Method and System for Access Authorization Using Flows and Circulation on Graphs

A computer system comprising:

• a non-transitory computer readable storage medium for storing computer components;
• and
• a processor for executing the computer components comprising:
• a first selection module for selecting, from one or more first set of computerized directories that store information about subjects, resources, actions, and privileges associated with an organization, subsets of each of:
• i) subjects, ii) groups of subjects, iii) privileges, iv) resources, v) groups of resources, and vi) actions, wherein the first selection module performs the selecting based on received first criteria,
• a second selection module for selecting from one or more second set of directories, and based on received second criteria, a subset of activity logs that store information related to activities performed by subjects on resources,
• a graph generation module for generating a relationship graph using the selected subsets of i) subjects, ii) groups of subjects, iii) privileges, iv) resources, v) groups of resources, vi) actions, and vii) activity logs, and
• a constraint application module for applying a set of circulation problem constraints to the relationship graph to produce a constrained relationship graph so as to enable the organization to modify a security posture based on the constrained relationship graph.

A computer usable non-transitory storage medium having a computer program embodied thereon for causing a suitable programmed system to perform the following steps when such program is executed on the system, the steps comprising:

• based on received first criteria, selecting from one or more first set of computerized directories that store information about subjects, resources, actions, and privileges associated with an organization, subsets of each of:
• i) subjects, ii) groups of subjects, iii) privileges, iv) resources, v) groups of resources, and vi) actions;
• based on received second criteria, selecting from one or more second set of directories a subset of activity logs that store information related to activities performed by subjects on resources;
• generating a relationship graph using the selected subsets of i) subjects, ii) groups of subjects, iii) privileges, iv) resources, v) groups of resources, vi) actions, and vii) activity logs;
• and
• applying a set of circulation problem constraints to the relationship graph to produce a constrained relationship graph so as to enable the organization to modify a security posture based on the constrained relationship graph.