# A Model Study on Collaborative Learning and Exploration of RBAC Roles

Authors: Jiyong Yang; Xiajiong Shen; Wan Chen; Qiang Ge; Lei Zhang; HaoLin Chen
Journal: Wireless Communications and Mobile Computing
 (2021)

---

## Abstract

Role-based access control (RBAC) can effectively guarantee the security of user system data. With its good flexibility and security, RBAC occupies a mainstream position in the field of access control. However, the complexity and time-consuming of the role establishment process seriously hinder the development and application of the RBAC model. The introduction of the assistant interactive question answering algorithm based on attribute exploration (semiautomatic heuristic way to build an RBAC system) greatly reduces the complexity of building a role system. However, there are some defects in the auxiliary interactive Q&A algorithm based on attribute exploration. The algorithm is not only unable to support multiperson collaborative work but also difficult to find qualified Q&A experts in practical work. Aiming at the above problems, this paper proposes a model collaborative learning and exploration of RBAC roles under the framework of attribute exploration. In this model, after interactive Q&A with experts in different permissions systems by using attribute exploration, the obtained results are merged and calculated to get the correct role system. This model not only avoids the time-consuming process of role requirement analysis but also provides a feasible scheme for collaborative role discovery in multidepartment permissions.


---

## Body

## 1. Introduction

With the development of the information system, information sharing among people becomes more and more convenient and fast. However, the “explosive” growth of the information system brings people convenient and quick access to information, and it also brings the problem of information security. It is not only the sharing of information between people that needs to be protected but also the information between industrial systems. For example, when computing matrix in the research field of Kalman filtering, multiple computing contents need to be encrypted [1, 2].To prevent the intrusion of illegal users or leakage caused by the careless operation of legal users, many solutions have been proposed [3, 4]. For example, Lihua proposes a new privacy protection scheme, which plays a good role in protecting privacy [5]. Access control allows users to access system resources only according to their permissions setting and may not exceed their permissions. To ensure flexibility and security, role-based access control (RBAC) [6] has been widely studied and applied due to its good applicability and occupies a mainstream position in the access control model [7]. The RBAC model introduces roles between users and permissions; connects users and permissions with roles and grants and revokes access permissions to users by assigning and canceling roles to users; and realizes the logical separation of users and access permissions [8]. Flexibility in permission management and its high correlation with an enterprise’s organizational structure greatly facilitate permission management [9].However, the increasing complexity of the information system leads to the increasing complexity of the RBAC model system construction [10]. In the design and use of a traditional RBAC system, the relationship between “users and roles” and “roles and permissions” is dependent on the acquisition of system requirement information and the personal experience of administrators. With the increasing complexity and diversification of the information system, the number of users, resources, and permissions in access control is increasing, and the business process and related domain knowledge of information systems are becoming complex. As a result, designing and managing an RBAC system that meets the functional and security needs of users solely relying on human beings is challenging [11]. With the development and prosperity of machine learning has given us more ways and methods to solve problems, machine learning is applied in various fields [12]. Many scholars have also applied machine learning to information security, Sun proposes an ESS-based algorithm of balancing the QoS and privacy risk, which reaches a stable state of maintaining long-term service by multiple iterations [13], and Yin uses a recursive neural network for intrusion detection [14]. In addition, machine learning is also applied to various fields, such as hyperspectral image processing and classification [15, 16]. With the prosperity and development of information system, information security combined with many research fields has been widely discussed and studied [17, 18].Among them, zhang Lei [19] proposed an auxiliary interactive question answering algorithm based on attribute exploration and used the attribute exploration algorithm to interact with experts to get the required roles and the partial order relationship between roles in the RBAC system. The reason why the attribute exploration algorithm [20] can obtain the roles and the partial order relationship between roles is that the attribute exploration algorithm is an important tool in the formal concept analysis [21]. Formal concept analysis is considered as a favorable tool for data analysis and knowledge description and has been widely used in data analysis [22], knowledge discovery [23], rule extraction [24], concept cognitive learning [25], and other fields. Among them, the important data structure-concept lattice [26] can well represent the partial order structure among data. Each lattice node on the concept lattice is composed of a group of intent and extent which have a natural correspondence with roles and permissions in role engineering. The role system mined by the concept lattice theory can not only reflect the hierarchical relationship between the roles but also ensure the correctness of the roles mined [27].Although the auxiliary interactive question answering algorithm based on attribute exploration can accomplish the role design of RBAC with heuristic assistance, the traditional attribute algorithm relies on the complete system permissions knowledge. In practice, it is difficult to find people who have a good knowledge of all permissions, especially when the permissions are involved in multiple departments. For example, it is difficult to find an expert who knows all the permissions information well when constructing the role of the administration system in conjunction with the faculty system. This defect severely limits the development and application of the RBAC model.In this paper, it is found that the Duquenne–Guigues and the set of roles obtained by the auxiliary interactive question answering algorithm based on attribute exploration have a close relationship with the whole system, but also have a close relationship with the local subsystem. Therefore, we can find an interactive domain expert in each one and merge the roles and Duquenne–Guigues of each system after the interaction of multiple systems is completed, to obtain the set of the Duquenne–Guigues and roles of the entire system.Therefore, this paper proposes a model collaborative learning and exploration of RBAC roles (RCLE). Under the framework of interactive Q&A of property exploration, a method is designed to support the role discovery of the same group of users under different permission systems. This model not only avoids the time-consuming process of role demand analysis and questionnaire survey in the process of role construction but also avoids the defects of the auxiliary interactive question and answer algorithm of attribute exploration in the construction of role system across departments.


## 2. Basic Definition

The relevant definitions used in this article are as follows [23, 25, 26]:Definition 1.
An access security contextK=U,M,I is composed of two sets U, M, and I (the relationship between U and M). The element of U is called user (object), and the element of M is called permission (attribute). u,m∈Ior uImmeans that user uhas permission m. We useu,m∉I, which means that useru does not have permission m.Definition 2.
SetK=U,M,I that is an access security context, ifA⊆U,B⊆M, then write
(1)fA=m∈M∣∀u∈A∈A,u,m∈I,(2)gB=u∈U∣∀∀m∈B,u,m∈I.
IfA and B satisfy thatfA=B and gB=A, then we call the binary group A,B a concept. A is the extent of the concept A,B, and B is the intent of the concept A,B.
The computation of Definition2 is carried out throughout the text. Definition 2 shows how to compute concepts in a given access security context. Since more than one formal context will be involved in the following paragraphs, for the convenience of distinguishing,f1A and g1B represent the calculation of fA and gB on the formal context K1.
The concept of access security contextK=U,M,I has the following basic properties (∀A,A1,A2⊆U,∀B,B1,B2⊆M):Property 3.
A1⊆A2⇒fA2⊆fA1; B1⊆B2⇒gB2⊆gB1; A⊆gfA; B⊆fgB; if B=fgB, then B is intent on the access security contextK.Definition 4.
SetU,M,I is an access security context, Y⊆M, and satisfies
(1)
Y≠fgYY⊆fgY,(2)
Each pseudointentY1⊂Y hasfgY1⊆Y. Then, Y is a pseudointent.
Definition4 provides the conditions for the establishment of pseudointent. To prove whether an attribute set is a pseudointent, we only need to verify whether it meets the two conditions of Theorem 14.Definition 5.
SetK=U,M,I is an access security context, Y1, Y2⊆M. if gY1⊆gY2, then Y1⟶Y2 is true inK.Definition 6.
IfK=U,M,I is an access security context, then the value dependency set {X⟶fgX∣X is the pseudointent of K} which is the Duquenne–Guigues of K.Definition 7.
Given access security contextK=U,M,I, implication set JK, and implication formula C⟶D∈JK, the attribute set if and only if T⊆MC⊈Tor D⊆T, called T, is associated withC⟶D. If T is related to all the implication forms in JK, then T is related to JK.According to the value dependence theory of concept lattice, the Duquenne–Guigues can produce all value dependence held in an access security context, namely, the implication relation of an attribute. It can be seen from definition6 that the Duquenne–Guigues of access security context can be obtained as long as all pseudointents are found. The correlation judgment between attribute set and implication set in Definition 7 can be used in the calculation of pseudointent.Definition 8.
LetK=U,M,I be an access security context,M=m1,m2⋯mn, and the permission (attribute) in M satisfies the basic linear order relationship m1<m2<··<mn. For anyY1,Y2⊆M if and only if there is mi∈Y2−Y1 and Y1∩m1,⋯,mi−1=Y2∩m1,⋯,mi−1, the lexicographical order of attribute setY1 is less than the lexicographical order of permission (attribute)set Y2, denoted as Y1<Y2.Definition8 describes the lexicographical order relation of the property set < which is a linear order relation of 2M. All property sets can be generated one by one according to the lexicographical order and tested one by one to see if the property set is a pseudointent or intent.


## 3. A Model for Collaborative Learning and Exploration of RBAC Roles

The attribute exploration algorithm interacts with domain experts by asking questions, traverses the attribute set in lexicographical order, and tests whether the set is pseudointent or intent. The use is the attribute set of the pseudointent to produce the implication, so as to construct the Duquenne–Guigues of the access security context and obtain the relevant context knowledge. Lexicographical order < is a linear order on the power set of all permission (attribute), which guarantees the completeness of the attribute exploration algorithm. In other words, the set of roles obtained by the traditional role discovery algorithm based on attribute exploration is complete. However, due to the lack of cooperation mechanism, traditional role discovery algorithms based on attribute exploration cannot build a role system across departments.The key to the above problem is how to discover the set of roles and the implication relationship between permissions under multiple permission systems (Duquenne–Guigues). In this paper, we found that after the attribute exploration among different departments, we further analyzed and summarized the roles and Duquenne–Guigues under different permissions systems, so as to obtain the role construction of the crossdepartment permission system.


### 3.1. Basic Theorem

To facilitate the elaboration, we first make the following definition.Definition 9.
Given an access security contextK1=U1,M1,I1 and K2=U2,M2,I2, ∀g∈U1∩U2, and ∀b∈M1∩M2 that meet gI1b⇔gI2b then called K1 is consistent withK2.Definition 10.
A model for collaborative learning and exploration of RBAC rolesRCLE=K1,K2,JK1,CK1,JK2,CK2,K1=U1,M1,I1, K2=U2,M2,I2, U1=U2=g1,g2,g3,g4⋯, and M1=a1,b1,c1,d1⋯, M2=a2,b2,c2,d2⋯I, represents the relationship between Ui and M. M and I are consistent in K1 and K2, JK1, JK2,CK1, and CK2, respectively, and represent the Duquenne–Guigues and intent of K1 and K2.Based on the above definition, we have the following findings, which can be used as the theoretical basis of theRCLE model.Theorem 11.
Given an access security contextK=U,M,I, the Duquenne–Guigues JK, and implication formula A⟶B∈JK, if the attribute set isT⊆Mand if A⊆T, B⊈T, the attribute set T in the access security context K is neither intent nor pseudointent.Proof.
Firstly, proofT is not intent. A⊆T, B⊈T, we knew from property 3 that T⊆fgT, then A⊆T⊆fgT, fgA⊆fgT. Subtract A from both ends of fgA⊆fgT and get fgA−A⊆fgT−A. And because A⟶B∈JK, then fgA−A=B. Because D⊈T, then fgT−A⊈T. Add A to both ends of fgT−A⊈T, get fgT⊈T∪A. Because A⊆T, therefore, fgT⊈T, T, is not intent.(2) Lastly, proofT is not pseudointent. IfT satisfies the definition of the pseudointent (2), then each pseudointent Y1⊂Tmust meetfgY1⊆T, becauseA⟶B∈JK. Thus, in K, A is a pseudointent. Because of A⊆T,fgA=B⊈T. Therefore, T does not satisfy the definition of pseudointent (2) thatT is not a pseudointent in K.Theorem11 shows that the set of permissions (attributes) is neither intent nor pseudointent if it is not related to any implication in the Duquenne–Guigues. Because in the attribute exploration, only the set of permissions (attributes) that are intent or pseudointent are considered, and the set of permissions (attributes) that satisfy theorem 11 can be ignored and not calculated.Theorem 12.
RCLE=K1,K2,JK1,CK1,JK2,CK2, K1=U1,M1,I1, K2=U2,M2,I2, access security contextK=K1+K2, and the Duquenne–Guigues ofKisJK. The permission set D is related toJK, D⟶f1g1D−D∈JK1. If f1g1D∪f2g1D≠D then D⟶f1g1D∪f2g1D−D∈JK. If f1g1D∪f2g1D=D, then f1g1D∪f2g1D∈CK.Proof.
BecauseD is related toJK, so by definition 7, we know that D is intent or pseudointent. D⟶f1g1D−D∈JK1, then in K1, the users that coown the permission set D are g1D. According to definition 10,U1=U2=U. Because K=K1+K2, so fgD=f1g1D∪f2g1D. If f1g1D∪f2g1D≠D, then D is a pseudointent; so, D⟶f1g1D∪f2g1D−D∈JK. If f1g1D∪f2g1D=D, then D is an intent, so f1g1D∪f2g1D∈CK.Inference 13.
RCLE=K1,K2,JK1,CK1,JK2,CK2, K1=U1,M1,I1, K2=U2,M2,I2, access security contextK=K1+K2, and the Duquenne–Guigues of K are JK. The permission set D is related toJK, D⟶f2g2D−D∈JK2. If f2g2D∪f1g2D≠D, then D⟶f2g2D∪f1g2D−D∈JK. If f2g2D∪f1g2D=D, then f2g2D∪f1g2D∈CK.Theorem 14.
RCLE=K1,K2,JK1,CK1,JK2,CK2, K1=U1,M1,I1, K2=U2,M2,I2, access security contextK=K1+K2, and the Duquenne–Guigues of K are JK. The permission set D is related toJK,D∈CK1. If D∪f2g1D=D, then D∪f2g1D∈CK. If D∪f2g1D≠D, then D⟶D∪f2g1D∈JK.Proof.
BecauseD is related toJK, so by definition 7, we know that D is intent or pseudointent. D∈CK1, and then in K1, the users that coown the permission set D are g1D. According to definition 10,U1=U2=U. Because K=K1+K2, so fgD=f1g1D∪f2g1D. If f1g1D∪f2g1D≠D, then D is a pseudointent, so D⟶D∪f2g1D=D−D∈JK. If D∪f2g1D=D, then D is an intent, so f1g1D∪f2g1D∈CK.Inference 15.
RCLE=K1,K2,JK1,CK1,JK2,CK2, K1=U1,M1,I1, K2=U2,M2,I2, access security contextK=K1+K2, and the Duquenne–Guigues of K are JK. The permission set D is related toJK, D∈CK2. If D∪f1g2D=D, then D∪f1g2D∈CK. If D∪f1g2D≠D, then D⟶D∪f1g2D∈JK.Theorems12 and 14 show that in the RCLE model, if a permission set is related to the Duquenne–Guigues of an access security context, then we can use the results obtained in the subdivision to carry out the union operation with the results calculated by other departments and judge whether the obtained results are intent or pseudointent.


## 3.1. Basic Theorem

To facilitate the elaboration, we first make the following definition.Definition 9.
Given an access security contextK1=U1,M1,I1 and K2=U2,M2,I2, ∀g∈U1∩U2, and ∀b∈M1∩M2 that meet gI1b⇔gI2b then called K1 is consistent withK2.Definition 10.
A model for collaborative learning and exploration of RBAC rolesRCLE=K1,K2,JK1,CK1,JK2,CK2,K1=U1,M1,I1, K2=U2,M2,I2, U1=U2=g1,g2,g3,g4⋯, and M1=a1,b1,c1,d1⋯, M2=a2,b2,c2,d2⋯I, represents the relationship between Ui and M. M and I are consistent in K1 and K2, JK1, JK2,CK1, and CK2, respectively, and represent the Duquenne–Guigues and intent of K1 and K2.Based on the above definition, we have the following findings, which can be used as the theoretical basis of theRCLE model.Theorem 11.
Given an access security contextK=U,M,I, the Duquenne–Guigues JK, and implication formula A⟶B∈JK, if the attribute set isT⊆Mand if A⊆T, B⊈T, the attribute set T in the access security context K is neither intent nor pseudointent.Proof.
Firstly, proofT is not intent. A⊆T, B⊈T, we knew from property 3 that T⊆fgT, then A⊆T⊆fgT, fgA⊆fgT. Subtract A from both ends of fgA⊆fgT and get fgA−A⊆fgT−A. And because A⟶B∈JK, then fgA−A=B. Because D⊈T, then fgT−A⊈T. Add A to both ends of fgT−A⊈T, get fgT⊈T∪A. Because A⊆T, therefore, fgT⊈T, T, is not intent.(2) Lastly, proofT is not pseudointent. IfT satisfies the definition of the pseudointent (2), then each pseudointent Y1⊂Tmust meetfgY1⊆T, becauseA⟶B∈JK. Thus, in K, A is a pseudointent. Because of A⊆T,fgA=B⊈T. Therefore, T does not satisfy the definition of pseudointent (2) thatT is not a pseudointent in K.Theorem11 shows that the set of permissions (attributes) is neither intent nor pseudointent if it is not related to any implication in the Duquenne–Guigues. Because in the attribute exploration, only the set of permissions (attributes) that are intent or pseudointent are considered, and the set of permissions (attributes) that satisfy theorem 11 can be ignored and not calculated.Theorem 12.
RCLE=K1,K2,JK1,CK1,JK2,CK2, K1=U1,M1,I1, K2=U2,M2,I2, access security contextK=K1+K2, and the Duquenne–Guigues ofKisJK. The permission set D is related toJK, D⟶f1g1D−D∈JK1. If f1g1D∪f2g1D≠D then D⟶f1g1D∪f2g1D−D∈JK. If f1g1D∪f2g1D=D, then f1g1D∪f2g1D∈CK.Proof.
BecauseD is related toJK, so by definition 7, we know that D is intent or pseudointent. D⟶f1g1D−D∈JK1, then in K1, the users that coown the permission set D are g1D. According to definition 10,U1=U2=U. Because K=K1+K2, so fgD=f1g1D∪f2g1D. If f1g1D∪f2g1D≠D, then D is a pseudointent; so, D⟶f1g1D∪f2g1D−D∈JK. If f1g1D∪f2g1D=D, then D is an intent, so f1g1D∪f2g1D∈CK.Inference 13.
RCLE=K1,K2,JK1,CK1,JK2,CK2, K1=U1,M1,I1, K2=U2,M2,I2, access security contextK=K1+K2, and the Duquenne–Guigues of K are JK. The permission set D is related toJK, D⟶f2g2D−D∈JK2. If f2g2D∪f1g2D≠D, then D⟶f2g2D∪f1g2D−D∈JK. If f2g2D∪f1g2D=D, then f2g2D∪f1g2D∈CK.Theorem 14.
RCLE=K1,K2,JK1,CK1,JK2,CK2, K1=U1,M1,I1, K2=U2,M2,I2, access security contextK=K1+K2, and the Duquenne–Guigues of K are JK. The permission set D is related toJK,D∈CK1. If D∪f2g1D=D, then D∪f2g1D∈CK. If D∪f2g1D≠D, then D⟶D∪f2g1D∈JK.Proof.
BecauseD is related toJK, so by definition 7, we know that D is intent or pseudointent. D∈CK1, and then in K1, the users that coown the permission set D are g1D. According to definition 10,U1=U2=U. Because K=K1+K2, so fgD=f1g1D∪f2g1D. If f1g1D∪f2g1D≠D, then D is a pseudointent, so D⟶D∪f2g1D=D−D∈JK. If D∪f2g1D=D, then D is an intent, so f1g1D∪f2g1D∈CK.Inference 15.
RCLE=K1,K2,JK1,CK1,JK2,CK2, K1=U1,M1,I1, K2=U2,M2,I2, access security contextK=K1+K2, and the Duquenne–Guigues of K are JK. The permission set D is related toJK, D∈CK2. If D∪f1g2D=D, then D∪f1g2D∈CK. If D∪f1g2D≠D, then D⟶D∪f1g2D∈JK.Theorems12 and 14 show that in the RCLE model, if a permission set is related to the Duquenne–Guigues of an access security context, then we can use the results obtained in the subdivision to carry out the union operation with the results calculated by other departments and judge whether the obtained results are intent or pseudointent.


## 4. RCLE Model Framework

Based on the above definitions and theorems, this section designs a model of RBAC role collaborative learning and exploration (RCLE) by referring to the framework of traditional attribute exploration algorithm and expert questions. the algorithm uses the traditional attribute exploration framework to discover the roles of different permissions system, then automatically revises the set of roles and the Duquenne–Guigues according to the obtained knowledge and the proposed theorem. In this way, we can get the required roles and the implication relationship between permissions and permissions of the system after the fusion of multiple systems. The model architecture is shown in Figure 1.Figure 1
RCLE model framework.Algorithm 1:RCLE algorithm description.
Input: two access security contextsK1=U1,M1,I1, K2=U2,M2,I2; Duquenne–Guigues JK1, JK2; intent set CK1,CK2Output: access security context K, JK, CKBEGIN1.JK=∅, CK=∅2.K=K1∪K23. WHILE (B≠M)4. IF (B∈CK1) THEN5. IF (B∪f1g2B==B) THEN6.  AddB∪f1g2B toCK7. ELSE8.  AddB⟶B∪f1g2B−B toJK9. END IF10.B =FindNextB(JK,B)11.  Continue12. END IF13. IF (B∈CK2) THEN14.  IF (B∪f2g1B==B) THEN15.   AddB∪f2g1B toCK16.  ELSE17.   AddB⟶B∪f2g1B−B toJK18.  END IF19.  B=FindNextB(JK,B)20.  Continue21. END IF22.  IF (B∈JK1) THEN23.   IF (f1g1B∪f2g1B==B) THEN24.    Addf1g1B∪f2g1B toCK25.   ELSE26.    AddB⟶f1g1B∪f2g1B toJK27.   END IF28.   B=FindNextB(JK,B)29.   Continue30.  END IF31.  IF (B∈JK2) THEN32.   IF (f2g2B∪f1g2B==B) THEN33.    Addf2g2B∪f1g2B toCK34.   ELSE35.    AddB⟶f2g2B∪f1g2B toJK36.   END IF37.   B=FindNextB(JK,B)38.   Continue39. END IF40. IF (fgB≠Bi)41.JK=JK∪(B⟶fgB−B)42. ELSE43.CK=CK∪(B)44. END IF45. END WHILE46. ENDUsing the attribute exploration algorithm, the role discovery algorithm interacts with system security managers in different departments to obtain the required set of roles (intent) and the set of implications between permissions (Duquenne–Guigues) in each department. The following is the specific process of the attribute exploration role discovery algorithm:At the beginning of the algorithm, the access security context is empty, the Duquenne–Guigues is empty, and the intent set is empty. Then, the set of attributes to be tested is continuously generated in lexicographic order, and an expert is asked if the implication with the attribute set as the preceding is true. If not, add a counterexample to the access security context and recalculate. If true, the attribute set is judged to be intent or pseudointent. If it is a pseudointent, then an implication form with the pseudointent added to the Duquenne–Guigues. If it is not a pseudointent, according to the value dependence of the concept lattice and the correlation theory of the attribute set, it must be intent, and then the attribute set is added to the intent set.The set of roles and the Duquenne–Guigues obtained are substituted into theRCLE model, and the set of roles and the Duquenne–Guigues required in the system after multidepartment system fusion are calculated. At the initial stage of the algorithm, the access security context is the union of multiple access security contexts, the Duquenne–Guigues is empty, and the set of roles is empty. In line 1 of the algorithm to determine whether the algorithm has reached the end state. Inline 4-8 of the algorithm, it means that the permissions set belongs to the role set of departments 1; so, the permissions jointly owned by users in department 1 and department 2 are calculated. Line 9-13 of the algorithm indicates that the permission set belongs to the role set of department 2; so, the permissions jointly owned by users in department 2 who have B permission set are calculated in department 1. Algorithm 14-23 is the processing process of the B permission set. Line 24-28 of the algorithm is the process where B does not exist in the set of roles of department 1 and department 2, nor in their Duquenne–Guigues, where the findNextB algorithm calculates the next permission set of B′ according to the correlation definition.Algorithm 2:findNextB algorithm description.
Input: Attribute set B, implies set JKOutput: The next attribute set NextBBEGIN1.B′=Find the lexicographic order of B s next2. Flag = TRUE3. WHILE(Flag)4.  FOR eacha1⟶b1∈JK5.   IF (a1⊆B′&&b1⊈B′)THEN6.B′=Find the lexicographic order of B′ next7.    BREAK8.   ELSE9.    RETURNB′10.   END IF11.  END FOR12. END


## 5. Example of theRCLE Algorithm Process

This section illustrates the running process of theRCLE model with an example. Access security contextK1=U1,M1,I1 and U1=1,2,3,4 represents (dean of faculty, dean of teaching, dean of research, dean of academic affairs), and M1=f,g,h,irepresents (student curriculum management, teacher information management, graduate employment information management, scientific research information management). The specific permission information is shown in Table 1. Access security context, K2=U2,M2,I2, U2=1,2,3,4M2=a,b,c,d,e represents (student information management, student registration information management, student status management, student curriculum review, student curriculum development and modification). The specific permission information is shown in Table 2. The permissions a<b<c<d<e<f<g<h<i。Table 1
Access security contextK1.
fghi11100201013000040010Table 2
Access security contextK2.
abcde100111200000300111411110Get by using the attribute exploration role discovery algorithmJK1=e⟶cd,d⟶c,c⟶d,b⟶acd,a⟶bcd, CK1=∅,cd,cde,abcd,abcde, JK2=i⟶g,gh⟶fi,f⟶g,fgi⟶h, and CK2=∅,h,g,gi,fg,fghiand plug JK1, CK1, JK2, CK2 into the RCLE algorithm.
(1)
The algorithm starts atB=∅.(2)
Because∅∈CK1, calculate ∅∪f2g1∅=∅=B, add ∅ to the set CK, calculate the next property set of B to bei, and make B=i.(3)
Becausei∈JK1, calculate f1g1i∪f2g1i−i=g≠∅, add i⟶g to the set JK, calculate the next property set of B to beh, and make B=h.(4)
Becauseh does not exist in JK1, CK1, JK2, and CK2,. calculate fgh−h=abcd≠∅, add h⟶abcd to the set JK, calculate the next property set of B to beg, and make B=g.(5)
Becauseg does not exist inJK1, CK1, JK2, CK2. calculate fgg−g=∅, add g to the set CK, calculate the next property set of B to begi, and make B=gi.(6)
Becausegi does not exist in JK1, CK1, JK2, CK2, calculate fggi−gi=∅, add gi to the set CK, calculate the next property set of B is f, and make B=f.(7)
Becausef∈JK1, calculate f1g1f∪f2g1f−f=cdeg≠∅, add f⟶cdeg to the set JK, calculate the next property set of B which ise, and make B=e.(8)
Becausee∈JK1, calculate f1g1e∪f2g1e−e=cdg≠∅, add e⟶cdg to the set JK, calculate the next property set of B isd, and make B=d.(9)
Becaused∈JK2, calculate f2g2d∪f1g2d−d=c≠∅, add d⟶c to the set JK, calculate the next property set of B isc, and make B=c.(10)
Becausec∈JK2, calculate f2g2c∪f1g2c−c=d≠∅, add c⟶d to the set JK, calculate the next property set of B iscd, and make B=cd.(11)
Becausecd does not exist in JK1, CK1, JK2,and CK2 calculate fgcd−cd=∅, add cd to the set CK, calculate the next property set of B is cdg, and make B=cdg.(12)
……(13)
This article will not repeat the process because of the limited space.At the end of the algorithm, CK={∅,g,gi,cd,cdeg,cdefg,abcdh,abcdefghi}, JK={i⟶g,h⟶abcd,f⟶cdeg,e⟶cdg,d⟶c,c⟶d,cdg⟶e,cdegi⟶abfh,b⟶acdh,a⟶bcdh,abcdegh⟶fi}.It can be seen from the above algorithm example process that theRCLE model utilizes the traditional attribute exploration role discovery algorithm to interact with the system managers of multiple departments, so as to obtain the set of roles and the implication relation between permissions under the combination of multiple departments.


## 6. Experiment and Analysis

### 6.1. Experimental Design

In order to verify the performance of the model proposed in this paper, the random function simulation in the JAVA language MATH library is used to generate two sets of access security context as test data. The experimental design is divided into two aspects. The first aspect is to observe the change in the number of the implication relation (Duquenne–Guigues) by changing the experimental conditions. The second aspect is to change the experimental conditions to observe the changes in the number of roles (intent).In the experiment, the algorithm traverses the access security context to answer the questions instead of the experts. The algorithm takes the randomly generated access security context as the objective access security context and traverses the entire access security context when judging whether the implication relation is true. If all users in the access security context meet the implication relation of this implication, the implication is considered to be true. Otherwise, it is considered that this implication relation is not valid, and a user is taken from the access security context and provided to the algorithm as a counterexample. The test platform hardware is 3.4GHZ CPU, and the 16GB memory operating system is Windows X10.The first group of experiments sets the access security context with the same number of users (objects) and the number of permissions (attributes) from 0 to 30 at an interval of 5 to test. The purpose of the test is to fix the number of users to change the number of permissions and observe the change in the number of implications. The test results are shown in Figure2.Figure 2
Number of implications (number of users: 30).The second group sets the number of access security context with the same number of permissions (attributes), and the number of users (objects) is tested from 0 to 300 at intervals of 50. The purpose of testing is to fix the number of permissions, change the number of users, and observe the change of the number of implications. The test results are shown in Figure3.Figure 3
Number of implications (number of permissions: 15).The third group of experiments sets access security context with the same number of users (objects) and the number of permissions (attributes) from 0 to 30 at an interval of 5 to test. The purpose of the test is to fix the number of users, change the number of permissions, and observe the change in the number of roles. The test results are shown in Figure4.Figure 4
Number of roles (number of users: 30).The fourth group sets the number of access security context with the same number of permissions (attributes), and the number of users (objects) is tested from 0 to 300 at intervals of 50. The purpose of the test is to fix the number of permissions, change the number of users, and watch the number of roles change. The test results are shown in Figure5.Figure 5
Number of roles (number of permissions: 15).


### 6.2. Experimental Analysis

The first, second, third, and fourth groups of experiments show that whether the number of fixed objects, changing the number of attributes, or the number of fixed attributes, changing the number of objects, the implication relationship, and role (intent) increase with the scale expansion of the access security context.TheRCLE model proposed in this paper not only avoids the time-consuming and labor-consuming process of role requirement analysis and questionnaire survey in the process of role construction but also solves the defects of the traditional auxiliary interactive question and answer algorithm based on attribute exploration, which does not support crossdepartments.


## 6.1. Experimental Design

In order to verify the performance of the model proposed in this paper, the random function simulation in the JAVA language MATH library is used to generate two sets of access security context as test data. The experimental design is divided into two aspects. The first aspect is to observe the change in the number of the implication relation (Duquenne–Guigues) by changing the experimental conditions. The second aspect is to change the experimental conditions to observe the changes in the number of roles (intent).In the experiment, the algorithm traverses the access security context to answer the questions instead of the experts. The algorithm takes the randomly generated access security context as the objective access security context and traverses the entire access security context when judging whether the implication relation is true. If all users in the access security context meet the implication relation of this implication, the implication is considered to be true. Otherwise, it is considered that this implication relation is not valid, and a user is taken from the access security context and provided to the algorithm as a counterexample. The test platform hardware is 3.4GHZ CPU, and the 16GB memory operating system is Windows X10.The first group of experiments sets the access security context with the same number of users (objects) and the number of permissions (attributes) from 0 to 30 at an interval of 5 to test. The purpose of the test is to fix the number of users to change the number of permissions and observe the change in the number of implications. The test results are shown in Figure2.Figure 2
Number of implications (number of users: 30).The second group sets the number of access security context with the same number of permissions (attributes), and the number of users (objects) is tested from 0 to 300 at intervals of 50. The purpose of testing is to fix the number of permissions, change the number of users, and observe the change of the number of implications. The test results are shown in Figure3.Figure 3
Number of implications (number of permissions: 15).The third group of experiments sets access security context with the same number of users (objects) and the number of permissions (attributes) from 0 to 30 at an interval of 5 to test. The purpose of the test is to fix the number of users, change the number of permissions, and observe the change in the number of roles. The test results are shown in Figure4.Figure 4
Number of roles (number of users: 30).The fourth group sets the number of access security context with the same number of permissions (attributes), and the number of users (objects) is tested from 0 to 300 at intervals of 50. The purpose of the test is to fix the number of permissions, change the number of users, and watch the number of roles change. The test results are shown in Figure5.Figure 5
Number of roles (number of permissions: 15).


## 6.2. Experimental Analysis

The first, second, third, and fourth groups of experiments show that whether the number of fixed objects, changing the number of attributes, or the number of fixed attributes, changing the number of objects, the implication relationship, and role (intent) increase with the scale expansion of the access security context.TheRCLE model proposed in this paper not only avoids the time-consuming and labor-consuming process of role requirement analysis and questionnaire survey in the process of role construction but also solves the defects of the traditional auxiliary interactive question and answer algorithm based on attribute exploration, which does not support crossdepartments.


## 7. Conclusion

Because of the defect that the traditional semiautomatic heuristic method for constructing the RBAC system cannot construct a role system in different permission system departments, this paper proposes a model of RBAC role cooperative learning and exploration. Based on the local access security context, three theorems are summarized from the local point of view, and the proposed theorems are proved by mathematical rigor. Finally, a model ofRCLE is given according to the theorems. The model uses the traditional attribute exploration role discovery method to construct the role system of different permission systems, and then according to the theorem proposed in this paper, calculates the role system of the multiple departments. Because the RCLE model greatly saves the time-consuming steps in the process of role to formulate and has characteristic of the interdepartmental build role, and so here we will further the development of tools for easier operation and makes the model able to get the more extensive application and development.



---

*Source: 5549109-2021-06-25.xml*