proposed new role assignment to a supervising user; and

implementing the proposed new role assignment upon receiving approval.

11. The computer-implemented method of claim 1 , further comprising:

determining a lower bound for a number of roles given a data set for the access control system; and

outputting a comparison of a number of roles in a discovered role set and the lower bound to provide a quantitative measure of quality of the discovered role set.

12. An automated method for discovery of roles for an access control system, the method comprising:

creating at least two potential roles using at least two independent procedures each potential role covering a set of permissions including all permissions which a user account needs but is not yet covered by another role that the user account has;

generating at least two potential role sets each comprising one of the at least two potential roles;

comparing said role sets to determine a preferred role set;

selecting the preferred role set; and

identifying a new role based at least in part on the selection of the preferred role set.

13. The automated method of claim 12 , wherein at least one of the independent procedures comprises:

selecting a user account according to a predetermined algorithm;

giving the new role to the user account so that all permissions needed by the user account are covered;

finding any additional user accounts which still need the set of permissions covered by the new role; and

giving the new role to the additional user accounts, if any.

14. The automated method of claim 12 , wherein the independent procedures include a first procedure and a second procedure, each of the first and second procedures comprising:

selecting a user account according to a predetermined algorithm;

giving the new role to the user account so that all permissions needed by the user account are covered;

finding any additional user accounts which still need the set of permissions covered by the new role; and

giving the new role to the additional user accounts, if any.

15. The automated method of claim 14 , wherein the predetermined algorithm for the first procedure comprises selecting a user account having a fewest uncovered permissions from among user accounts having at least one uncovered permission, and wherein the predetermined algorithm for the second procedure comprises selecting a user account having a most uncovered permissions from among user accounts having at least one uncovered permission.

16. The automated method of claim 12 , further comprising:

a simplifying procedure to reduce a complexity of the preferred role set.

17. The automated method of claim 12 , further comprising:

determining a lower bound for a number of roles given a data set for the access control system; and

outputting a comparison of a number of roles in the preferred role set and the lower bound to provide a quantitative measure of quality of the preferred role set.

18. A non-transitory computer-readable medium configured with computer-readable program code to perform automated role discovery for an access control system, the non-transitory computer-readable medium comprising:

computer-readable program code configured to choose a user account according to a predetermined algorithm;

computer-readable program code configured to generate a new role covering a set of permissions including all permissions which the user account needs but is not yet covered by another role that the user account has;

computer-readable program code configured to assign the new role to the user account so that all permissions needed by the user account are covered;

computer-readable program code configured to determine any additional user accounts which still need the set of permissions covered by the new role; and

computer-readable program code configured to assign the new role to the additional user accounts, if any.

19. The non-transitory computer-readable medium of claim 18 , further comprising:

computer-readable program code configured to perform a simplifying procedure to reduce a complexity of a discovered role set.

20. The non-transitory computer-readable medium of claim 18 , further comprising:

computer-readable program code configured to determine a lower bound for a number of roles given a data set for the access control system; and

computer-readable program code configured to output a comparison of a number of roles in a discovered role set and the lower bound to provide a quantitative measure of quality of the discovered role set.

21. A non-transitory computer-readable medium configured with computer-readable program code to perform automated role discovery for an access control system, the non-transitory computer-readable medium comprising:

computer-readable program code configured to generate a plurality of role sets, each role set comprising a new role covering a set of permissions including all permissions which a user account needs but is not yet covered by another role that the user account has;

computer-readable program code configured to compare said plurality of role sets to determine a preferred role set; and

computer-readable program code configured to select the preferred role set.