# Severity Level of Permissions in Role-Based Access Control

## TL;DR

This paper introduces a methodology to quantify the importance of permissions in role-based access control systems by calculating their severity levels, aiding in identifying critical permissions and reducing redundancy.

## Contribution

It proposes a novel approach using analytic hierarchy process to determine permission severity levels based on role hierarchy structure.

## Key findings

- A numerical severity level reflects permission importance.
- The methodology helps identify critical permissions for security.
- Role graph serves as the decision tree for analysis.

## Abstract

The analysis of hidden channels of information leakage with respect to role-based access control includes monitoring of excessive permissions among users. It is not always possible to completely eliminate redundancy. The problem of ranking permissions arises in order to identify the most significant, for which redundancy is most not desirable. A numerical characteristic that reflects the value or importance of permissions is called the "severity level". A number of heuristic assumptions have been formulated that make it possible to establish the dependence of the severity level of permissions on the structure of the role hierarchy. A methodology for solving the problem is proposed, using analytic hierarchy process and taking into account these assumptions. The main idea is that the decision tree of the process will be the role graph.