Resiliency Analysis of Role-Based Access Control via Constraint Enforcement and Mathematical Programming
研究了当部分用户缺席时，基于角色的访问控制（RBAC）系统能否确保每个权限都被执行且满足授权约束的韧性检查问题，提出了一种基于Petri网和整数线性规划的方法。
Given a role-based access control (RBAC), resiliency checking problem (RCP) aims at determining whether every permission is executed by a user and all authorization constraints are satisfied when some users become absent. Although the problem is computationally hard, desirable solutions are still expected so as to guarantee the continuity of access control. In this article, we solve RCP for RBAC based on constraint enforcement and mathematical programming. We use Petri nets (PNs) to formalize RBAC. It is shown that each separation of duty constraint imposed on a PN modeling of RBAC can be enforced by a maximally permissive PN-based control structure. After implementing such control structure on the PN modeling of RBAC, we can obtain an admissible RBAC. We show that RCP of RBAC can be transformed into another problem, which determines whether each permission can be executed by a user in the admissible RBAC against the absence of some users. An integer linear programming-based approach is presented to accomplish such verification. The comparison between our approach and the existing one is given to illustrate the effectiveness and efficiency of ours.