Role-Mining Optimization with Separation-of-Duty Constraints and Security Detections for Authorizations

Wei Sun, Shiwei Wei, Huaping Guo and Hongbing Liu
Additional contact information
Wei Sun: Center of Network Information and Computing, Xinyang Normal University, Xinyang 464000, China
Shiwei Wei: School of Computer and Technology, Guilin University of Aerospace Technology, Guilin 541000, China
Huaping Guo: School of Computer and Information Technology, Xinyang Normal University, Xinyang 464000, China
Hongbing Liu: Center of Network Information and Computing, Xinyang Normal University, Xinyang 464000, China

Future Internet, 2019, vol. 11, issue 9, 1-21

Abstract: Role-based access control (RBAC), which has been regarded as one of the most popular access-control mechanisms, is featured by the separation-of-duty constraints, mutually exclusive constraints, and the least-privileges principle. Role mining, a bottom-up role-engineering technology, is an effective method to migrate from a non-RBAC system to an RBAC system. However, conventional role-mining approaches not only do not consider the separation of duty constraints, but also cannot ensure the security of a constructed RBAC system when the corresponding mined results violate the separation of a duty constraint and/or the least-privileges principle. To solve these problems, this paper proposes a novel method called role-mining optimization with separation-of-duty constraints and security detections for authorizations (RMO_SODSDA), which mainly includes two aspects. First, we present a role-mining-optimization approach for satisfying the separation of duty constraints, and we constructed different variants of mutually exclusive constraints to correctly implement the given separation of duty constraints based on unconstrained role mining. Second, to ensure the security of the constructed system and evaluate authorization performance, we reduced the authorization-query problem to a maximal-satisfiability problem. The experiments validate the effectiveness and efficiency of the proposed method.

Keywords: role engineering; role mining; separation of duty constraints; user authorization query (search for similar items in EconPapers)
JEL-codes: O3 (search for similar items in EconPapers)
Date: 2019
References: View references in EconPapers View complete reference list from CitEc
Citations:

Downloads: (external link)
https://www.mdpi.com/1999-5903/11/9/201/pdf (application/pdf)
https://www.mdpi.com/1999-5903/11/9/201/ (text/html)

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:gam:jftint:v:11:y:2019:i:9:p:201-:d:268749

Access Statistics for this article

Future Internet is currently edited by Ms. Grace You

More articles in Future Internet from MDPI
Bibliographic data for series maintained by MDPI Indexing Manager ().