An analysis of graphs that represent a role-based security policy hierarchy

Article type: Research Article

Authors: Belim, Sergey^{; *} | Bogachenko, Nadezda | Ilushechkin, Evgeniy

Affiliations: Omsk F.M. Dostoevsky State University, Omsk, Russia. E-mails: sbelim@mail.ru, nfbogachenko@mail.ru

Correspondence: [*] Corresponding author: Sergey Belim, Omsk F.M. Dostoevsky State University, Omsk, Russia. E-mail: sbelim@mail.ru.

Abstract: The present work considers structural modification of the role hierarchy in a formal model of the role-based access control. The marked directed graph (the role graph), graphically representing an ordered set of roles, was analyzed to define the ordering relation in the role set and to distribute permissions according to the generated hierarchy. We constructed algorithms of the role graph’s transformations using different criteria of optimality and proved correctness of these algorithms. In the process, such characteristics as principles of permission distribution in the system, presence of role duplicates, the role graph’s peculiarities, e.g. how tree-like the graph is, were considered. The main result of the work is proof of possibility of constructing several role graphs corresponding to the same RBAC model. Thus, on the basis of relevant criteria, one can transform the role graph to make analysis and modification of a given RBAC model more effective.

Keywords: Role-based access control, permission distribution, equivalence classes of roles, role hierarchy

DOI: 10.3233/JCS-150532

Journal: Journal of Computer Security, vol. 23, no. 5, pp. 641-657, 2015