Generating role-based access control policies based on discovered risk-averse roles

A computer program product stored on a computer readable storage medium having computer readable program code encoded thereon that is executable by a computer for generating role-based access control policies that minimize a risk profile of resulting risk-averse roles and assignments to those risk-averse roles, the computer program product comprising:

• computer readable program code for generating a user-permission relation from a stored access control policy by extracting users and permissions assigned to each of the users from the stored access control policy;
• computer readable program code for generating a user-attribute relation by mapping the users to attributes describing each of the users;
• computer readable program code for generating a permission-attribute relation by mapping the permissions to attributes describing each of the permissions;
• computer readable program code for determining the set of risk-averse roles, assignment of the set of risk-averse roles to the users, and assignment of the permissions to the set of risk-averse roles based on applying a risk-optimization function to the generated user-permission relation, the generated user-attribute relation, and the generated permission-attribute relation;
• and
• computer readable program code for generating a role-based access control policy that minimizes a risk profile of the set of risk-averse roles, the assignment of the set of risk-averse roles to the users, and the assignment of the permissions to the set of risk-averse roles.