# US 2014/0196104 A1 · Generating role-based access control policies based on discovered risk-averse roles > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2014/0196104 A1 - Document ID: US20140196104A1 - Status: Published application - Kind: A1 - Application number: 13/969,533 - Filed: 2013-08-17 - Published: 2014-07-10 - Earliest claimed: 2013-01-04 - Assignees: Interntional Business Machines Corporation - Applicants: Interntional Business Machines Corporation - Inventors: Suresh N. Chari; Ian M. Molloy - Web page: https://patentgrep.com/patent/US20140196104A1 ## CPC - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 63/102: {Entity profiles} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Generating role-based access control policies is provided. A user-permission relation is generated by extracting users and permissions assigned to each of the users from a stored access control policy. A user-attribute relation is generated by mapping the users to attributes describing the users. A permission-attribute relation is generated by mapping the permissions to attributes describing the permissions. The set of risk-averse roles, assignment of the set of risk-averse roles to the users, and assignment of the permissions to the set of risk-averse roles are determined based on applying a risk-optimization function to the generated user-permission relation, the generated user-attribute relation, and the generated permission-attribute relation. A role-based access control policy that minimizes a risk profile of the set of risk-averse roles, the assignment of the set of risk-averse roles to the users, and the assignment of the permissions to the set of risk-averse roles is generated. ## Claims ### Claim 1 A computer system for generating role-based access control policies that minimize a risk profile of resulting risk-averse roles and assignments to those risk-averse roles, the computer system comprising: a bus system; a storage device connected to the bus system, wherein the storage device stores computer readable program code; and a processor unit connected to the bus system, wherein the processor unit executes the computer readable program code to generate a user-permission relation from a stored access control policy by extracting users and permissions assigned to each of the users from the stored access control policy; generate a user-attribute relation by mapping the users to attributes describing each of the users; generate a permission-attribute relation by mapping the permissions to attributes describing each of the permissions; determine the set of risk-averse roles, assignment of the set of risk-averse roles to the users, and assignment of the permissions to the set of risk-averse roles based on applying a risk-optimization function to the generated user-permission relation, the generated user-attribute relation, and the generated permission-attribute relation; and generate a role-based access control policy that minimizes a risk profile of the set of risk-averse roles, the assignment of the set of risk-averse roles to the users, and the assignment of the permissions to the set of risk-averse roles. ### Claim 2 (depends on 1) The computer system of claim 1, wherein the risk-optimization function is a multiple-objective optimization function that minimizes risk of misuse of user-permission assignments while minimizing complexity of the generated role-based access control policy and a number of changes to the user-permission assignments from the stored access control policy to the generated role-based access control policy. ### Claim 3 (depends on 2) The computer system of claim 2, wherein the risk-optimization function is a weighted combination of the risk of misuse of user-permission assignments, the complexity of the generated role-based access control policy, and the number of changes to the user-permission assignments from the stored access control policy to the generated role-based access control policy. ### Claim 4 (depends on 3) The computer system of claim 3, wherein risk of the generated role-based access control policy is calculated using an aggregation function that aggregates a risk of each risk-averse role in the set of risk-averse roles. ### Claim 5 (depends on 4) The computer system of claim 4, wherein the aggregation function is a monotonically non-decreasing function. ### Claim 6 (depends on 5) The computer system of claim 5, wherein the risk of the generated role-based access control policy is calculated based on aggregating a risk of each of the users in the generated role-based access control policy given all risk-averse roles assigned to each of the users. ### Claim 7 (depends on 1) The computer system of claim 1, wherein the risk-optimization function maps the attributes describing each of the users and the attributes describing each of the permissions to a specific risk level. ### Claim 8 (depends on 1) The computer system of claim 1, wherein risk of misuse of user-permission assignments in a risk-averse role is calculated based on an aggregation of the attributes describing each of the users and the attributes describing each of the permissions assigned to the risk-averse role. ### Claim 9 (depends on 8) The computer system of claim 8, wherein the attributes describing each of the users used in calculating the risk of misuse of user-permission assignments in the risk-averse role include at least one of a security clearance level and an access risk level of a user. ### Claim 10 (depends on 9) The computer system of claim 9, wherein the attributes describing each of the permissions used in calculating the risk of misuse of user-permission assignments in the risk-averse role include at least one of a sensitivity level and an access risk level of a permission. ### Claim 11 A computer program product stored on a computer readable storage medium having computer readable program code encoded thereon that is executable by a computer for generating role-based access control policies that minimize a risk profile of resulting risk-averse roles and assignments to those risk-averse roles, the computer program product comprising: computer readable program code for generating a user-permission relation from a stored access control policy by extracting users and permissions assigned to each of the users from the stored access control policy; computer readable program code for generating a user-attribute relation by mapping the users to attributes describing each of the users; computer readable program code for generating a permission-attribute relation by mapping the permissions to attributes describing each of the permissions; computer readable program code for determining the set of risk-averse roles, assignment of the set of risk-averse roles to the users, and assignment of the permissions to the set of risk-averse roles based on applying a risk-optimization function to the generated user-permission relation, the generated user-attribute relation, and the generated permission-attribute relation; and computer readable program code for generating a role-based access control policy that minimizes a risk profile of the set of risk-averse roles, the assignment of the set of risk-averse roles to the users, and the assignment of the permissions to the set of risk-averse roles. ### Claim 12 (depends on 11) The computer program product of claim 11, wherein the risk-optimization function is a multiple-objective optimization function that minimizes risk of misuse of user-permission assignments while minimizing complexity of the generated role-based access control policy and a number of changes to the user-permission assignments from the stored access control policy to the generated role-based access control policy. ### Claim 13 (depends on 12) The computer program product of claim 12, wherein the risk-optimization function is a weighted combination of the risk of misuse of user-permission assignments, the complexity of the generated role-based access control policy, and the number of changes to the user-permission assignments from the stored access control policy to the generated role-based access control policy. ### Claim 14 (depends on 13) The computer program product of claim 13, wherein risk of the generated role-based access control policy is calculated using an aggregation function that aggregates a risk of each risk-averse role in the set of risk-averse roles. ### Claim 15 (depends on 14) The computer program product of claim 14, wherein the aggregation function is a monotonically non-decreasing function. ### Claim 16 (depends on 15) The computer program product of claim 15, wherein the risk of the generated role-based access control policy is calculated based on aggregating a risk of each of the users in the generated role-based access control policy given all risk-averse roles assigned to each of the users. ### Claim 17 (depends on 11) The computer program product of claim 11, wherein the risk-optimization function maps the attributes describing each of the users and the attributes describing each of the permissions to a specific risk level. ### Claim 18 (depends on 11) The computer program product of claim 11, wherein risk of misuse of user-permission assignments in a risk-averse role is calculated based on an aggregation of the attributes describing each of the users and the attributes describing each of the permissions assigned to the risk-averse role. ### Claim 19 (depends on 18) The computer program product of claim 18, wherein the attributes describing each of the users used in calculating the risk of misuse of user-permission assignments in the risk-averse role include at least one of a security clearance level and an access risk level of a user. ### Claim 20 (depends on 19) The computer program product of claim 19, wherein the attributes describing each of the permissions used in calculating the risk of misuse of user-permission assignments in the risk-averse role include at least one of a sensitivity level and an access risk level of a permission.