Description

This paper offers a new role engineering approach toRole-Based Access Control(RBAC), referred to asvisual role mining.The key idea is to graphically represent user-permission assignments to enable quick analysis and elicitation of meaningful roles. First,we formally define the problem by introducing a metric for the quality of the visualization. Then, we prove that finding the best representation according to the defined metric is aNP-hard problem. In turn, we propose two algorithms: o ADVISER o EXTRACT. The former is a heuristic used to best represent the user-permission assignments of a given set of roles. The latter is a fast probabilistic algorithm that, when used in conjunction with ADVISER, allows for a visual elicitation of roles even in absence of predefined roles. Besides being rooted in sound theory, our proposal is supported by extensive simulations run over real data. Results confirm the quality of the proposal and demonstrate its viability in supporting role engineering decisions.