{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,3]],"date-time":"2026-05-03T10:59:08Z","timestamp":1777805948580,"version":"3.51.4"},"reference-count":24,"publisher":"SAGE Publications","issue":"1","license":[{"start":{"date-parts":[[2015,3,15]],"date-time":"2015-03-15T00:00:00Z","timestamp":1426377600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/2.zoppoz.workers.dev:443\/https\/journals.sagepub.com\/page\/policies\/text-and-data-mining-license"}],"content-domain":{"domain":["journals.sagepub.com"],"crossmark-restriction":true},"short-container-title":["Journal of Computer Security"],"published-print":{"date-parts":[[2015,3,15]]},"abstract":"<jats:p>Role based access control (RBAC) is a widely used approach to access control with well-known advantages in managing authorization policies. This paper considers user-role reachability analysis of administrative role based access control (ARBAC), which defines administrative roles and specifies how members of each administrative role can change the RBAC policy. Most existing works on user-role reachability analysis assume the separate administration restriction in ARBAC policies. While this restriction greatly simplifies the user-role reachability analysis, it also limits the expressiveness and applicability of ARBAC. In this paper, we consider analysis of ARBAC without the separate administration restriction and present new techniques to reduce the number of ARBAC rules and users considered during analysis. We also present parallel algorithms that speed up the analysis on multi-core systems. The experimental results show that our techniques significantly reduce the analysis time, making it practical to analyze ARBAC without separate administration.<\/jats:p>","DOI":"10.3233\/jcs-140511","type":"journal-article","created":{"date-parts":[[2016,5,18]],"date-time":"2016-05-18T03:47:02Z","timestamp":1463543222000},"page":"1-29","update-policy":"https:\/\/2.zoppoz.workers.dev:443\/https\/doi.org\/10.1177\/sage-journals-update-policy","source":"Crossref","is-referenced-by-count":1,"title":["Policy analysis for administrative role based access control without separate administration"],"prefix":"10.1177","volume":"23","author":[{"given":"Ping","family":"Yang","sequence":"first","affiliation":[{"name":"Department of Computer Science, State University of New York at Binghamton, Binghamton, NY, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Mikhail I.","family":"Gofman","sequence":"additional","affiliation":[{"name":"Department of Computer Science, California State University at Fullerton, Fullerton, CA, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Scott D.","family":"Stoller","sequence":"additional","affiliation":[{"name":"Department of Computer Science, Stony Brook University, Stony Brook, NY, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Zijiang","family":"Yang","sequence":"additional","affiliation":[{"name":"Department of Computer Science, Western Michigan University, Kalamazoo, MI, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"179","published-online":{"date-parts":[[2015,3,15]]},"reference":[{"key":"ref001","unstructured":"A.N.S.I. (ANSI), Role-based access control, ANSI INCITS Standard 359-2004, February 2004."},{"key":"ref002","doi-asserted-by":"crossref","unstructured":"F.\u00a0Alberti, A.\u00a0Armando and S.\u00a0Ranise, Efficient symbolic automated analysis of administrative attribute-based RBAC-policies, in: ACM Symposium on Information, Computer and Communications Security, 2011, pp.\u00a0165\u2013175.","DOI":"10.1145\/1966913.1966935"},{"key":"ref003","doi-asserted-by":"crossref","unstructured":"M.Y.\u00a0Becker, Specification and analysis of dynamic authorisation policies, in: 22nd IEEE Computer Security Foundations Symposium (CSF), 2009, pp.\u00a0203\u2013217.","DOI":"10.1109\/CSF.2009.14"},{"key":"ref004","doi-asserted-by":"crossref","unstructured":"A.L.\u00a0Ferrara, P.\u00a0Madhusudan and G.\u00a0Parlato, Security analysis of role-based access control through program verification, in: IEEE Computer Security Foundations Symposium (CSF), 2012, pp.\u00a0113\u2013125.","DOI":"10.1109\/CSF.2012.28"},{"key":"ref005","doi-asserted-by":"crossref","unstructured":"A.L.\u00a0Ferrara, P.\u00a0Madhusudan and G.\u00a0Parlato, Policy analysis for self-administrated role-based access control, in: International Conference on Tools and Algorithms for the Construction and Analysis of Systems (TACAS), 2013, pp.\u00a0432\u2013447.","DOI":"10.1007\/978-3-642-36742-7_30"},{"key":"ref006","doi-asserted-by":"crossref","unstructured":"K.\u00a0Fisler, S.\u00a0Krishnamurthi, L.A.\u00a0Meyerovich and M.C.\u00a0Tschantz, Verification and change-impact analysis of access-control policies, in: International Conference on Software Engineering (ICSE), 2005, pp.\u00a0196\u2013205.","DOI":"10.1109\/ICSE.2005.1553562"},{"key":"ref007","unstructured":"M.\u00a0Gofman, R.\u00a0Luo, J.\u00a0He, Y.\u00a0Zhang and P.\u00a0Yang, Incremental information flow analysis of role based access control, in: International Conference on Security and Management (SAM), 2009, pp.\u00a0397\u2013403."},{"key":"ref008","doi-asserted-by":"crossref","unstructured":"M.\u00a0Gofman, R.\u00a0Luo, A.\u00a0Solomon, Y.\u00a0Zhang, P.\u00a0Yang and S.\u00a0Stoller, RBAC-PAT: A policy analysis tool for role based access control, in: Tools and Algorithms for the Construction and Analysis of Systems (TACAS), 2009, pp.\u00a046\u201349.","DOI":"10.1007\/978-3-642-00768-2_4"},{"key":"ref009","doi-asserted-by":"crossref","unstructured":"M.\u00a0Gofman, R.\u00a0Luo and P.\u00a0Yang, User-role reachability analysis of evolving administrative role based access control, in: European Symposium on Research in Computer Security (ESORICS), 2010, pp.\u00a0455\u2013571.","DOI":"10.1007\/978-3-642-15497-3_28"},{"key":"ref010","doi-asserted-by":"publisher","DOI":"10.3233\/JCS-2005-13105"},{"key":"ref011","doi-asserted-by":"crossref","unstructured":"K.\u00a0Irwin, T.\u00a0Yu and W.H.\u00a0Winsborough, On the modeling and analysis of obligations, in: ACM Conference on Computer and Communications Security (CCS), 2006, pp.\u00a0134\u2013143.","DOI":"10.1145\/1180405.1180423"},{"key":"ref012","doi-asserted-by":"crossref","unstructured":"D.\u00a0Jackson, I.\u00a0Schechter and I.\u00a0Shlyakhter, Alcoa: the alloy constraint analyzer, in: International Conference on Software Engineering (ICSE), June 2000, 2000, pp.\u00a0730\u2013733.","DOI":"10.1145\/337180.337616"},{"key":"ref013","doi-asserted-by":"crossref","unstructured":"S.\u00a0Jajodia, P.\u00a0Samarati and V.S.\u00a0Subrahmanian, A logical language for expressing authorizations, in: IEEE Symposium on Security and Privacy, 1997, pp.\u00a031\u201342.","DOI":"10.1109\/SECPRI.1997.601312"},{"issue":"4","key":"ref014","first-page":"18:1","volume":"15","author":"Jayaraman K.","year":"2013","journal-title":"ACM Transaction on Information and System Security (TISSEC)"},{"key":"ref015","doi-asserted-by":"publisher","DOI":"10.3233\/JCS-2004-123-402"},{"key":"ref016","doi-asserted-by":"publisher","DOI":"10.1145\/1187441.1187442"},{"key":"ref017","doi-asserted-by":"publisher","DOI":"10.1145\/300830.300839"},{"key":"ref018","doi-asserted-by":"publisher","DOI":"10.1016\/j.tcs.2011.05.009"},{"key":"ref019","doi-asserted-by":"crossref","unstructured":"A.\u00a0Schaad and J.D.\u00a0Moffett, A lightweight approach to specification and analysis of role-based access control extensions, in: ACM Symposium on Access Control Models and Technologies (SACMAT), 2002, pp.\u00a013\u201322.","DOI":"10.1145\/507711.507714"},{"key":"ref020","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2010.08.002"},{"key":"ref021","unstructured":"S.D.\u00a0Stoller, P.\u00a0Yang, C.R.\u00a0Ramakrishnan and M.I.\u00a0Gofman, An ARBAC policy for a university, 2007, available at: https:\/\/2.zoppoz.workers.dev:443\/http\/www.cs.sunysb.edu\/~stoller\/ccs2007\/university-policy.txt."},{"key":"ref022","doi-asserted-by":"crossref","unstructured":"S.D.\u00a0Stoller, P.\u00a0Yang, C.R.\u00a0Ramakrishnan and M.I.\u00a0Gofman, Efficient policy analysis for administrative role based access control, in: 14th ACM Conference on Computer and Communications Security (CCS), 2007, pp.\u00a0445\u2013455.","DOI":"10.1145\/1315245.1315300"},{"key":"ref023","doi-asserted-by":"crossref","unstructured":"E.\u00a0Uzun, V.\u00a0Atluri, S.\u00a0Sural, J.\u00a0Vaidya, G.\u00a0Parlato, A.L.\u00a0Ferrara and M.\u00a0Parthasarathy, Analyzing temporal role based access control models, in: ACM Symposium on Access Control Models and Technologies (SACMAT), 2012, pp.\u00a0177\u2013186.","DOI":"10.1145\/2295136.2295169"},{"key":"ref024","doi-asserted-by":"crossref","unstructured":"P.\u00a0Yang, M.\u00a0Gofman and Z.\u00a0Yang, Policy analysis for administrative role based access control without separate administration, in:\n                      27th IFIP WG 11.3 Conference on Data and Applications Security and Privacy (DBSEC)\n                      , pp.\u00a049\u201364.","DOI":"10.1007\/978-3-642-39256-6_4"}],"container-title":["Journal of Computer Security"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/2.zoppoz.workers.dev:443\/https\/journals.sagepub.com\/doi\/pdf\/10.3233\/JCS-140511","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/2.zoppoz.workers.dev:443\/https\/journals.sagepub.com\/doi\/full-xml\/10.3233\/JCS-140511","content-type":"application\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/2.zoppoz.workers.dev:443\/https\/journals.sagepub.com\/doi\/pdf\/10.3233\/JCS-140511","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,4,29]],"date-time":"2026-04-29T20:44:49Z","timestamp":1777495489000},"score":1,"resource":{"primary":{"URL":"https:\/\/2.zoppoz.workers.dev:443\/https\/journals.sagepub.com\/doi\/10.3233\/JCS-140511"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2015,3,15]]},"references-count":24,"journal-issue":{"issue":"1","published-print":{"date-parts":[[2015,3,15]]}},"alternative-id":["10.3233\/JCS-140511"],"URL":"https:\/\/2.zoppoz.workers.dev:443\/https\/doi.org\/10.3233\/jcs-140511","relation":{},"ISSN":["0926-227X","1875-8924"],"issn-type":[{"value":"0926-227X","type":"print"},{"value":"1875-8924","type":"electronic"}],"subject":[],"published":{"date-parts":[[2015,3,15]]}}}