Back to results
US 10,764,299 B2Granted
Access control manager
AssigneeMicrosoft Technology Licensing, LLC
InventorsBen Kliger, Efim Hudis, Moshe Israel, Steven J. Lieberman, Mark Wahl
Life of this patent
Estimating the term…
Abstract
An access configuration for an access control manager is generated. Access data including users, resources, and actions the users performed on the resources is received into a matrix. Clusters of the matrix are formed to produce ranges of the users and ranges of the resources having selected permission levels based on the actions. Administrator-modifiable security groups are created based on the ranges of users and administrator-modifiable resources groups based on the ranges of resources.
Claims20
A method of generating an access configuration, the method comprising:
- receiving access data including a plurality of users, a plurality of resources, and actions the plurality of users performed on the plurality of resources into a matrix of the plurality of users and the plurality of resources from a data gathering over a period of time of permission levels;
- assigning an expected permission level for each resource of the plurality of resources to each user of the plurality of users based on actions of the each user with respect to each resource from the access data selected from a plurality of permission levels available for access over the period of time, wherein the expected permission level is a more restrictive permission level than a least restrictive permission level of the plurality of permission levels available for access;
- forming clusters of the matrix to produce a plurality of ranges of the users and a plurality of ranges of the resources from the expected permission level for each resource;
- assigning a permission level from a set of permission levels to each of the clusters based on the access data of the actions, the access data of the actions corresponding with the set of the permission levels;
- and
- creating administrator-modifiable security groups based on the plurality of ranges of users and administrator-modifiable resources groups based on the plurality of ranges of resources.
3 more elements
A computer readable storage device to store computer executable instructions to control a processor to:
- receive access data including a plurality of users, a plurality of resources, and actions the plurality of users performed on the plurality of resources into a matrix of the plurality of users and the plurality of resources from a data gathering over a period of time of permission levels;
- assign an expected permission level for each resource of the plurality of resources to each user of the plurality of users based on actions of the each user with respect to each resource from the access data selected from a plurality of permission levels available for access over the period of time, wherein the expected permission level is a more restrictive permission level than a least restrictive permission level of the plurality of permission levels available for access;
- form clusters of the matrix to produce a plurality of ranges of the users and a plurality of ranges of the resources from the expected permission level for each resource;
- assign a permission level from a set of permission levels to each of the clusters based on the access data of the actions, the access data of the actions corresponding with the set of the permission levels;
- and
- create administrator-modifiable security groups based on the ranges of users and administrator-modifiable resources groups based on the ranges of resources.
3 more elements
The computer readable storage device of 11 wherein the clusters are formed with a biclustering machine.
A system, comprising:
- a memory device to store a set of instructions;
- and
- a processor to execute the set of instructions to:
- receive access data including a plurality of users, a plurality of resources, and actions the plurality of users performed on the plurality of resources into a matrix of the plurality of users and the plurality of resources from a data gathering over a period of time of permission levels;
- assign an expected permission level for each resource of the plurality of resources to each user of the plurality of users based on actions of the each user with respect to each resource from the access data selected from a plurality of permission levels available for access over the period of time, wherein the expected permission level is a more restrictive permission level than a least restrictive permission level of the plurality of permission levels available for access;
- form clusters of the matrix to produce a plurality of ranges of the users and a plurality of ranges of the resources from the expected permission level for each resource;
- assign a permission level from a set of permission levels to each of the clusters based on the access data of the actions, the access data of the actions corresponding with the set of the permission levels;
- and
- create administrator-modifiable security groups based on the ranges of users and administrator-modifiable resources groups based on the ranges of resources.
6 more elements
Dependencies are inferred from the claim text.