| CPC H04L 63/104 (2013.01) [H04L 63/105 (2013.01); H04L 63/20 (2013.01)] | 20 Claims |
|
1. A system comprising:
memory; and
a processing system coupled to the memory, the processing system configured to:
identify role assignments that assign roles to principals, the roles defining permissions that enable the principals to which the roles are assigned to perform actions with regard to resources, the roles are comprised in a dynamic role hierarchy in which a subset of the roles that has a relatively lower rank in the dynamic role hierarchy inherits a permission from a subset of the roles that has a relatively higher rank in the dynamic role hierarchy;
identify a proposed role assignment that proposes assignment of a designated role to a designated principal, the designated role defining a designated permission that enables the designated principal to perform a designated action with regard to a designated resource;
select impacted role assignments from the role assignments based at least on the impacted role assignments comprising a first impacted role assignment corresponding to the designated role, a second impacted role assignment corresponding to another role in the dynamic role hierarchy that comprises the designated role, and a third impacted role assignment corresponding to yet another role that is comprised in the designated role and further based at least on the impacted role assignments corresponding to the designated resource or a resource that comprises the designated resource or that is comprised in the designated resource;
generate a static policy, which is defined by the impacted role assignments and the proposed role assignment;
convert the static policy into a first logical artifact;
convert a specification, which comprises security properties that define boundaries of specified allowed actions and specified disallowed actions with regard to at least a subset of the resources such that the boundaries define constraints on the role assignments and the proposed role assignment, and a relationship property, which defines a relationship between the specification and the static policy, into a second logical artifact;
prior to implementation of the proposed role assignment, determine whether the proposed role assignment conforms to the security properties in the specification by comparing the first logical artifact and the second logical artifact; and
based at least on the proposed role assignment not conforming to at least one of the security properties, increase security of the designated resource by inhibiting the designated principal from at least one of viewing the designated resource, deleting the designated resource, inserting information into the designated resource, or changing a value associated with the designated resource.
|