Affiliations: [a] Department of Computer Science, State University of New York at Binghamton, Binghamton, NY, USA | [b] Department of Computer Science, California State University at Fullerton, Fullerton, CA, USA | [c] Department of Computer Science, Stony Brook University, Stony Brook, NY, USA | [d] Department of Computer Science, Western Michigan University, Kalamazoo, MI, USA
Abstract: Role based access control (RBAC) is a widely used approach to access control with well-known advantages in managing authorization policies. This paper considers user-role reachability analysis of administrative role based access control (ARBAC), which defines administrative roles and specifies how members of each administrative role can change the RBAC policy. Most existing works on user-role reachability analysis assume the separate administration restriction in ARBAC policies. While this restriction greatly simplifies the user-role reachability analysis, it also limits the expressiveness and applicability of ARBAC. In this paper, we consider analysis of ARBAC without the separate administration restriction and present new techniques to reduce the number of ARBAC rules and users considered during analysis. We also present parallel algorithms that speed up the analysis on multi-core systems. The experimental results show that our techniques significantly reduce the analysis time, making it practical to analyze ARBAC without separate administration.
