Specifying and enforcing the principle of least privilege in role-based access control

The principle of least privilege in role-based access control (RBAC) is an important area of research. There are two crucial issues related to it: the specification and the enforcement. We believe that existing least privilege specification schemes are not comprehensive enough and few of the enforcement methods are likely to scale well. In this paper, we formally define the basic principle of least privilege and present different variations, called the δ-approx principle of least privilege and the minimizing-approx principle of least privilege. Since there may be more than one result to enforce the same principle of least privilege, we introduce the notation about weights of permission and role to optimize the results. Then we prove that all least privilege problems are NP-complete. As an important contribution of the paper, we show the principle of least privilege problem can be reduced to minimal cost set covering (MCSC) problem. We can borrow the existing solutions of MCSC to solve the principle of least privilege problems. Finally, different algorithms are designed to solve the proposed least privilege problems. Experiments on performance study prove the superiority of our algorithms.