Mining RBAC Roles under Cardinality Constraint

Role Based Access Control (RBAC) is an effective way of managing permissions assigned to a large number of users in an enterprise. In order to deploy RBAC, a complete and correct set of roles needs to be identified from the existing user permission assignments, keeping the number of roles low. This process is called role mining. After the roles are mined, users are assigned to these roles. While implementing RBAC, it is often required that a single role is not assigned a large number of permissions. Else, any user assigned to that role will be overburdened with too many operations. In this paper, we propose a heuristic bottom-up constrained role mining scheme that satisfies a cardinality condition that no role contains more than a given number of permissions. We compare its results with eight other recently proposed role mining algorithms. It is seen that the proposed scheme always satisfies the cardinality constraint and generates the least number of roles among all the algorithms studied.