Automated ABAC Policy Generation from RBAC Attributes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing attribute-based access control (ABAC) policies require manual definition and are challenging to manage due to noise and errors in deployed data, especially when migrating from role-based access control (RBAC) systems, which lack automated generation methods.
Innovation Solution
A method to automatically generate ABAC policies by identifying relevant attributes, removing noise, and deriving logical rules from existing identity and access management (IAM) systems, using entropy analysis and decision tree methodologies to account for errors and scalability.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If ABAC policies are manually defined and written, then policy accuracy can be ensured, but administrative overhead and time consumption increase significantly
Solution Approach 1:
The system enables automated generation of ABAC policies by having the policy generation module automatically derive policies from existing RBAC configurations and attribute data, eliminating the need for manual policy writing and reducing administrative overhead while maintaining accuracy through systematic attribute-based rule derivation
Solution Approach 2:
The patent replaces the manual mechanical process of policy definition with an automated computational system that uses attribute data and decision algorithms to generate policies automatically, substituting human administrative work with machine-based policy generation
2Productivity
If ABAC policies are generated automatically from existing IAM systems, then administrative overhead is reduced, but noise and errors in deployed data may affect policy quality
Solution Approach 1:
The noise removal module extracts and removes noisy assignments and attributes from the deployed data before policy generation, separating the useful attribute information from erroneous or irrelevant data to ensure high-quality policy output
Solution Approach 2:
The system performs preliminary noise removal and data cleaning operations before the actual policy generation process, preparing clean attribute data in advance to ensure reliable policy derivation without compromising generation efficiency
3Ease of operation
If direct permission assignment to users is used, then policy implementation is simple, but policy size becomes large and difficult to manage in dynamic environments
Solution Approach 1:
The system changes the parameter representation from direct user-permission assignments to attribute-based rules, where policies are defined by attribute conditions rather than explicit user permissions, enabling more compact and manageable policy representations that scale better in dynamic environments
Data Source
AI summary
Attributes relevant to at least one existing authorization system are identified. Noise removal from identified attributes of the at least one existing authorization system is performed. An attribute based access control (ABAC) policy is generated from remaining identified attributes to derive logical rules that grant or deny access.