The Formalization of Least Privilege Mining in RBAC

Abstract:

Devising a complete and correct set of roles for supporting the least privilege principle has been recognized as one of the most important tasks in implementing RBAC. A key problem is how to find such sets of roles which have the least permissions. However there are too few formalized descriptions and definitions on this problem. In order to provide a material object for researching the least privilege principle, we define the least privilege mining problem (LPMP) and its two variations: δ-approx LPMP and MinNoise LPMP. By showing formalized descriptions, we clarify clearly the methods of discovering least permissions. Correspondingly, we give two simple algorithms to implement the methods.

• Periodical: Key Engineering Materials (Volumes 480-481)
• Pages: 1023-1027
• DOI: https://doi.org/10.4028/www.scientific.net/KEM.480-481.1023
• Online since: June 2011
• Authors: Li Jun Dong, Xiao Jun Kang, Jun Song, Mao Cai Wang
• Keywords: Access Control (AC), Information Security, Least Privilege, RBAC

References

[1] American National Standards Institute, Inc.: American National Stnadard for Inormation Technology-Role Based Access Control (ANSI INCITS359-2004), (2004).

[2] F.B. Schneider. Least privilege and more [computer security]. IEEE Security & Privacy, 2003, 1(5): 55-59.

DOI: 10.1109/msecp.2003.1236236

[3] Timothy E. Levin, Cynthia E. Irvine and Thuy D. Nguyen. Least Privilege in Separation Kernels. Communications in Computer and Information Science, 2008, 9: 146-157.

DOI: 10.1007/978-3-540-70760-8_12

[4] Jaideep Vaidya, Vijayalakshmi Atlur, Qi Guo. The role mining problem: finding a minimal descriptive set of roles. Proceedings of the 12th ACM symposium on Access control models and technologies, 2007, pp.175-184.

DOI: 10.1145/1266840.1266870

[5] R. Simon, and M. Zurko. Separation of duty in role-based environments. In Proceedings of 10th IEEE Computer Security Foundations Workshop, 1997, pp.183-194.

DOI: 10.1109/csfw.1997.596811

[6] Ravi Sandhu and Venkata Bhamidipati, The ASCAA Principles for Next-Generation Role-Based Access Control. Proc. 3rd International Conference on Availability, Reliability and Security, 2008, pp.532-537.

[7] Jorg R. Muhlbacher, Christian Praher. DS RBAC-Dynamic Sessions in Role Based Access Control. Journal of Universal Computer Science, 2009, 15(3): 538~554.

[8] M.A. Habib. Mutual exclusion and role inheritance affecting least privilege in RBAC. 2010 International Conference for Internet Technology and Secured Transactions (ICITST), 2010, pp.1-6.

[9] Liang Chen and Jason Crampton. Inter-domain role mapping and least privilege. Proceedings of the 12th ACM symposium on Access control models and technologies, 2007, pp.157-162.

DOI: 10.1145/1266840.1266866