Provisioning authorization claims using attribute-based access-control policies

A computer-implemented method of provisioning authorization claims, which are enforced to control access of users to objects in a computer system,

• each authorization claim forming part of a privilege relation associating at least one user, at least one object and at least one permission level,
• the method comprising the steps:
• i) receiving an attribute-based access control (ABAC) policy depending on attributes and evaluable to one of Permit and possible further values;
• ii) receiving attribute values for a plurality of elements in predefined categories corresponding to users, objects and permission levels in the computer system;
• viii) selecting one of the predefined categories as a final category and, for a vector comprising one element from each of any remaining non-final category, finding all elements in the final category for which the ABAC policy evaluates to Permit;
• and
• ix) defining an authorization claim and a privilege relation in which the authorization claim associates said one element from each remaining non-final category and the elements in the final category thus found.

A policy converter for provisioning authorization claims, which are enforced to control access of users to objects in a computer system, each authorization claim forming part of a privilege relation associating at least one user, at least one object and at least one permission level,

• the policy converter comprising:
• a memory;
• a processor;
• a policy processor configured to:
• i) receive an attribute-based access control (ABAC) policy depending on attributes and evaluable to one of Permit and possible further values;
• ii) receive attribute values for a plurality of elements in predefined categories corresponding to users, objects and permission levels in the computer system;
• viii) select one of the predefined categories as a final category and, for a vector comprising one element from each of any remaining non-final category;
• a reverse policy evaluator configured to find all elements in the final category for which the ABAC policy evaluates to Permit;
• and
• an authorization claim generator configured to define an authorization claim and a privilege relation in which the authorization claim associates the primary equivalence class, said one element from each remaining non-final category and the elements in the final category found by the reverse policy evaluator.