Method and system for determining policy similarities
AssigneeInternational Business Machines Corporation
InventorsElisa Bertino, Dan Lin, Jorge Lobo, Prathima Rama Rao
Life of this patent
Estimating the term…
Abstract
A method for determining similarity of two policies includes providing a first policy with n rules and a second policy with m rules, wherein each rule is structured into a plurality of identifiable elements, categorizing the rules in each policy based on an action, for each pair of rules finding those predicates whose attribute names match, computing an attribute similarity score for the attribute values, summing the attribute similarity scores for all pairs to obtain an element similarity score, and computing a rule similarity score for the pair of rules from a weighted sum of said element similarity scores.
Claims28
A computer-implemented method for determining similarity of two access control policies, the method performed by the computer comprising the steps of:
- providing a first policy with n rules;
- providing a second policy with m rules;
- categorizing the rules in each policy based on effect, wherein said rules are categorized as either permit rules or deny rules;
- calculating a rule similarity score for each permit rule in said first policy with each permit rule in said second policy;
- calculating a rule similarity score for each deny rule in said first policy with each deny rule in said second policy;
- for each rule in each policy, calculating a rule-set similarity score between said rule and the rules of similar effect in the other policy;
- averaging the rule-set similarity scores for all permit rules;
- averaging the rule-set similarity scores for all deny rules;
- and
- calculating a policy similarity score from a weighted sum of the average permit rule-set similarity score and the average deny rule-set similarity score,
- wherein said policy similarity score is indicative of the similarity of said first and second policies, wherein each said policy is a set of rules for determining access to and use of resources in an information system.
A computer-implemented method for determining similarity of two access control policies, the method performed by the computer comprising the steps of:
- providing a first policy with n rules and a second policy with m rules, wherein each rule comprises a plurality of elements, including a subject element, a resource element, an action element, and a condition element that determines an effect of said rule, wherein each element is represented as a set of predicates in the form of {attr_name1⊕1attr_value1,attr_name2⊕2attr_value2, . . . }, where attr_name denotes an attribute name, ⊕ denotes a comparison operator and attr_value represents an attribute value, wherein attribute values include categorical values or numerical values;
- categorizing the rules in each policy based on effect, wherein said rules are categorized as either permit rules or deny rules;
- for each rule ri, in said first policy and each rule rj, in said second policy of similar effect, finding those predicates in said pair of rules whose attribute names match, wherein a match is either a syntactic match or a synonym;
- for each predicate with matching attribute names, computing an attribute similarity score for the attribute values;
- summing the attribute similarity scores for all pairs of matching predicates to obtain an element similarity score;
- and
- computing a rule similarity score Srule(ri,rj) for said pair of rules from a weighted sum of said element similarity scores,
- wherein said rule similarity score is indicative of the similarity of said first and second policies, wherein each said policy is a set of rules for determining access to and use of resources in an information system.
A program storage device readable by a computer, tangibly embodying a program of instructions executable by the computer to perform the method steps for determining similarity of two access control policies, said method comprising the steps of:
- providing a first policy with n rules;
- providing a second policy with m rules;
- categorizing the rules in each policy based on effect, wherein said rules are categorized as either permit rules or deny rules;
- calculating a rule similarity score for each permit rule in said first policy with each permit rule in said second policy;
- calculating a rule similarity score for each deny rule in said first policy with each deny rule in said second policy;
- for each rule in each policy, calculating a rule-set similarity score between said rule and the rules of similar effect in the other policy;
- averaging the rule-set similarity scores for all permit rules;
- averaging the rule-set similarity scores for all deny rules;
- and
- calculating a policy similarity score from a weighted sum of the average permit rule-set similarity score and the average deny rule-set similarity score,
- wherein said policy similarity score is indicative of the similarity of said first and second policies, wherein each said policy is a set of rules for determining access to and use of resources in an information system.
A program storage device readable by a computer, tangibly embodying a program of instructions executable by the computer to perform the method steps for determining similarity of two access control policies, said method comprising the steps of:
- providing a first policy with n rules and a second policy with m rules, wherein each rule comprises a plurality of elements, including a subject element, a resource element, an action element, and a condition element that determines an effect of said rule, wherein each element is represented as a set of predicates in the form of {attr_name1⊕1attr_value1,attr_name2⊕2attr_value2, . . . }, where attr_name denotes an attribute name, ⊕ denotes a comparison operator and attr_value represents an attribute value, wherein attribute values include categorical values or numerical values;
- categorizing the rules in each policy based on effect, wherein said rules are categorized as either permit rules or deny rules;
- for each rule ri in said first policy and each rule rj in said second policy of similar effect, finding those predicates in said pair of rules whose attribute names match, wherein a match is either a syntactic match or a synonym;
- for each predicate with matching attribute names, computing an attribute similarity score for the attribute values;
- summing the attribute similarity scores for all pairs of matching predicates to obtain an element similarity score;
- and
- computing a rule similarity score Srule(ri, rj) for said pair of rules from a weighted sum of said element similarity scores,
- wherein said rule similarity score is indicative of the similarity of said first and second policies, wherein each said policy is a set of rules for determining access to and use of resources in an information system.
A computer-implemented method for determining similarity of two policies, the method performed by the computer comprising the steps of:
- providing a first policy with n rules and a second policy with m rules, wherein each rule is structured into a plurality of identifiable elements, including a event element, a condition element, and an action element, wherein each element is represented as a set of predicates in the form of {attr_name1⊕1attr_value1,attr_name2⊕2attr_value2, . . . }, where attr_name denotes an attribute name, ⊕ denotes a comparison operator and attr_value represents an attribute value;
- categorizing the rules in each policy based on action;
- for each rule ri in said first policy and each rule rj in said second policy of similar effect, finding those predicates in said pair of rules whose attribute names match, wherein a match is either a syntactic match or a synonym;
- for each predicate with matching attribute names, computing an attribute similarity score for the attribute values;
- summing the attribute similarity scores for all pairs of matching predicates to obtain an element similarity score;
- and
- computing a rule similarity score Srule(ri, rj) for said pair of rules from a weighted sum of said element similarity scores,
- wherein said rule similarity score is indicative of the similarity of said first and second policies, wherein each said policy is a set of rules for determining access to and use of resources in an information system.
Dependencies are inferred from the claim text.