## 4 Proposed Method
### Policy Optimization with Separation-of-Duty Constraints
#### 4.2.2 Construction of t-m MEAR Constraints from k-n SOAR Constraints
However, when the number of users remains constant, the time varies clearly with a varying number of rules. Specifically, for 10 rules, the time always remains around 0.02 s as the number of users varies, while for 30 users, the time varies from around 0.02 to 0.04 as the number of rules varies. This occurs because the more rules

Figure 8: Execution time for different numbers of users and rules. there are, the larger the size of the set of SOAR constraints constructed by the Rel-SAT model counter will be, and the greater the number of MEAR constraints that will be generated using Algorithm 3. Obviously, the total time for the verification of MEAR constraints increases with an increasing number of constraints. ### Discussions

From the above analyses, we present some discussions in the following:

(1) For the sake of brevity, we do not consider the environments, such as time and locations. However, consideration of time factor in the constrained policy engineering is also an interesting topic. Take the dynamic SOD for example, the \(k\)-\(n\) dynamic SOD can be modified as \(dsod<\{t_{1},t_{2},\,\dots,\,t_{i}\,\dots,\,t_{n}\}\), \(k\), \([bt,et]>\), where \([bt,et]\) is a time interval. It states that the enforcement of the SOD constraint is valid from \(bt\) to \(et\). Similarly, both the authorization set and rule set also need to be modified with time intervals. (2) Figures 3 and 4 aim to demonstrate the performance of our method with different number of users and objects, and the result is consistent with the analysis of the computational complexity of Algorithm 2. In fact, VisMAP and Xu-Stoller have the similar performance, which have been presented in the state-of-the-art literatures and also can be observed from Tables 18 and 19. Thus, we do not make the similar figures for VisMAP and Xu-Stoller in our work. (3) Figures 5-7 demonstrate variations of execution time for Xu-Stoller with different number of attribute-value pairs of users and objects, different maximum number of rules used to construct the datasets, and different maximum length of any mining rule, respectively. However, these attribute properties are constant for the evaluation of VisMAP, and thus we do not make the same type of graphs for VisMAP. (4) Although PEO_VR&SOD performs better for mining optimal sets of rules in the above real and synthetic datasets, Either VisMAP or Xu-Stoller does well for some scenarios, and the corresponding synthetic datasets are more appropriate for efficiency evaluations of VisMAP or Xu-Stoller. Specifically, it is observed from Table 18 that, VisMAP outperforms PEO_VR&SOD for execution time with the increasing number of partitions. From Figure 7, the number of users and objects are fixed at 1000 and 100, respectively. Xu-Stoller also outperforms PEO_VR&SOD when the maximum length of any mining rule takes varies of 2 and 3. ## 6 Conclusions

A novel method for policy-engineering optimization called PEO_VR&SOD was proposed in this paper. We first used the visual technique with Hamming distance to reduce the policy-mining scale and presented the policy mining algorithm. Then, we used the method of SAT-based model counting to convert the SOD constraints into the corresponding SOAR constraints and constructed MEAR constraints to implicitly enforce the SOAR constraints in the constructed policy-engineering system. As a result, the proposed method can successfully address the stated problems of enhancing interpretability while mining a minimal set of rules and implicitly enforcing SOD constraints in a constructed ABAC system. The experiments demonstrated that the proposed method is efficient and effective. However, a few interesting issues remain to be solved. One issue is how to implement PEO_VR&SOD in systems such as blockchains, wireless sensor networks, and the internet of things. Another issue is how to implement cardinality constraints for policy-engineering optimizations in future work. Conceptualization, W.S. ; methodology, W.S. ; validation, W.S. and H.S. ; formal analysis, W.S. ; data curation, H.S. and H.X.