Patent ID: 7606801
Filing Date: 2009-10-20
Classification: G06F,G06Q,Y10S

Abstract:
1. An access control method for dynamically establishing rules for governing control of access to data stored on at least one storage device by a multiplicity of persons in an organization, said method being implemented on at least one computer, said method comprising: monitoring and recording actual access events of multiple persons to multiple data elements in said data stored on said at least one storage device over a learning period; based on said monitoring and recording said actual access events of said multiple persons to said multiple data elements in said data stored on said at least one storage device over said learning period, creating a data access profile for each of said multiple persons and, based on said data access profiles, defining multiple groups each including a plurality of persons among said multiplicity of persons, each group being characterized by the extent of its monitored and recorded actual access events during said learning period to a corresponding aggregation of data elements in said data stored on said at least one storage device automatically defining access rules permitting the plurality of persons in each of said multiple groups to access the corresponding aggregation of data elements in said data stored on said at least one storage device for which said monitored and recorded actual access events occurred during said learning period; and during at least one period following said learning period, automatically redefining said access rules by narrowing said aggregation of data elements in said data stored on said at least one storage device accessible to the plurality of persons in a group by removing permission to access data elements in said data stored on said at least one storage device which were not accessed by persons in said group during said at least one period following said learning period, said step of defining multiple groups being performed iteratively, wherein said data access profiles are redetermined at each iteration thereof and said access rules are updated following each said iteration.