On the feasibility of RBAC to ABAC policy mining: A formal analysis

Abstract

Given a Role-Based Access Control (RBAC) system along with supporting attribute data, the process of automated migration to an Attribute-Based Access Control (ABAC) system is a particular instance of the ABAC policy-mining problem. In this paper, we formulate and investigate the feasibility problem of RBAC to ABAC policy mining. Specifically, the ABAC RuleSet Existence problem is introduced formally for the first time in RBAC context. In case of infeasibility, the notion of ABAC RuleSet Infeasibility Correction is formalized and a solution developed utilizing role-based attributes.