Towards role mining with restricted user-role assignment

RBAC (Role-Based Access Control) is a widely adopted access control model. However, migrating to RBAC requires identification of a complete and correct set of roles. Many bottom-up algorithms have been proposed for mining such roles. These algorithms attempt to find a minimal set of roles that is consistent with a given input configuration. But none of these consider any form of constraint on the maximum number of users that can be assigned to each role. This is a common requirement often termed as `cardinality constraint' which has been widely referred in early RBAC literature. In this paper, we propose three algorithms which identify roles that satisfy such type of constraint. The algorithms vary in their degree of complexity and accuracy. Comparative performance analysis has been done using benchmark datasets.