JPWO2020250103A5

JPWO2020250103A5 -

Info

Publication number: JPWO2020250103A5
Application number: JP2021571288A
Authority: JP
Publication date: 2022-10-27
Anticipated expiration: 2040-06-08

Claims

A method for facilitating maintenance of access control information for controlling access by one or more subjects to one or more resources of an information technology system, comprising:
retrieving, by a controlling computing system, one or more trigger policies, each based on one or more policy parameters associated with said resource, said subject, and said access to said resource by said subject; When,
retrieving the policy parameters by the control computing system;
evaluating, by the control computing system, the trigger policy according to the corresponding policy parameters;
determining, by the control computing system, a trigger indicator according to results of the evaluation of the trigger policy;
outputting, by the control computing system, an indication of the trigger indicator for triggering modification of the access control information in response to the trigger indicator, wherein the modification causes the target to be the resource; and said outputting comprising a mining activity to map to and possible updating of said access control information based on results of said mining activity.

2. The method of claim 1, further comprising performing the mining activity in response to the trigger indicator having a positive value indicating the need for modification.

3. The method of claim 1 or 2, further comprising updating said access control information according to said result of said mining activity.

wherein said access control information is assigned to each of said subjects and an indication of one or more roles each including one or more privileges to perform one or more activities in said information technology system; 4. A method according to any one of claims 1 to 3, comprising an indication of one or more of said roles in which said mining activity is role mining.

The access control information includes one or more rules, each rule based on one or more attributes, and at least one associated with activity in the information technology system when the rule is satisfied. 5. A method according to any one of claims 1 to 4, wherein the authorization is indicated and the mining activity is rule mining.

6. The method of any one of claims 1-5, further comprising determining, by the control computing system, the trigger indicator according to a corresponding score assigned to the trigger policy.

storing, by the control computing system, historical information indicative of the modification in association with associated one or more of the trigger policies that contribute to triggering the modification;
updating, by the control computing system, the scores of the associated trigger policies according to the history information and the access control information upon the modified ranking, according to the history information and the access control information. A method according to any one of paragraphs.

storing, by the control computing system, historical information including an indication of one or more affected control items when ranked ;
Updating, by the control computing system, the scores of the associated trigger policies according to the affected control items during the ranking, according to any one of claims 1 to 7. described method.

retrieving, by the control computing system, corresponding lifetime indicators of affected control items during ranking ;
Updating, by the control computing system, the score of the associated trigger policy according to the lifetime indicator of the affected control item. described method.

retrieving, by the control computing system, corresponding range indicators of affected control items when ranking ;
Updating, by the control computing system, the score of the associated trigger policy according to the range indicator of the affected control item. the method of.

11. The method of claim 10, wherein the range indicator for each of the affected control items is based on the target corresponding to the affected control item.

12. The method of claim 10 or 11, wherein the extent indicator for each of the affected control items is based on the authority of the affected control item to perform activities in the information technology system.

conditioned one or more of the trigger policies include an indication of one or more evaluation conditions;
13. The method of any preceding claim, wherein the method further comprises, by the controlling computing system, conditioning the evaluation of each of the conditioned trigger policies with the corresponding evaluation condition. described method.

14. The method of claim 13, wherein at least one of said evaluation conditions is completion of a corresponding conditioning task.

determining, by the controlling computing system, a major change in the policy parameters;
retrieving, by the controlling computing system, said trigger policy in response to said major change in said policy parameter; retrieving said policy parameter; evaluating said trigger policy; 15. The method of any one of claims 1-14, further comprising performing a verification process comprising determining a trigger indicator and outputting the indication of the trigger indicator.

A computer program for causing a control computing system to perform the steps of the method according to any one of claims 1 to 15.

16. A computer readable storage medium having recorded thereon a computer program for causing a control computing system to perform the steps of the method according to any one of claims 1 to 15.