Specifying and enforcing the principle of least privilege in role-based access control

摘要

The principle of least privilege in role-based access control is an important area of research. There are two crucial issues related to it: the specification and the enforcement. We believe that the existing least privilege specification schemes are not comprehensive enough and few of the enforcement methods are likely to scale well. In this paper, we formally define the basic principle of least privilege problem and present different variations, called the 5-approx principle of least privilege problem and the minimizing-approx principle of least privilege problem. Since there may be more than one result to enforce the same principle of least privilege, we introduce the notation about weights of permissions and roles to optimize the results. Then we prove that all least privilege problems are NP-complete. As an important contribution of the paper, we show that the principle of least privilege problem can be reduced to minimal cost set covering (MCSC) problem. We can borrow the existing solutions of MCSC to solve the principle of least privilege problems. Finally, different algorithms are designed to solve the proposed least privilege problems. Experiments on performance study prove the superiority of our algorithms.