A cost-driven approach to role engineering

In recent years role-based access control (RBAC) has been spreading within organizations. However, companies still have considerable difficulty migrating to this model, due to the complexity involved in identifying a set of roles fitting the real needs of the company. All the various role engineering methods proposed thus far lack a metric for measuring the "quality" of candidate roles produced. This paper proposes a new approach guided by a cost-based metric, where "cost" represents the effort to administer the resulting RBAC. Further, we propose RBAM (Role-Based Association-rule Mining), an algorithm leveraging the cost metric to find candidate role-sets with the lowest possible administration cost. For a specific parameter set, RBAM behaves as already existing role mining algorithms and is, worst case, NP-complete. Yet, we will provide several examples showing the sensibility of assumptions made by the algorithm. Further, application of the algorithm to real dat...

• Type: Journal
• Year: 2008
• Where: SAC
• Authors: Alessandro Colantonio, Roberto Di Pietro, Alberto Ocello
• Keywords: Algorithms, Applied Computing, Role-based Access Control, Role-Based Association-rule Mining, SAC 2008