Patent ID: 9679264
Date: 2017-06-13
CPC Classifications: G06F,G06Q

Claim:
1. A computer implemented method for roles discovery using permission cluster analysis, the method comprising: accessing a hierarchy of data that corresponds to an organization chart and that comprises one or more levels of the hierarchy with root nodes corresponding to one or more employee position titles, mid-level nodes corresponding to constituent duties of the one or more employee position titles and leaf nodes corresponding to respective permissions of the constituent duties controlling computer network access; traversing the one or more levels of the hierarchy; retrieving, based on the traversing, a set of permissions; enumerating one or more permissions inherited by each employee position title based on the hierarchy of data; clustering the set of permissions into a plurality of sets of clustered permissions comprising all combinations of individual permissions, by: assigning one or more of the plurality of sets of clustered permissions to a respective virtual role; storing an assigned one or more sets of clustered permissions in association with the respective virtual role in one or more database tables; retrieving data from a respective database table; determining, based on the retrieving of the data, whether a specific permission is stored in the respective database table in association with one or more virtual roles; and controlling access to the computer network by performing at least one of (i) granting or (ii) denying access to a resource within the computer network to an employee associated with the one or more virtual roles.