Abstract:For a given role-based access control (RBAC) configuration, user-role assignment satisfying least privilege principle (specified as LPUAP) is one of the most important problems to be solved in information security. LPUAP has been proved to be NP-hard. This paper gives several efficient greedy algorithms for handling this problem. Experiment results show that the output of our algorithms is almost optimal while the running time is greatly reduced. In another case where a RBAC configuration is to be set up, minimizing the descriptive set of roles (specified as Basic-RMP) and minimizing the administrative assignments for roles (specified as Edge-RMP) can greatly decrease the management costs. Both role mining problems (i.e., Basic-RMP and Edge-RMP) have also been proved to be NP-hard. This paper converts Basic-RMP to set cover problem and Edge-RMP to weighted set cover problem, and two algorithms respectively named \(GA_{Basic}\) algorithm for Basic-RMP and \(GA_{Edge}\) algorithm for Edge-RMP, are designed. Experiment results show that the average similarity rate between role sets produced by \(GA_{Basic}\) algorithm and the original ones used in generating the dataset is above 90 %. However, in the process of converting role mining into Set Cover Problem, the number of candidate role set is very large. In order to reduce the complexity of the \(GA_{Basic}\) algorithm, this paper presents a new polynomial-time algorithm with a performance nearly the same as that of \(GA_{Basic}\) algorithm.

Greedy Algorithm for Least Privilege in RBAC Model

Handling Least Privilege Problem and Role Mining in Rbac

A Task-Role Based Access Control Model with Multi-Constraints

Role-Based ABAC Model for Implementing Least Privileges

Practical Way to Implement Role-Based Access Control in Security Administration System

A Security Violation Detection Method For Rbac Based Interoperation

Implementing the principle of least administrative privilege on operating systems: challenges and perspectives

Design and Implementation of Context-Aware RBAC Model Based on Reasoning

Enforcing the principle of least privilege with a state-based privilege control model

The Privilege Control of the Users Role Hierarchies Based on RBAC

A Semantic and Trust Based Framework for Rbac User-Role Assignment

A Framework for Implementing Dynamically Modified Least Privilege Security Policy

Towards a Group-Based RBAC Model and Decentralized User-Role Administration

Security Violation Detection for RBAC Based Interoperation in Distributed Environment

Role Permission in Hierarchy Relation of RBAC Model

Separation of Duty Constraint for Permission Based Delegation Model

Selective Regression Test for Access Control System Employing RBAC

A Role Manage Method Based on RBAC

Extended RBAC Model and Application

Inconsistency Resolution Method for RBAC Based Interoperation

An Extended RBAC Model Based on Granular Logic