Planning user assignment in administrative role-based access control

By introducing prerequisite conditions into the user-role assignment component (URA), administrative role-based access control model (ARBAC) has decentralized the user-role assignment without losing the centralized control on security policies. However, in a large-scale role-based access control (RBAC) system, employing the URA makes it very difficult to manually obtain a sequence of the administrative operators by which a given user can be assigned to a given role. We refer to this problem as the user assignment problem (UAP). We formalized the UAP and recognized the UAP as an exponential space complexity problem. We also presented a graph-based search technology to solve the UAP, which was shown to be practically feasible in large-scaled RBAC systems.