How to Discover High-Quality Roles? A Survey and Dependency Analysis of Quality Criteria in Role Mining

Abstract

Abstract.Roles have evolved into the de facto standard for access control in Enterprise Identity Management. However, companies struggle to develop and maintain a role-based access control state. For the initial role deployment, role mining is widely used. Due to the high number and complexity of available role mining algorithms, companies fail to perceive which is selected best according to their needs. Furthermore, requirements on the composition of roles such as reduction of administration cost are to be taken into account in role development. In order to give them guidance, in this paper we aggregate existing role mining approaches and classify them. For consideration of individual prerequisites we extract quality criteria that should be met. Later on, we discuss interdependencies between the criteria to help role developers avoid unwanted side-effects and produce RBAC states that are tailored to their preferences.

Optimization of Access Control Policies

“…The initial creation of ACPs with high quality is addressed by ACP modelling approaches. Existing approaches differ greatly in terms of modelling objectives and their definitions of optimal ACPs (Kunz et al, 2015b;Mitra et al, 2016). Existing proposals typically focus on policy mining, i.e.…”

“…Beckerle and Martucci (2013) developed six criteria to determine well-usable ACPs sets and developed metrics to quantify these. Both Kunz et al (2015b) and Mitra et al (2016) present surveys on role mining approaches and point out objectives that role mining algorithms apply to achieve high-quality roles. Jabal et al (2019) define a list of policy analysis criteria with implications to the policy quality.…”

“…At the same time, the complexity of the policy is increased, which suggests a negative correlation between the objectives of minimal complexity and maximal completeness. Kunz et al (2015b) present a dependency analysis of quality criteria applied during role mining. Despite that, to the best of our knowledge, the interaction of ACP quality criteria has not been analyzed by scientific research yet.…”

“…If an ACP set does not cover UPAs, an access control mechanism is unable to determine an access control decision for the corresponding user-permission pair during policy evaluation (except for a standard fallback decision). The criterion of completeness is also often used in ACP modelling to determine to which extent a newly modelled ACP set expresses the UPAs defined by an input state (Kunz et al, 2015b). The term coverage is closely related and often used interchangeably, but does not necessarily contain a quality indication.…”

Access Control Role Evolution Mechanism for Open Computing Environment

“…Since the existing role mining method does not consider existing roles in the system, Zhai et al [39] optimized the role mining process by calculating the similarity between the newly generated role set and the original role set. For the problem of role mining under incomplete knowledge condition, Kunz et al [40] studied the quality criteria and feature dependence of role mining technology from 22 dimensions. Blundo et al [41] constrained the role mining process by the number of contained permissions in the role and the number of contained in the user.…”