Patent ID: 8020191
Filing Date: 2011-09-13
Classification: G06F

Abstract:
1. A computer-implemented method for determining similarity of two access control policies, the method performed by the computer comprising the steps of: providing a first policy with n rules; providing a second policy with m rules; categorizing the rules in each policy based on effect, wherein said rules are categorized as either permit rules or deny rules; calculating a rule similarity score for each permit rule in said first policy with each permit rule in said second policy; calculating a rule similarity score for each deny rule in said first policy with each deny rule in said second policy; for each rule in each policy, calculating a rule-set similarity score between said rule and the rules of similar effect in the other policy; averaging the rule-set similarity scores for all permit rules; averaging the rule-set similarity scores for all deny rules; and calculating a policy similarity score from a weighted sum of the average permit rule-set similarity score and the average deny rule-set similarity score, wherein said policy similarity score is indicative of the similarity of said first and second policies, wherein each said policy is a set of rules for determining access to and use of resources in an information system.