IDEAS home Printed from https://ideas.repec.org/a/gam/jftint/v11y2019i9p201-d268749.html
   My bibliography  Save this article

Role-Mining Optimization with Separation-of-Duty Constraints and Security Detections for Authorizations

Author

Listed:
  • Wei Sun

    (Center of Network Information and Computing, Xinyang Normal University, Xinyang 464000, China)

  • Shiwei Wei

    (School of Computer and Technology, Guilin University of Aerospace Technology, Guilin 541000, China)

  • Huaping Guo

    (School of Computer and Information Technology, Xinyang Normal University, Xinyang 464000, China)

  • Hongbing Liu

    (Center of Network Information and Computing, Xinyang Normal University, Xinyang 464000, China)

Abstract

Role-based access control (RBAC), which has been regarded as one of the most popular access-control mechanisms, is featured by the separation-of-duty constraints, mutually exclusive constraints, and the least-privileges principle. Role mining, a bottom-up role-engineering technology, is an effective method to migrate from a non-RBAC system to an RBAC system. However, conventional role-mining approaches not only do not consider the separation of duty constraints, but also cannot ensure the security of a constructed RBAC system when the corresponding mined results violate the separation of a duty constraint and/or the least-privileges principle. To solve these problems, this paper proposes a novel method called role-mining optimization with separation-of-duty constraints and security detections for authorizations (RMO_SODSDA), which mainly includes two aspects. First, we present a role-mining-optimization approach for satisfying the separation of duty constraints, and we constructed different variants of mutually exclusive constraints to correctly implement the given separation of duty constraints based on unconstrained role mining. Second, to ensure the security of the constructed system and evaluate authorization performance, we reduced the authorization-query problem to a maximal-satisfiability problem. The experiments validate the effectiveness and efficiency of the proposed method.

Suggested Citation

  • Wei Sun & Shiwei Wei & Huaping Guo & Hongbing Liu, 2019. "Role-Mining Optimization with Separation-of-Duty Constraints and Security Detections for Authorizations," Future Internet, MDPI, vol. 11(9), pages 1-21, September.
    • Handle: RePEc:gam:jftint:v:11:y:2019:i:9:p:201-:d:268749
    as

    Download full text from publisher

    File URL: https://www.mdpi.com/1999-5903/11/9/201/pdf
    Download Restriction: no
    File URL: https://www.mdpi.com/1999-5903/11/9/201/
    Download Restriction: no
    ---><---

    References listed on IDEAS

    as
    1. Sigrid Schefer-Wenzl & Mark Strembeck, 2014. "Modeling Support for Role-Based Delegation in Process-Aware Information Systems," Business & Information Systems Engineering: The International Journal of WIRTSCHAFTSINFORMATIK, Springer;Gesellschaft für Informatik e.V. (GI), vol. 6(4), pages 215-237, August.
    2. Hejiao Huang & Feng Shang & Jinling Liu & Hongwei Du, 2015. "Handling least privilege problem and role mining in RBAC," Journal of Combinatorial Optimization, Springer, vol. 30(1), pages 63-86, July.
    Full references (including those not matched with items on IDEAS)

    Most related items

    These are the items that most often cite the same works as this one and are cited by the same works as this one.
    1. Tao Wang & Qiang Wu, 2023. "Role Minimization Optimization Algorithm Based on Concept Lattice Factor," Mathematics, MDPI, vol. 11(14), pages 1-13, July.

    Corrections

    All material on this site has been provided by the respective publishers and authors. You can help correct errors and omissions. When requesting a correction, please mention this item's handle: RePEc:gam:jftint:v:11:y:2019:i:9:p:201-:d:268749. See general information about how to correct material in RePEc.

    If you have authored this item and are not yet registered with RePEc, we encourage you to do it here. This allows to link your profile to this item. It also allows you to accept potential citations to this item that we are uncertain about.

    If CitEc recognized a bibliographic reference but did not link an item in RePEc to it, you can help with this form .

    If you know of missing items citing this one, you can help us creating those links by adding the relevant references in the same way as above, for each refering item. If you are a registered author of this item, you may also want to check the "citations" tab in your RePEc Author Service profile, as there may be some citations waiting for confirmation.

    For technical questions regarding this item, or to correct its authors, title, abstract, bibliographic or download information, contact: MDPI Indexing Manager (email available below). General contact details of provider: https://www.mdpi.com .

    Please note that corrections may take a couple of weeks to filter through the various RePEc services.

    IDEAS is a RePEc service. RePEc uses bibliographic data supplied by the respective publishers.