An Approach to Bridge the Gap between Role Mining and Role Engineering via Migration Guides

Abstract

Abstract-Mining approaches, such as role mining or organizational mining, can be applied to derive permissions and roles from a system's configuration or from log files. In this way, mining techniques document the current state of a system and produce current-state RBAC models. However, such currentstate RBAC models most often follow from structures that have evolved over time and are not the result of a systematic rights management procedure. In contrast, role engineering is applied to define a tailored RBAC model for a particular organization or information system. Thus, role engineering techniques produce a target-state RBAC model that is customized for the business processes supported via the respective information system. The migration from a current-state RBAC model to a tailored targetstate RBAC model is, however, a complex task. In this paper, we present a systematic approach to migrate current-state RBAC models to target-state RBAC models. In particular, we use model comparison techniques to identify differences between two RBAC models. Based on these differences, we derive migration rules that define which elements and element relations must be changed, added, or removed. A migration guide then includes all migration rules that need to be applied to a particular current-state RBAC model to produce the corresponding target-state RBAC model. In addition, we discuss different options for tool support and describe our implementation for the derivation of migration guides which is based on the Eclipse Modeling Framework (EMF).

The generalized temporal role mining problem

“…For SCT and WCT, the roles r 1 , r 2 , r 3 , r 4 and r 5 are selected and the triples u 2 , p 1 , 7 AM-8 AM and u 3 , p 4 , 7 AM-8 AM remain uncovered. For SCUT and r 3 , r 5 r 2 r 3 , r 5 r 2 r 3 r 2 r 3 r 2 2 r 1 , r 2 , r 5 , r 8 r 3 , r 5 r 1 , r 2 , r 5 , r 8 r 3 r 2 r 3 r 2 r 3 3 r 1 , r 5 , r 12 r 1 , r 5 , r 9 , r 12 r 1 r 1 , r 9 r 1 r 1 r 1 r 1 4 r 5 , r 12 r 5 , r 12 r 4 , r 6 , r 7 r 4 , r 6 , r 7 , r 9 , r 11 r 5 r 5 r 4 r 4 5 r 4 , r 6 , r 7 r 4 , r 6 , r 7 , r 9 , r 11 r 6 , r 7 r 6 , r 7 r 4 r 4 r 6 r 6 6 r 6 , r 7 r 6 , r 7 r 7 r 7 r 6 r 6 r 7 r 7 7 r 7 r 7 r 5 , r 12 r 5 , r 12 r 7 r 7 r 5 r 5 Table 4 Output for the TUPA of Table 2 (a) UA matrix (b) PA matrix (c) REB r 1 r 2 r 3 r 4 r 5 r 6 r 7 u 1 1 WCUT, the roles r 1 , r 2 , r 3 , r 4 , r 6 and r 7 are selected and the triples u 3 , p 2 , 9 AM-11 AM and u 3 , p 3 , 9 AM-11 AM remain partially covered.…”

“…Baumgrass and Strembeck [1] propose a set of guidelines that allow migration of current-state RBAC models derived from role mining approaches to target-state RBAC models derived from role engineering approaches. Hachana et al [17] formally define the problem of comparing two sets of roles and prove it to be NP-complete.…”