Patent ID: 9148433
Filing Date: 2015-09-29
Classification: G06F,H04L

Abstract:
1. A method of changing an access policy based on a comparison of the access policy with another access policy, the method comprising the steps of: using a computer hardware to implement an access control mechanism having a first access policy, the first access policy including a first access control list of users and identifying specified actions that each of the users on the first access control list has access to; providing an audit log having entries of accesses made in the past to said specified actions under the first access policy as provided to the access control mechanism and implemented by said computer hardware, each entry in the audit log identifying a person and an associated specified action; submitting a second access policy to said access control mechanism, the second access policy including a second access control list of users and identifying specified actions that each of the users on the second access control list has access to, and wherein some of the users, who made said accesses in the past to said specified actions under said first access policy, are denied access to said specified actions under the second access policy; comparing a number of entries on the audit log, made under the first access policy, to the second access control list of users to determine how a policy change from the first access policy to the second access policy would have influenced past access requests, as a predictor of problems with using the second access policy, including determining which of the persons, identified in said number of entries in the audit log, are not given access, according to the second access control list of users, to the specified actions to which said persons were given access under the first access policy; and based on the results of the comparing, taking one of a predetermined number of actions to provide additional users on the second access control list with access to the specified actions; and wherein: the comparing includes calculating an effective access of a given person under the second access control list, and comparing said effective access to a specific action in the audit log; and the taking one of a number of predetermined actions includes the step of, if said specific action is not allowed to the given person under the second access control list, displaying said specific action to an administrator.