A Model for Attribute Based Role-Role Assignment (ARRA)
\IEEEauthorblockN{{\textsuperscript{a
Administrative Role Based Access Control (ARBAC) models specify how to manage user-role assignments (URA), permission-role assignments (PRA), and role-role assignments (RRA). Many approaches have been proposed in the literature for URA, PRA and RRA. In this paper, we propose a model for attribute-based role-role assignment (ARRA), a novel way to unify prior RRA approaches. We leverage the idea that attributes of various RBAC entities such as admin users and regular roles can be used to administer RRA in a highly-flexible manner. We demonstrate that ARRA can express and unify prior RRA models. %
SKM_Main.tex
\documentclass[conference]{IEEEtran}
\usepackage{blindtext, graphicx}
\usepackage{cite}
\usepackage{multicol}

% Add the compsoc option for Computer Society conferences.
%
% If IEEEtran.cls has not been installed into the LaTeX system files,
% manually specify the path to it like:
% \documentclass[conference]{../sty/IEEEtran}
\usepackage{amssymb}
\setcounter{tocdepth}{3}
\usepackage{graphicx}
\usepackage{epstopdf}
\usepackage{url}
\urldef{\mailsa}\path|jiwan.ninglekhu@gmail.com, ram.krishnan@utsa.edu|
%\urldef{\mailsb}\path|anna.kramer, leonie.kunz, christine.reiss, nicole.sator,|
%%\urldef{\mailsc}\path|erika.siebert-cole, peter.strasser, lncs}@springer.com|    
%\newcommand{\keywords}[1]{\par\addvspace\baselineskip
%\noindent\keywordname\enspace\ignorespaces#1}

\usepackage[]{graphicx}
\usepackage{tabu}
\usepackage{amsmath}
\usepackage{textcomp}
\usepackage{fixltx2e}
\usepackage{amssymb}
\usepackage{ltablex,booktabs}
\usepackage[T1]{fontenc}

\usepackage{tabulary}
%\usepackage[newcommands]{ragged2e}
\usepackage{xspace}
\usepackage{floatrow}
\usepackage{algorithm}
\usepackage{algorithmic}
\usepackage{hhline}
%\usepackage{enumitem}
%\raggedbottom
%\usepackage[bottom]{footmisc}
\makeatletter
\DeclareRobustCommand{\textsupsub}[2]{{%
  \m@th\ensuremath{%
    ^{\mbox{\fontsize\sf@size\z@#1}}%
    _{\mbox{\fontsize\sf@size\z@#2}}%
  }%
}}
\makeatother



\floatsetup[table]{capposition=top}
\newcommand\tab[1][1.27cm]{\hspace*{#1}}
\newcommand\stab[1][0.635cm]{\hspace*{#1}}
\newcommand\hstab[1][0.3175cm]{\hspace*{#1}}
\renewcommand{\arraystretch}{1.5}
\newcommand{\U}{USERS}
\newcommand{\R}{ROLES}
\newcommand{\T}{T}
\newcommand{\tH}{TH}
\newcommand{\AU}{AU}
\newcommand{\PA}{PA}
\newcommand{\TA}{TA}
\renewcommand{\P}{PERMS}
\newcommand{\AR}{AR}
\newcommand{\ARH}{ARH}
\newcommand{\AUA}{AUA}
\newcommand{\CR}{CR}
\newcommand{\RH}{RH}
\newcommand{\UATT}{UATT}
\newcommand{\AATT}{AATT}
\newcommand{\RATT}{RATT}
\newcommand{\PATT}{PATT}
\newcommand{\CATT}{CATT}
\newcommand{\TATT}{TATT}
\newcommand{\ARATT}{ARATT}
\newcommand{\OP}{AOP}
\newcommand{\UA}{UA}
\newcommand{\RN}{ROLES}
\newcommand{\RNH}{RH}
\newcommand{\ARN}{AROLE\_NAMES}
\newcommand{\exmm}{exp\_mob\_mem}
\newcommand{\immm}{imp\_mob\_mem}
\newcommand{\eximm}{exp\_immob\_mem}
\newcommand{\imimm}{imp\_immob\_mem}
\newcommand{\isauth}{is\_authorized}
\newcommand{\isord}{is\_ordered}
\newcommand{\OU}{ORGU}
\newcommand{\OUH}{OUH}
\newcommand{\UUA}{UUA}
\newcommand{\PPA}{PPA}
%\renewcommand{\ss}{\textsubscript}
%\renewcommand{\SS}{\textsuperscript}
\renewcommand{\it}{\textit}
\newcommand{\ADU}{ADU}
\newcommand{\UP}{UP}
\newcommand{\UPH}{UPH}
\newcommand{\UUPA}{UUPA}
\newcommand{\AUH}{AUH}
\newcommand{\upau}{userpool\_adminunit}
\newcommand{\aur}{adminunit\_role}
\newcommand{\au}{admin\_unit}
\newcommand{\tadu}{task\_adminu}
\newcommand{\imupau}{impl\_userpool\_adminunit}
\newcommand{\adminu}{adminu}
\newcommand{\ups}{userpools}
\newcommand{\uam}{user\_am}
\newcommand{\ram}{role\_am}
\newcommand{\oam}{object\_am}
\newcommand{\classp}{classp}
\renewcommand{\t}{\texttt}
\newcommand{\q}{\textquotesingle}
\newcommand{\OI}{O}
\newcommand{\scope}{Scope}
\newcommand{\adroles}{assigned\_roles}


%Page number is not required. This is just for drafts
%pagenumber
\usepackage[margin=1in,left=1in, includefoot]{geometry}
\usepackage{fancyhdr}
\pagestyle{fancy}
\fancyhead{}
\fancyfoot{}
\fancyfoot[C]{\thepage}
\renewcommand{\headrulewidth}{0pt}
\renewcommand{\footrulewidth}{0pt}
%\pagenumber
%\usepackage{xspace}
%\usepackage{floatrow}
%\usepackage{algorithm}% algpseudocode}
%\usepackage{algorithmic}
\usepackage{setspace}
%\addtocounter{algorithm}{-1}

%Side-less Table
\usepackage{booktabs}
\let\labelindent\relax
\usepackage{enumitem}


% *** CITATION PACKAGES ***
%
\usepackage{cite}



%\input{source_tex/header}

\begin{document}

\title{A Model for Attribute Based Role-Role Assignment (ARRA)}

\author{\IEEEauthorblockN{{\textsuperscript{\it{a}}}Jiwan L. Ninglekhu and {\textsuperscript{\it{b}}}Ram Krishnan}
\IEEEauthorblockA{Department of Electrical and Computer Engineering \\
The University of Texas at San Antonio\\
San Antonio, Texas 78249\\
Email: {\textsuperscript{\it{a}}}jiwan.ninglekhu@gmail.com and {\textsuperscript{\it{b}}}ram.krishnan@utsa.edu}
%\and 
%\IEEEauthorblockN{Ram Krishnan}
%\IEEEauthorblockA{Department of Electrical and Computer Engineering\\ 
%The University of Texas at San Antonio\\
%San Antonio, Texas 78249\\
%Email: ram.krishnan@utsa.edu}
}

\maketitle

\input{source_tex/abstract}

\begin{IEEEkeywords}
Roles, Role Hierarchy, RBAC, ARBAC, Access Control, Administration.
\end{IEEEkeywords}

\IEEEpeerreviewmaketitle

\input{source_tex/intro}
\input{source_tex/related}
\input{source_tex/ARRA_model}
\input{source_tex/ARRAmodelsection}

\input{source_tex/RRAtranslations}
\input{source_tex/RRA97Instance}
\input{source_tex/algo_MapRRA97}
\input{source_tex/mapRRA97_sec}

\input{source_tex/RRA-UARBACInstance}
\input{source_tex/algo_MapRRA-U}
\input{source_tex/mapRRA-U_sec}



\input{source_tex/ARRA_example}
\input{source_tex/conclusion}
\input{source_tex/ack}
%\input{source_tex/appendix}

\ifCLASSOPTIONcaptionsoff
  \newpage
\fi

\bibliographystyle{IEEEtran}
\bibliography{bib/References}


\end{document}



abstract.tex
\begin{abstract} 
  Administrative Role Based Access Control (ARBAC) 
  models specify how to manage user-role assignments (URA), permission-role assignments (PRA),
  and role-role assignments (RRA). Many approaches have been
  proposed in the literature for URA, PRA and RRA. In this paper, we
  propose a model for attribute-based role-role assignment (ARRA), 
  a novel way to unify prior RRA approaches. We leverage the idea 
  that attributes of various RBAC entities
  such as admin users and regular roles can be used to 
  administer RRA in a highly-flexible manner. We demonstrate that ARRA can
  express and unify prior RRA models.
% 
\end{abstract}


ack.tex

\section*{Acknowledgment}
This work is partially supported by NSF grants CNS-1423481 and CNS-1553696.

algo_MapRRA-U.tex
\floatname{algorithm}{Algorithm}

\begin{algorithm}
\caption{Map\textsubscript{RRA-UARBAC}}
\label{algo:rra-uarbac}
\begin{algorithmic} [1] 
\begin{spacing}{1.0}
\item[]\hspace{-17pt}\textbf{Input:} Instance of RRA in UARBAC 
\item[]\hspace{-17pt}\textbf{Output:} ARRA instance 
\item[\textbf{Step 1:}] \ \  /* Map basic sets and functions in AURA */
\item[] a. \AU\textsuperscript{{A}} $\leftarrow$ \it{\U}\textsuperscript{{U}} ; \OP\textsuperscript{{A}} $\leftarrow$ \{\textbf{assign, revoke}\}
\item[] b. \R\textsuperscript{{A}} $\leftarrow$ \it{\R}\textsuperscript{{U}} ;  \AUA\textsuperscript{{A}} = $\phi$
\item[] c. \RH\textsuperscript{{A}} $\leftarrow$ \it{\RH}\textsuperscript{{U}} 

\item[\textbf{Step 2:}]   \stab /* Map attribute functions in AURA */
\item[] a. \AATT\textsuperscript{{A}} $\leftarrow$ \{\it{grantAuth, empowerAuth, adminAuth, 
\item[] \stab roleClassAuth}\}, \ARATT\ = \{\}, \RATT\ = \{\}
\item[] b. \scope\textsuperscript{{A}}(\it{grantAuth}) = \R\textsuperscript{{A}},  
\item[] c. attType\textsuperscript{{A}}(\it{grantAuth}) = set 
\item[] d. \isord\textsuperscript{{A}}(\it{grantAuth}) = True, 
H\textsuperscript{{A}}\textsubscript{\it{grantAuth}} = \RH\textsuperscript{{A}}
\item[] e. For each \it{u\textsubscript{}} in \AU\textsuperscript{{U}}, \it{grantAuth}(\it{u\textsubscript{}}) = $\phi$ 
\item[] f. For each \it{u} in \it{\U}\textsuperscript{{U}} and 
\item[] \ \ \  for each [\textsf{role}, \it{r\textsubscript{}}, \textsf{grant}] $\in$ authorized\_perms\textsuperscript{{U}}[\it{u}],
\item[] \tab \it{grantAuth}(\it{u\textsubscript{}})\textquotesingle\ = \it{grantAuth}(\it{u\textsubscript{}}) $\cup$ (\it{r\textsubscript{}})
%
\item[] g. \scope\textsuperscript{{A}}(\it{empowerAuth}) = \R\textsuperscript{{A}},  
\item[] h. attType\textsuperscript{{A}}(\it{empowerAuth}) = set 
\item[] i. \isord\textsuperscript{{A}}(\it{empowerAuth}) = True, 
\item[] j. H\textsuperscript{{A}}\textsubscript{\it{empowerAuth}} = \RH\textsuperscript{{A}}
\item[] k. For each \it{u\textsubscript{}} in \AU\textsuperscript{{U}}, \it{empowerAuth}(\it{u\textsubscript{}}) = $\phi$ 
\item[] l. For each \it{u} in \it{\U}\textsuperscript{{U}} and 
\item[] \stab for each [\textsf{role}, \it{r\textsubscript{}}, \textsf{empower}] 
\item[] \tab \stab  $\in$ authorized\_perms\textsuperscript{{U}}[\it{u}],
\item[] \ \ \ \  \it{empowerAuth}(\it{u\textsubscript{}})\textquotesingle\ = \it{empowerAuth}(\it{u\textsubscript{}}) $\cup$ \it{r\textsubscript{}}
\item[] m. \scope\textsuperscript{{A}}(\it{adminAuth}) = \R\textsuperscript{{A}}
\item[] n. attType\textsuperscript{{A}}(\it{adminAuth}) = set 
\item[] o. \isord\textsuperscript{{A}}(\it{adminAuth}) = True, 
\item[] p. H\textsuperscript{{A}}\textsubscript{\it{adminAuth}} = \RH\textsuperscript{{A}} 
\item[] q. For each \it{u\textsubscript{}} in \U\textsuperscript{{A}}, \it{adminAuth}(\it{u}) = $\phi$ 
\item[] r. For each \it{u} in \it{\U}\textsuperscript{{U}} and
\item[] \ \ \ for each [\textsf{role}, \it{r\textsubscript{}}, \textsf{admin}] $\in$ authorized\_perms\textsuperscript{{U}}[\it{u}], 
\item[] \tab \it{adminAuth}(\it{u\textsubscript{}})\textquotesingle\ = \it{adminAuth}(\it{u\textsubscript{}}) $\cup$ \it{r\textsubscript}
%
\item[] s. \scope\textsuperscript{{A}}(\it{roleClassAuth}) = \it{AM}\textsuperscript{{U}}(\textsf{role}) 
\item[] t. attType\textsuperscript{{A}}(\it{roleClassAuth}) = set 
\item[] u. \isord\textsuperscript{{A}}(\it{roleClassAuth}) = False 
\item[] v. H\textsuperscript{{A}}\textsubscript{\it{roleClassAuth}} = $\phi$ 
\item[] w. For each \it{u\textsubscript{}} in \U\textsuperscript{{A}}, \it{roleClassAuth}(\it{u}) = $\phi$ 
\item[] x. For each \it{u} in \it{\U}\textsuperscript{{U}} 
\item[] \stab for each [\it{c, am}] $\in$ authorized\_perms\textsuperscript{{U}}[\it{u}], 
%
\item[]\tab \it{roleClassAuth}(\it{u})\q = \it{roleClassAuth}(\it{u}) $\cup$ \it{am} 
\item[\textbf{Step 3:}] \stab /* Construct assign rule in AURA */
\item[] a. assign\_formula = 
\hspace*{0.3cm}(\it{r\textsubscript{1}} $\in$ \it{grantAuth}(\it{au\textsubscript{}}) $\wedge$ \\ 
\hspace*{0.3cm}\it{r\textsubscript2} $\in$ \it{empowerAuth}(\it{au\textsubscript{}})) $\vee$ (\it{r\textsubscript{1}} $\in$ \it{grantAuth}(\it{au\textsubscript{}}) $\wedge$ \\ 
\hspace*{0.3cm}\textsf{empower} $\in$ \it{roleClassAuth}(\it{au\textsubscript{}})) $\vee$ \\
\hspace*{0.3cm}(\textsf{grant} $\in$ \it{roleClassAuth}(\it{au\textsubscript{}}) $\wedge$ \\
\hspace*{0.3cm}\it{r\textsubscript2} $\in$ \it{empowerAuth}(\it{au\textsubscript{}})) $\vee$\\
\hspace*{0.3cm}(\textsf{grant} $\in$ \it{roleClassAuth}(\it{au\textsubscript{}}) $\wedge$ \\
\hspace*{0.3cm}\textsf{empower} $\in$ \it{roleClassAuth}(\it{au\textsubscript{}}))
%


\vspace{-0.5cm}
\end{spacing}
\end{algorithmic}
\end{algorithm}

%%% Continued

\floatname{algorithm}{Continuation of Algorithm}
\setcounter{algorithm}{0}
\begin{algorithm}
\caption{Map\textsubscript{RRA-UARBAC}}
\begin{algorithmic} [1] 
\begin{spacing}{1.1}
%
\item[]

\item[] b. auth\_assign = 
\item[] \ \ \ \ {\isauth}U\textsubscript{\textbf{assign}}(\it{au\textsubscript{}} : \AU, \it{r\textsubscript1} : \R, \it{r\textsubscript2} : \R) $\equiv$   assign\_formula
% \item[]
\item[\textbf{Step 4:}] \stab /* Construct revoke rule for AURA */
\item[] a. revoke\_formula = 
\it{r\textsubscript{1}} $\in$ \it{grantAuth}(\it{au\textsubscript{}}) $\wedge$  \\ 
\hspace*{0.3cm}\it{r\textsubscript2} $\in$ \it{empowerAuth}(\it{au\textsubscript{}})) $\vee$ \it{r\textsubscript{1}} $\in$ \it{adminAuth}(\it{au\textsubscript{}}) $\vee$\\
 \hspace*{0.3cm}\it{r\textsubscript{2}} $\in$ \it{adminAuth}(\it{au\textsubscript{}}) $\vee$
\textsf{admin} $\in$ \it{roleClassAuth}(\it{au})
\item[] b. auth\_revoke = 
\item[]  \ \ \ \ {\isauth}U\textsubscript{\textbf{revoke}}(\it{au\textsubscript1} : \AU, \it{r\textsubscript1} : \R, \it{r\textsubscript2} : \R) $\equiv$ revoke\_formula
\vspace{-0.5cm}
\end{spacing}
\end{algorithmic}
\end{algorithm}


algo_MapRRA97.tex
%MAP RRA97
\floatname{algorithm}{Algorithm}
%\setcounter{algorithm}{0}
%\clearpage
\begin{algorithm}
\caption{Map\textsubscript{RRA97}}
\label{alg:rra97}
\begin{algorithmic} [1] 
\begin{spacing}{1.2}

\item[]\hspace{-17pt}\textbf{Input:} RRA97 instance
\item[]\hspace{-17pt}\textbf{Output:} ARRA instance 
\item[\textbf{Step 1:}]  \  /* Map basic sets and functions in AURA */
\item[] a. \AU\ $\leftarrow$ \U\textsuperscript{{97}} \\
\item[] b. \OP\textsuperscript{{A}} $\leftarrow$ \{\textbf{insertEdge, deleteEdge}\} 
\item[] c. \R\textsuperscript{{A}} $\leftarrow$ \R\textsuperscript{{97}} ; 
 \AUA\textsuperscript{{A}} $\leftarrow$ \AUA\textsuperscript{{U}} 
\item[] b. \RH\textsuperscript{{A}} $\leftarrow$ \RH\textsuperscript{{97}} 
%
\item[\textbf{Step 2:}]   \stab /* Map attribute functions in AURA */
\item[] a. \AATT\textsuperscript{{A}} $\leftarrow$ \{\} ; \RATT\textsuperscript{{A}} $\leftarrow$ \{\}
\item[] b. \ARATT\textsuperscript{{A}} $\leftarrow$ \{\it{authRange}\} 
\item[] c. \scope\textsuperscript{{A}}(\it{authRange}) = \RH\textsuperscript{+}\textsuperscript{{A}} 
\item[] d. attType\textsuperscript{{A}}(\it{authRange}) = set 
\item[] e. \isord\textsuperscript{{A}}(\it{authRange}) = False ; H\textsupsub{{A}}{\it{authRange}} = $\phi$
\item[] f. For each \it{ar} $\in$ \AR\textsuperscript{{A}}, \it{authRange}(\it{ar}) = $\phi$  
\item[] g. For each (\it{ar}, (\it{r\textsubscript{i}, r\textsubscript{j}})) $\in$ \it{can-modify}\textsuperscript{97},
\item[] \stab \it{authRange}(\it{ar}) = \it{authRange}(\it{ar}) $\cup$ (\it{r\textsubscript{i}, r\textsubscript{j}})
%
\item[\textbf{Step 3:}] \stab /* Construct assign rule in AURA */
\item[] a. assign\_formula = $\phi$ 
\item[] b. For each (\it{ar}, (\it{r\textsubscript{i}, r\textsubscript{j}})) $\in$ \it{can-modify}\textsuperscript{97}, 
\item[] \stab assign\_formula\textquotesingle\ = assign\_formula $\vee$ \\
($\exists$(\it{au}, \it{ar\textsubscript1}) $\in$ \AUA, $\exists$(s, t) $\in$ \it{authRange}(\it{ar\textsubscript1}). \it{r\textsubscript1}, \it{r\textsubscript2} $\in$ $\lceil$s, t$\rceil$) 
$\wedge$
(($\exists$(m, n), (m\q, n\q) $\in$ $\bigcup\limits_{ar\textsubscript2 \in\ \textrm{\AR}}$ \it{authRange}(\it{ar\textsubscript2}). 
\it{r\textsubscript1}, \it{r\textsubscript2} $\lceil$m, n$\rceil$ $\wedge$ ($\lceil$m\q, n\q$\rceil$ $\subset$ $\lceil$m, n$\rceil$ $\rightarrow$ \it{r\textsubscript1}, \it{r\textsubscript2} $\notin$ (m\q, n\q)))
$\vee$ 
($\exists$(x,y) $\in$ $\bigcup\limits_{ar\textsubscript3 \in\ \textrm{\AR}}$ \it{authRange}(\it{ar\textsubscript3}). ((\it{r\textsubscript1} = y $\wedge$ \it{r\textsubscript2} > x) $\vee$ (\it{r\textsubscript2} = x $\wedge$ \it{r\textsubscript1} < y)) $\wedge$ ($\forall$p $\in$ $\lceil$x, y$\rceil$ $\wedge$ $\forall$q $\notin$ $\lceil$x, y$\rceil$. (<q, p> $\in$ (\RH\ $\cup$ <\it{r\textsubscript2}, \it{r\textsubscript1}>)* $\leftrightarrow$ <q, y> $\in$ (\RH\ $\cup$ <\it{r\textsubscript2}, \it{r\textsubscript1}>)*) $\wedge$ (<p, q> $\in$ (\RH\ $\cup$ <\it{r\textsubscript2}, \it{r\textsubscript1}>)*  $\leftrightarrow$ <x, q> $\in$ (\RH\ $\cup$ <\it{r\textsubscript2}, \it{r\textsubscript1}>)*))))
%
\item[] c. auth\_assign = {\isauth}R\textsubscript{\textbf{insertEdge}}(\it{au} : \AU\textsuperscript{{A}}, \\
\item[] \stab \it{r\textsubscript1} : \R\textsuperscript{{A}}, \it{r\textsubscript2} : \R\textsuperscript{{A}}) $\equiv$ assign\_formula\textquotesingle
\item[\textbf{Step 4:}] \stab /* Construct revoke rule for AURA */
\item[] a. revoke\_formula = $\phi$
\item[] b. For each (\it{ar\textsubscript1}, (\it{r\textsubscript{1}, r\textsubscript{2}})) $\in$ \it{can-modify}\textsuperscript{97},
\item[] \stab revoke\_formula\textquotesingle\ = revoke\_formula $\vee$ \\
\item[] $\exists$(\it{au, ar}) $\in$ \AUA, $\exists$(x, y) $\in$ \it{authRange}(\it{ar}). 
\it{r\textsubscript1}, \it{r\textsubscript2} \\
$\in$ $\lceil$x, y$\rceil$ $\wedge$ $\forall$(u, v) $\in$ $\bigcup\limits_{ar\textsubscript4 \in\ \textrm{\AR}}$ \it{authRange}(\it{ar\textsubscript4}), \\
$\exists$<\it{r\textsubscript2, r\textsubscript1}> $\in$ \RH. (\it{r\textsubscript1} $\neq$ u $\wedge$ \it{r\textsubscript2} $\neq$ v) \\
\item[] c. auth\_revoke = {\isauth}R\textsubscript{\textbf{deleteEdge}}(\it{au} : \AU\textsuperscript{{A}}, \\
\item[] \stab \it{r\textsubscript1} : \R\textsuperscript{{A}}, \it{r\textsubscript2} : \R\textsuperscript{{A}}) $\equiv$ revoke\_formula\textquotesingle
\vspace{-13pt}
\end{spacing}
\end{algorithmic}
\end{algorithm}

appendix.tex
\begin{figure}[t]
 \centering
 \includegraphics[scale=0.25]{figs/roleh.pdf}
 \caption{Role and Administrative Role Hierarchies in RRA97}
 \label{fig:roleh}
\end{figure}

\appendices
\label{appendix}
\section{Mapping an Example RRA97 Instance in ARRA}
\label{urra97-appendix}

\noindent
\textbf{An RRA97 Example Instance:}\\
Following is an example instance that assumes an existing regular role hierarchy and an administrative role hierarchy in RRA97.\\
 %as depicted in Figure~\ref{fig:roleh}. \\
\underline{Sets and Functions}: 
\begin{itemize}
\item \U\ = \{\textbf{u\textsubscript1, u\textsubscript2, u\textsubscript3, u\textsubscript4}\} 
\item \R\ = \{\textbf{ED, E1, PE1, QE1, PL1, E2, PE2, 
\item[] \stab QE2, PL2, DIR}\}
\item \AR\ = \{\textbf{DSO, PSO1}\}
\item \AUA\ = \{(\textbf{u\textsubscript3, DSO}), (\textbf{u\textsubscript4, PSO1})\}
%\item \AU\ =  \{\textbf{u\textsubscript1, u\textsubscript2, u\textsubscript3, u\textsubscript4}\} 
\item \RH\ = \{<\textbf{ED, E1}>, <\textbf{E1, QE1}>, <\textbf{E1, PE1}>,
\item[] \stab <\textbf{PE1, PL1}>, <\textbf{QE1, PL1}>, <\textbf{ED, E2}>, 
\item[] \stab  <\textbf{E2, PE2}>, <\textbf{E2, QE2}>, <\textbf{PE2, PL2}>, 
\item[] \stab  <\textbf{QE2, PL2}>, <\textbf{PL1, DIR}>, <\textbf{PL2, DIR}>\}
\item \ARH\ = \{<\textbf{SSO, DSO}>, <\textbf{DSO, PSO1}>, \\
\stab <\textbf{DSO, PSO2}>\}
\item \it{can\_modify} = \{(\textbf{DSO, (ED, DIR)}), 
\item[] \stab  (\textbf{PSO1, (E1, PL1)}), (\textbf{PSO1, (E2, PL2)})\}
\item[] Where, (\textbf{ED, DIR}) = \{\textbf{E1, E2, PE1, PE2, QE1,
\item[] \stab   QE2, PL1, PL2}\}, 
\item[] (\textbf{E1, PL1}) = \{\textbf{PE1, QE1}\} and, 
\item[] (\textbf{E2, PL2}) = \{\textbf{PE2, QE2}\}
\end{itemize}
For every (\it{ar}, (x, y)) in \it{can\_modify}, the range denoted by (x, y) must be an encapsulated authority range. 
%The definition of encapsulated authority range in RRA97 is given by following definition.  
%\vspace{0.17cm}
%\noindent
A range (x, y) is said to be an encapsulated if,\\
$\forall$\it{r\ss1} $\in$ (x, y) $\wedge$ $\forall$\it{r\ss2} $\notin$ (x, y). [\it{r\ss2 > r\ss1} $\leftrightarrow$ 
\it{r\ss2} > y $\wedge$\\
 \it{r\ss2} < \it{r\ss1} $\leftrightarrow$ \it{r\ss2} < x]

\vspace{0.17cm}
A new edge AB can be inserted between two incomparable roles A and B under following two conditions:
\begin{itemize}
\item %Immediate authority ranges of A and B must be same, i.e.,
\it{AR\ss{immediate}}(\it{A}) = \it{AR\ss{immediate}}(\it{B}).
%where, 
An immediate authority range of a role \it{r},
 \it{AR\ss{immediate}}(\it{r}) is the authority range (x,y) such that \it{r} $\in$ (x, y) and for all authority ranges (x\textquotesingle, y\textquotesingle) junior to (x, y) we have \it{r} $\notin$  (x\textquotesingle, y\textquotesingle).
\textbf{or}, 
\item if (x, y) is an authority range such that (A = y $\wedge$ B > x) $\vee$ (B = x $\wedge$ A < y) then insertion of AB must preserve encapsulation of (x, y). 

\vspace{0.17cm}
\noindent
\end{itemize}%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\subsubsection{Equivalent RRA97 Instance in ARRA}
An ARRA instance equivalent to aforementioned RRA97 example instance is as follows:\\
\underline{Step 1: Map RRA97 sets to ARRA sets}
\begin{itemize}
%\item \U\ =\{\textbf{u\textsubscript1, u\textsubscript2, u\textsubscript3, u\textsubscript4}\}   
\item \AU\ = \{\textbf{u\textsubscript1, u\textsubscript2, u\textsubscript3, u\textsubscript4}\} %,% where \textbf{au\textsubscript1 = u\textsubscript3}, \textbf{au\textsubscript2 = u\textsubscript4}\\
\item \OP\ = \{\textbf{insertEdge, deleteEdge}\}
\item \R\ = \{\textbf{ED, DIR, E1, PE1, QE1, PL1, E2,
\item[] \stab  PE2, QE2, PL2, DIR}\}
\item \AUA\ = \{(\textbf{u\textsubscript3, DSO}), (\textbf{u\textsubscript4, PSO1})\}
\item \RH\ = \{<\textbf{ED, E1}>, <\textbf{E1, QE1}>, <\textbf{E1, PE1}>,
\item[] \stab <\textbf{PE1, PL1}>, <\textbf{QE1, PL1}>, <\textbf{ED, E2}>, 
\item[] \stab  <\textbf{E2, PE2}>, <\textbf{E2, QE2}>, <\textbf{PE2, PL2}>, 
\item[] \stab  <\textbf{QE2, PL2}>, <\textbf{PL1, DIR}>, <\textbf{PL2, DIR}>\}
\end{itemize}
\vspace{-0.1cm}
\underline{Step 2: Define attributes}
\begin{itemize}
\item \AATT\ = \{\it{}\}, \RATT\ = \{\}
%\item \scope(\it{aroles}) = \{\textbf{DSO, PSO1}\}, 
%\item[] attType(\textit{aroles}) = set, \isord(\it{aroles}) = True, 
%\item[] H\textsubscript{\it{aroles}} = \{<\textbf{DSO, PSO1}>\}
%\item \it{aroles}(\textbf{u\textsubscript3}) = \{\textbf{DSO}\}, \it{aroles}(\textbf{u\textsubscript4}) = \{\textbf{PSO1}\}

\item \ARATT = \{\it{authRange}\}
\item \scope(\it{authRange}) = \RH\SS{+}, attType(\textit{authRange}) = set,
\item[]  \isord(\it{authRange}) = False, H\textsubscript{\it{authRange}} = $\phi$
\item \it{authRange}(\textbf{DSO}) = \{\textbf{ED, DIR}\},
\item[] \it{authRange}(\textbf{PSO1}) = \{(\textbf{E1, PL1}), (\textbf{E2, PL2})\}
%
\end{itemize}
\vspace{-0.03cm}
%If an admin user \it{au} wants to insert or delete an edge between any two roles \it{r\ss1} and \it{r\ss2},
%authorization rules for edge insertion and edge deletion for the given instance can be expressed respectively, as follows:
\underline{Step 3: Construct authorization for \textbf{insertEdge}}\\
%To assign role \it{r\ss1} to role \it{r\ss2},
 -- {\isauth}R\textsubscript{\textbf{insertEdge}}(\it{au} : \AU, \it{r\ss1} : \R, \it{r\ss2} : \R)
$\equiv$ \\
%
($\exists$(\it{au}, \it{ar\ss1}) $\in$ \AUA, $\exists$(s, t) $\in$ \it{authRange}(\it{ar\ss1}). \it{r\ss1}, \it{r\ss2} $\in$ $\lceil$s, t$\rceil$) 
$\wedge$
(($\exists$(m, n), (m\q, n\q) $\in$ $\bigcup\limits_{ar\ss2 \in\ \textrm{\AR}}$ \it{authRange}(\it{ar\ss2}). 
\it{r\ss1}, \it{r\ss2} $\lceil$m, n$\rceil$ $\wedge$ ($\lceil$m\q, n\q$\rceil$ $\subset$ $\lceil$m, n$\rceil$ $\rightarrow$ \it{r\ss1}, \it{r\ss2} $\notin$ (m\q, n\q)))
$\vee$ 
($\exists$(x,y) $\in$ $\bigcup\limits_{ar\ss3 \in\ \textrm{\AR}}$ \it{authRange}(\it{ar\ss3}). ((\it{r\ss1} = y $\wedge$ \it{r\ss2} > x) $\vee$ (\it{r\ss2} = x $\wedge$ \it{r\ss1} < y)) $\wedge$ ($\forall$p $\in$ $\lceil$x, y$\rceil$ $\wedge$ $\forall$q $\notin$ $\lceil$x, y$\rceil$. (<q, p> $\in$ (\RH\ $\cup$ <\it{r\ss2}, \it{r\ss1}>)* $\leftrightarrow$ <q, y> $\in$ (\RH\ $\cup$ <\it{r\ss2}, \it{r\ss1}>)*) $\wedge$ (<p, q> $\in$ (\RH\ $\cup$ <\it{r\ss2}, \it{r\ss1}>)*  $\leftrightarrow$ <x, q> $\in$ (\RH\ $\cup$ <\it{r\ss2}, \it{r\ss1}>)*))))
%
\\
Where: $\lceil$a, b$\rceil$ = \{\it{r} $\vert$ \it{r} $\in$ \R\ $\wedge$ a < \it{r} < b\}
\noindent
\underline{Step 3: Construct authorization for \textbf{insertEdge}}\\
  -- {\isauth}R\textsubscript{\textbf{deleteedge}}(\it{au} : \AU, \it{r\ss1} : \R, \it{r\ss2} : \R) 
$\equiv$ \\
$\exists$\textit{ar} $\in$ \textit{aroles}(\textit{au}) $\wedge$ $\exists$(x, y) $\in$ \it{authRange}(\it{ar}). 
\it{r\ss1}, \it{r\ss2} \\
$\in$ (x, y) $\cup$ \{x, y\} $\wedge$ <\it{r\ss2, r\ss1}> $\in$ \RH\ $\wedge$ (\it{r\ss1} $\neq$ x $\wedge$ \it{r\ss2} $\neq$ y)




\section{Mapping an Example Instance of \\
UARBAC's RRA in ARRA}\label{rrau-appendix}

\noindent
\textbf{An Example UARBAC's RRA Instance:}\\
\underline{RBAC schema}
\begin{itemize}
\item \it{C} = \{\textsf{role}\}
\item \it{OBJS}(\textsf{user}) = \textbf{USERS}, \it{OBJS}(\textsf{role}) = \textbf{ROLES}
% \item \it{AM}(\textsf{user}) = \{\textsf{empower, admin}\},
\item \it{AM}(\textsf{role}) = \{\textsf{grant, empower, admin}\}
\end{itemize}
\underline{RBAC state}
\begin{itemize}
\item \it{\U} = \it{OBJ}(\textsf{user}) = \{\textbf{u\textsubscript1, u\textsubscript2, u\textsubscript3, u\textsubscript4}\} 
\item \it{\R} = \it{OBJ}(\textsf{role})= \{\textbf{r\textsubscript{1}, r\textsubscript{2}, r\textsubscript3}\} % $\cup$ \textbf{sso}, where \textbf{sso} is a reserved role called Senior Security Officer.
\item \it{P} = [\textsf{role}, \textbf{r\textsubscript1}, \textsf{grant}], [\textsf{role}, \textbf{r\textsubscript1}, \textsf{empower}], [\textsf{role}, \textbf{r\textsubscript1}, \textsf{admin}], [\textsf{role}, \textbf{r\textsubscript2}, \textsf{grant}], [\textsf{role}, \textbf{r\textsubscript2}, \textsf{empower}], [\textsf{role}, \textbf{r\textsubscript2}, \textsf{admin}], [\textsf{role}, \textbf{r\textsubscript3}, \textsf{grant}], [\textsf{role}, \textbf{r\textsubscript3}, \textsf{empower}], [\textsf{role}, \textbf{r\textsubscript3}, \textsf{admin}], {[\textsf{role}, \textsf{grant}], [\textsf{role, empower}], [\textsf{role, admin}]\}}
%\item \it{\UA} = \{(\textbf{u\textsubscript1, r\textsubscript1}), (\textbf{u\textsubscript2, r\textsubscript1}), (\textbf{u\textsubscript2, r\textsubscript2}), (\textbf{u\textsubscript2, r\textsubscript3}), (\textbf{u\textsubscript3, r\textsubscript3}), (\textbf{u\textsubscript4, r\textsubscript2})\}
\item \it{\RH} = \{<\textbf{r\textsubscript2, r\textsubscript3}>\}
\end{itemize}
\noindent
\underline{Administrative permissions of UARBAC's RRA}\\
Following is the list of administrative permissions each user has for role-role assignment:
\begin{itemize}
\item authorized\_perms[\textbf{u\textsubscript1}]  = \{{[\textsf{role}, \textbf{r\textsubscript1}, \textsf{grant}],
\item[] \stab {[\textsf{role}, \textbf{r\textsubscript2}, \textsf{admin}]}, [\textsf{role}, \textbf{r\textsubscript2}, \textsf{empower}]}, 
\item[] \stab {[\textsf{role}, \textbf{r\textsubscript3}, \textsf{admin}]}\}

\item authorized\_perms[\textbf{u\textsubscript2}]  = \{[\textsf{role}, \textbf{r\textsubscript1}, \textsf{admin}],
\item[] \stab {[\textsf{role}, \textbf{r\textsubscript1}, \textsf{empower}]}, [\textsf{role}, \textbf{r\textsubscript2}, \textsf{empower}], 
\item[] \stab {[\textsf{role}, \textbf{r\textsubscript3}, \textsf{grant}]}\}
\item authorized\_perms[\textbf{u\textsubscript3}] = \{[\textsf{role, admin}]\}
\item authorized\_perms[\textbf{u\textsubscript4}] = \{[\textsf{role, grant}], \item[] \stab {[\textsf{role, empower}]}, {[\textsf{role, admin}]}\}
\end{itemize}
%
\underline{Role-role assignment condition}\\
One can perform following operation to assign a role \textbf{r\textsubscript1} to another role \textbf{r\textsubscript2}.
\begin{itemize}
\item grantRoleToRole(\textbf{r\textsubscript{1}, r\textsubscript{2}}) 
\end{itemize}
To perform this operation one needs one of the following two permissions:
\begin{itemize}
\item {[\textsf{role}, \textbf{r\textsubscript1}, \textsf{grant}]} and {[\textsf{role}, \textbf{r\textsubscript2}, \textsf{empower}]} or,
\item {[\textsf{role}, \textsf{grant}]} and {[\textsf{role}, \textbf{r\textsubscript2}, \textsf{empower}]} or,
\item {[\textsf{role}, \textbf{r\textsubscript1}, \textsf{grant}]} and {[\textsf{role}, \textsf{empower}]} or,
\item {[\textsf{role}, \textsf{grant}]} and {[\textsf{role}, \textsf{empower}]}
\end{itemize}
%
%
\underline{Condition for revoking a role from another role}\\
To revoke a role \textbf{r\textsubscript2} from a role \textbf{r\textsubscript3}, admin user performs following operation.
\begin{itemize}
\item revokeRoleFromUser(\textbf{r\textsubscript{2}, r\textsubscript{3}}) 
\end{itemize}
To conduct this operation one needs one of the following options:
\begin{itemize}
\item {[\textsf{role}, \textbf{r\textsubscript2}, \textsf{grant}] and [\textsf{role}, \textbf{r\textsubscript3}, \textsf{empower}]}
\item {[\textsf{role}, \textbf{r\textsubscript2}, \textsf{admin}]} 
\item {[\textsf{role}, \textbf{r\textsubscript3}, \textsf{admin}]}
\item {[\textsf{role}, \textsf{admin}]}
\end{itemize}

\vspace{0.19cm}
\noindent
%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%      URA-UARBAC      %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\subsubsection{Equivalent ARRA instance UARBAC's RRA}
%
\begin{itemize}
%\item \U\ = \{\textbf{u\textsubscript{1}, u\textsubscript{2}, u\textsubscript{3}, u\textsubscript4}\}
\item \AU\ = \{\textbf{u\textsubscript{1}, u\textsubscript{2}, u\textsubscript{3}, u\textsubscript4}\}, \OP\ = \{\textbf{assign, revoke}\}
\item \R\ = \{\textbf{r\textsubscript{1}, r\textsubscript{2}, r\textsubscript3}\}, \AUA\ = \{\}
\item \RH\ = \{<\textbf{r\textsubscript2, r\textsubscript3}>\}
\item \AATT\ = \{\textit{grantAuth, empowerAuth, adminAuth, roleClassAuth}\}, \ARATT\ = \{\}, \RATT\ = \{\}
%\item[] \tab class\_grantAuth, class\_empowerAuth,
%\item[] \tab class\_adminAuth}\}
\item \scope(\textit{grantAuth}) = \{\textbf{r\textsubscript{1}, r\textsubscript{2}, r\textsubscript3}\}
\item[] attType(\it{grantAuth}) = set, 
\item[] \isord(\it{grantAuth}) = \R\SS{\t{A}}, H\textsubscript{\it{grantAuth}} = \RH\SS{\t{A}}

\item \it{grantAuth}(\textbf{u\textsubscript{1}}) = \{\textbf{r\ss1}\}, \it{grantAuth}(\textbf{u\textsubscript{2}}) = \{\textbf{r\ss3}\},
\item[] \it{grantAuth}(\textbf{u\textsubscript{3}}) = \{\}, \it{grantAuth}(\textbf{u\textsubscript{4}}) = \{\}

\item \scope(\textit{empowerAuth}) = \{\textbf{r\textsubscript{1}, r\textsubscript{2}, r\textsubscript3}\}
\item[] attType(\it{empowerAuth}) = set, 
\item[] \isord(\it{empowerAuth}) = \R\SS{\t{A}}
\item[] H\textsubscript{\it{empowerAuth}} = \RH\SS{\t{A}}

\item \it{empowerAuth}(\textbf{u\textsubscript{1}}) = \{\textbf{r\ss2}\}, 
\item[]\it{empowerAuth}(\textbf{u\textsubscript{2}}) = \{\textbf{r\ss1, r\ss2}\},
\item[] \it{empowerAuth}(\textbf{u\textsubscript{3}}) = \{\}, \it{empowerAuth}(\textbf{u\textsubscript{4}}) = \{\}

\item \scope(\textit{adminAuth}) = \{\textbf{r\textsubscript{1}, r\textsubscript{2}, r\textsubscript3}\}
\item[] attType(\it{adminAuth}) = set, 
\item[] \isord(\it{adminAuth}) = \R\SS{\t{A}},
\item[] H\textsubscript{\it{adminAuth}} = \RH\SS{\t{A}}

\item \it{adminAuth}(\textbf{u\textsubscript{1}}) = \{\textbf{r\ss2, r\ss3}\}, 
\item[]\it{adminAuth}(\textbf{u\textsubscript{2}}) = \{\textbf{r\ss1}\},
\item[] \it{adminAuth}(\textbf{u\textsubscript{3}}) = \{\}, \it{adminAuth}(\textbf{u\textsubscript{4}}) = \{\}
%%---------------------------------------------- class level perms
\item \scope(\textit{roleClassAuth}) = \it{AM}(\textsf{role})
\item[] attType(\it{roleClassAuth}) = set, 
\item[] \isord(\it{roleClassAuth}) = False, 
\item[] H\textsubscript{\it{roleClassAuth}} = $\phi$

\item \it{roleClassAuth}(\textbf{u\textsubscript{1}}) = \{\}, \it{roleClassAuth}(\textbf{u\textsubscript{2}}) = \{\textbf{}\},
\item[] \it{roleClassAuth}(\textbf{u\textsubscript{3}}) = \{\textsf{admin}\},
\item[] \it{roleClassAuth}(\textbf{u\textsubscript{4}}) = \{\textsf{grant, empower, admin}\}

%\item \scope(\textit{class\_grantAuth}) = \{\textsf{role}\}
%\item[] attType(\it{class\_grantAuth}) = set, 
%\item[] \isord(\it{class\_grantAuth}) = False, 
%\item[] H\textsubscript{\it{class\_grantAuth}} = $\phi$
%
%\item \it{class\_grantAuth}(\textbf{u\textsubscript{1}}) = \{\}, 
%\item[] \it{class\_grantAuth}(\textbf{u\textsubscript{2}}) = \{\textbf{}\},
%\item[] \it{class\_grantAuth}(\textbf{u\textsubscript{3}}) = \{\},
%\item[] \it{class\_grantAuth}(\textbf{u\textsubscript{4}}) = \{\textsf{role}\}
%
%\item \scope(\textit{class\_empowerAuth}) = \{\textsf{role}\}
%\item[] attType(\it{class\_empowerAuth}) = set, 
%\item[] \isord(\it{class\_empowerAuth}) = False,
%\item[] H\textsubscript{\it{class\_empowerAuth}} = $\phi$
%
%\item \it{class\_empowerAuth}(\textbf{u\textsubscript{1}}) = \{\}, 
%\item[]\it{class\_empowerAuth}(\textbf{u\textsubscript{2}}) = \{\textbf{}\},
%\item[] \it{class\_empowerAuth}(\textbf{u\textsubscript{3}}) = \{\}, 
%\item[] \it{class\_empowerAuth}(\textbf{u\textsubscript{4}}) = \{\textsf{role}\}
%
%\item \scope(\textit{class\_adminAuth}) = \{\textsf{role}\}
%\item[] attType(\it{class\_adminAuth}) = set, 
%\item[] \isord(\it{class\_adminAuth}) = False,
%\item[] H\textsubscript{\it{class\_adminAuth}} = $\phi$
%
%\item \it{class\_adminAuth}(\textbf{u\textsubscript{1}}) = \{\textbf{}\}, 
%\item[]\it{class\_adminAuth}(\textbf{u\textsubscript{2}}) = \{\textbf{}\},
%\item[] \it{class\_adminAuth}(\textbf{u\textsubscript{3}}) = \{\}, 
%\item[] \it{class\_grantAuth}(\textbf{u\textsubscript{4}}) = \{\textsf{role}\}

\end{itemize}
%
For each \it{op} in \OP, authorization rule to assign/revoke role-role can be expressed as follows:\\
To assign any regular role \it{r\textsubscript1} $\in$ \R\ to regular role \it{r\textsubscript2} $\in$ \R,\\
-- {\isauth}U\textsubscript{\textbf{assign}}(\it{au\textsubscript{}} : \AU, \it{r\textsubscript1} : \R, \\
\hspace*{0.3cm}\it{r\textsubscript2} : \R) $\equiv$ \\
\hspace*{0.3cm}(\it{r\textsubscript{1}} $\in$ \it{grantAuth}(\it{au\textsubscript{}}) $\wedge$ \it{r\textsubscript2} $\in$ \it{empowerAuth}(\it{au\textsubscript{}})) $\vee$\\
\hspace*{0.3cm}(\it{r\textsubscript{1}} $\in$ \it{grantAuth}(\it{au\textsubscript{}}) $\wedge$ \textsf{empower} \\
\hspace*{0.3cm}$\in$ \it{roleClassAuth}(\it{au\textsubscript{}})) $\vee$ 
(\textsf{grant} $\in$ \it{roleClassAuth}(\it{au\textsubscript{}}) $\wedge$ \\
\hspace*{0.3cm}\it{r\textsubscript2} $\in$ \it{empowerAuth}(\it{au\textsubscript{}})) $\vee$ (\textsf{grant} $\in$ \it{roleClassAuth}(\it{au\textsubscript{}}) \\
\hspace*{0.3cm}$\wedge$ \textsf{empower} $\in$ \it{roleClassAuth}(\it{au\textsubscript{}}))
 
 \vspace{0.17cm}
 \noindent
 To revoke any regular role \it{r\textsubscript1} $\in$ \R\ from another regular role \it{r\ss2} $\in$ \R,\\
-- {\isauth}U\textsubscript{\textbf{revoke}}(\it{au\textsubscript1} : \AU, \it{r\textsubscript1} : \R,\\
\hspace*{0.3cm}\it{r\textsubscript2} : \R) $\equiv$ \\
\hspace*{0.3cm}(\it{r\textsubscript{1}} $\in$ \it{grantAuth}(\it{au\textsubscript{}}) $\wedge$ \it{r\textsubscript2} $\in$ \it{empowerAuth}(\it{au\textsubscript{}})) $\vee$\\
\hspace*{0.3cm}\it{r\textsubscript{1}} $\in$ \it{adminAuth}(\it{au\textsubscript{}}) $\vee$ \it{r\textsubscript{2}} $\in$ \it{adminAuth}(\it{au\textsubscript{}}) $\vee$\\
\hspace*{0.3cm}\textsf{admin} $\in$ \it{roleClassAuth}(\it{au})




ARRA_example.tex

\subsection{An Example Instance for ARRA with role attributes}
Previous ARRA model simulation examples did not include regular role attribute. In this section, we present a simple yet plausible example that demonstrates a use case for role attributes in assigning role to role. 
%\begin{figure}[t]
% \centering
% \includegraphics[scale=0.18]{figs/role-role.pdf}
% \caption{A Segment of Role Hierarchy of an Engineering Department in a Manufacturing Company}
% \label{fig:role-role}
%\end{figure}
%A piece of role structure presented in Figure~\ref{fig:role-role}. was taken from the organizational structure of Ford Motors~\cite{refOrg}. 

There are two admin users, \textbf{Sam} and \textbf{Tom}, and regular roles \textbf{IT Director, Development Manager, Quality Manager, Marketing Mganager, Finance Manager, Support Engineer} and \textbf{System Analyst}. There can be many other roles in an organization. We have considered few roles, enough to illustrate our case. Admin user attribute \it{dept} maps each admin user to set of departments they have admin authority over. Although, it is likely that departments have hierarchy in practice, we have not included hierarchy for departments for simplicity. There are three departments in the organization, namely \textbf{Operations, Account} and \textbf{IT} departments. \textbf{Sam} has admin authority over all the departments while \textbf{Tom} has authority over \textbf{IT} department only. There is a regular role attribute \it{dept} for mapping regular roles to their departments.

Authorization condition is that if an admin user \it{au} with admin role \it{ar} was given authority over a department \it{d} and if roles \it{r\textsubscript1} and \it{r\textsubscript2} belonged to the same department \it{d} then \it{r\textsubscript1} can be assigned to \it{r\textsubscript2}. 
\\
\\
\underline{Sets}\\
-- \AU\ = \{\textbf{Sam, Tom}\}, \OP\ = \{\textbf{assign, revoke}\} \\
-- \R\ = \{\textbf{IT Director, Devlopment Mgr., Quality} \\
\stab \textbf{Mgr., Marketing Mgr., Finance Mgr., Support Engineer, System Analyst}\} \\
-- \AR\ = \{\textbf{}\} \\
-- \AUA\ = \{\} \\
-- \RH\ = \{\},  \ARH\ = \{\} \\
\underline{Attributes definition} \\
-- \AATT\ = \{\it{dept}\}, \\
-- \scope(\it{dept}) = \{\textbf{Operations, Account, IT}\}, \\ 
\hstab attType(\it{dept}) = set, \isord(\it{dept}) = False, \\
\hstab H\textsubscript{\it{dept}} = $\phi$\\ 
-- \it{dept}(\textbf{Sam}) = \{\textbf{Operations, Account, IT}\}, \\
\hstab \it{dept}(\textbf{Tom}) = \{\textbf{IT}\}  \\
%\vspace{0.13cm}
-- \ARATT\ = \{\}, \RATT\ = \{\it{dept, level}\} \\
-- \scope(\it{dept}) = \{\textbf{Operations, Account, IT}\}, \\ 
\hstab attType(\it{dept}) = atomic, \\
\hstab \isord(\it{dept}) = False, H\textsubscript{\it{dept}} = $\phi$ \\
-- \it{dept}(\textbf{IT Director}) = \textbf{IT}, \it{dept}(\textbf{Dev. Manager}) = \textbf{IT}, \\
\hstab \it{dept}(\textbf{Marketing Mgr.}) = \textbf{Operations}, \\
\hstab \it{dept}(\textbf{QA Mgr.}) = \textbf{IT}, \\
%
%--  \scope(\it{level}) = \{\textbf{President, VP, Director, Manager, \\
%\stab Engineer}\},  \\
% \hstab attType(\it{level}) = atomic, \isord(\it{level}) = True, \\
%\hstab H\textsubscript{\it{level}} = \{<\textbf{President, VP}>, <\textbf{VP, Director}>,\\
%\stab <\textbf{Director, Manager}>, <\textbf{Manager, Engineer}> \\
%-- \it{level}(\textbf{IT Director}) = \textbf{Director}, \\
%\hstab \it{level}(\textbf{IT Manager}) = \textbf{Manager}, \\
%\hstab \it{level}(\textbf{Dev. Manager}) = \textbf{Manager}, \\
%\hstab \it{level}(\textbf{QA Manager}) = \textbf{Manager}, \\
%%
%\hstab \it{level}(\textbf{Marketing Manager}) = \textbf{Manager}\\
%
\underline{Authorization functions}\\
%
\noindent
-- {\isauth}R\textsubscript{\textbf{assign}}(\it{au} : \AU, \it{r\textsubscript1} : \R, \it{r\textsubscript2} : \R) $\equiv$ 
$\exists$\it{d} $\in$ \scope(\it{dept}). \it{dept}(\it{au}) = \it{dept}(\it{r\textsubscript1}) = \it{dept}(\it{r\textsubscript2}) 
%\wedge$ $\exists$\it{l\textsubscript1 $\neq$ l\textsubscript2} $\in$ \scope(\it{level}) $\wedge$ \it{level}(\it{r\textsubscript1}) = \it{l\textsubscript1}  $\wedge$ \it{level}(\it{r\textsubscript2}) = \it{l\textsubscript2} $\in$ <\it{l\textsubscript2, l\textsubscript1}> $\in$ H\textsubscript{\it{level}} 
%\vspace{0.12cm}$
\newline
-- {\isauth}R\textsubscript{\textbf{revoke}}(\it{au} : \AU, \it{r\textsubscript1} : \R, \it{r\textsubscript2} : \R) $\equiv$ {\isauth}R\textsubscript{\textbf{assign}}(\it{au} : \AU, \it{r\textsubscript1} : \R, \it{r\textsubscript2} : \R)
% $\exists$\it{d} $\in$ \scope(\it{dept}). \it{dept}(\it{au}) = \it{dept}(\it{r\textsubscript1}) =  \it{dept}(\it{r\textsubscript2})
%\vspace{-0.03cm}


ARRA_model.tex

\begin{table*}[tbp]
\caption{ARRA Model}
\centering
\label{tab:arra}
\begin{tabu} to 1\textwidth { | X[l] | }
\hline

-- \AU, \OP, \R, \AR\  are finite sets of administrative users, administrative operations such as assign and  
\hspace{7pt}revoke, regular roles and administrative roles, respectively. \\
-- \AUA\ $\subseteq$ \AU\ $\times$ \AR, administrative user to administrative role assignment relation. \\
-- \RH\ $\subseteq$ \R\ $\times$ \R, a partial ordering on the set \R.\\

-- \ARH\ $\subseteq$ \AR\ $\times$ \AR, a partial ordering on the set \AR.\\

-- \AATT, \ARATT, and \RATT\ are finite sets of administrative user attribute functions, administrative role 

\hspace{7pt}attribute functions, and regular role attribute functions, respectively. \\  

-- For each \textit{att} in \AATT\ $\cup$ \ARATT\ $\cup$ \RATT,
\scope(\it{att}) 
is a finite set of atomic values from which the range \\ 
\vspace*{-3ex}
\hspace{7pt}of the 
attribute function \it{att} is derived.
\vspace{1ex}

-- attType : \AATT\ $\cup$ \ARATT\ $\cup$ \RATT\ $\rightarrow$ \{set, atomic\},
which specifies whether the range of a given attribute\\ 
\vspace{-2ex}
\hspace{7pt}is atomic or set valued.\\
%
-- Each attribute function maps elements in \AU, \AR\ and \R\ to atomic or set values.

%
  \[
    \forall aatt \in \mbox{\AATT}.\ aatt : \mbox{\AU} \rightarrow \left\{
                \begin{array}{ll}
                  \mbox{\scope}(aatt)\> \mbox{if} \> \mbox{attType}(aatt) = \mbox{atomic}\\
                  2\textsuperscript{\scope(\textit{aatt})}\> \mbox{if}\> \mbox{attType}(aatt) = \mbox{set}\\
                 
                \end{array}
              \right.
  \]
%
  \[
    \forall aratt \in \mbox{\ARATT}.\ aratt : \mbox{\AR} \rightarrow \left\{
                \begin{array}{ll}
                  \mbox{\scope}(aratt)\> \mbox{if} \> \mbox{attType}(aratt) = \mbox{atomic}\\
                  2\textsuperscript{\scope(\textit{aratt})}\> \mbox{if}\> \mbox{attType}(aratt) = \mbox{set}\\
                 
                \end{array}
              \right.
  \]
  %
\[
  \forall ratt \in \mbox{\RATT}.\ ratt : \mbox{\R} \rightarrow \left\{
            \begin{array}{ll}
                \mbox{\scope}(ratt)\> \mbox{if} \> \mbox{attType}(ratt) = \mbox{atomic}\\
                 2\textsuperscript{\scope(\textit{ratt})}\> \mbox{if}\> \mbox{attType}(ratt) = \mbox{set}\\
               
               \end{array}
             \right.
\]
  %
-- \isord\ :  \AATT\ $\cup$ \ARATT\ $\cup$ \RATT\ $\rightarrow$ \{True, False\}, specifies
if the scope is ordered for each of the\\
\hspace{7pt}attributes.\\
-- For each \it{att} $\in$ \AATT\ $\cup$ \ARATT\ $\cup$ \RATT,
% \vspace{-1ex}

\hspace{7pt}if \isord(\it{att}) = True, 
H\textsubscript{\it{att}} $\subseteq$ \scope(\it{att}) $\times$ \scope(\it{att}),
a partially ordered attribute hierarchy, and H\textsubscript{\it{att}} $\neq$
$\phi$,

\hspace{7pt}else, 
if \isord(\it{att}) = False, 
H\textsubscript{\it{att}} = $\phi$\\
\hspace{3pt}
(For some \it{att} $\in$ \AATT\ $\cup$ \ARATT\ $\cup$ \RATT\
for which attType(\it{att}) = set and \isord(\it{att}) = True,
if
$\{a,b\}$, 

\hspace{7pt}$\{c,d\}$
$\in$ 2\textsuperscript{\scope(\textit{att})}
(where $a, b, c, d \in$ \scope($att$)), 
we infer
$\{a,b\}$ $\geq$ $\{c,d\}$ if
$(a,c)$, $(a,d)$, $(b,c)$, $(b,d)$

\hspace{7pt}$\in$ H\textsupsub{*}{\it{att}}.)
\vspace{7pt}\\
\hhline{|=|}

ARRA model allows an administrator to perform an operation on a single role
or a set of roles at a time. The authorization rule for performing an operation on a single role is as follows:\\

For each \it{op} in \OP, {\textbf{\isauth}}\textbf{R\textsubscript{\it{op}}}(\it{au}: \AU, \it{r\textsubscript1} :
\R, \it{r\textsubscript2} : \R) specifies if the admin user \it{au} is allowed to perform
the operation \it{op} (e.g. assign, revoke, etc.) between the
regular roles \it{r\textsubscript1} and the role \it{r\textsubscript2}. Assigning a role \it{r\textsubscript1} to \it{r\textsubscript2} makes \it{r\textsubscript1} junior to \it{r\textsubscript2}. This rule is written as a logical expression using attributes of admin
user \it{au}, admin role, \it{ar}, and regular role, \it{r}.
\vspace{1em}\\
\hline
The authorization rule for performing an operation on a set of users is as follows:\\

For each \it{op} in \OP, {\textbf{\isauth}}\textbf{R\textsubscript{\it{op}}}(\it{au}: \AU, $\chi$ :
2\textsuperscript{\R}, \it{r} : \R) specifies if the admin user \it{au} is allowed to
perform the operation \it{op} (e.g. assign, revoke, etc.) between the roles
in the set $\chi$ and the role \it{r}. 

Here $\chi$ is a set of roles that can be specified using a set-builder
notation, whose rule is written using role attributes.
\vspace{1em}
\\
\hline
\end{tabu}
\end{table*}


ARRAmodelsection.tex
\section{ARRA Model}\label{sec:aarbac}
%
In this section, we present our approach for attribute-based role-role assignment (ARRA). Inspired by prior RRA models we have included attributes for admin users, admin roles and regular roles. Based on these attributes role assignment and revocation decisions on are made. 
%
%Decisions on whether an admin user can assign/revoke a regular role to/from another regular role is based on the attributes of admin user, regular role and admin role. 

Table~\ref{tab:arra} presents formal ARRA model. The entities involved in ARRA comprise of admin users (\AU), regular roles (\R) and their
hierarchy (\RH), admin roles (\AR) and their hierarchy (\ARH), admin user to admin role relation (\AUA) and admin operations (\OP). 

In ARRA, admin user in \AU\ wants to perform admin operation such as assign or revoke from \OP\ using attributes of entities in the model. We have developed admin users attribute functions (\AATT) and admin roles attribute functions (\ARATT). We have also introduced regular roles attribute functions (\RATT) based on the need we have observed. Attributes from other RBAC entities can also be developed if needed. We will later see that we need attributes from different entities in representing properties of RRA97 and UARBAC's RRA in ARRA.   

The attribute functions or \emph{simply} attributes are defined as mapping from its domain such as \AU\ or \AR\ to its range. Range of an attribute \it{att} can be atomic or set valued, which is specified by function attType. It is derived from set of scope or atomic values denoted by \scope(\it{att}). Furthermore, the scope of an attribute can be either ordered or unordered, which is given by a function called \isord(\it{att}). If it is ordered, we must specify that attribute's hierarchy denoted by H\textsubscript{\it{att}} on its scope \scope(\it{att}). H\textsubscript{\it{att}} is a partial ordering on \scope(\it{att}). Note that even in the case of a set valued attribute \it{att}, the
hierarchy H\textsubscript{\it{att}} is specified on \scope(\it{att}) instead of
2\textsuperscript{\scope(\it{att})}. We infer the ordering between two set values given an ordering on atomic values. 
H\textsupsub{*}{\it{att}} in Table~\ref{tab:arra}
denotes the reflexive transitive closure of
H\textsubscript{\it{att}}.

In ARRA, there are two ways by which an admin user can select a set of regular roles for assignment to a target regular role. The first way allows an admin user to select a single role and a target role, and perform an admin operation like assign or revoke. The second way allows an admin user to select a set of regular roles, the target role and perform similar operation on those roles. In the latter case, the selection criteria for the set
of regular roles can be expressed using a set-builder notation whose rule
is based on the regular role attributes. For example, 
{\isauth}R\textsubscript{\textbf{assign}}(\textbf{au},
\{\it{r\textsubscript1} | \it{r\textsubscript1} $\in$ \R\ $\wedge$ \textbf{Lead} $\in$ \it{roleTitle}(\it{r\textsubscript1})\},
\textbf{r\textsubscript2}) 
would specify a policy for an admin user \textbf{au} that selects the set of all the roles with role title \textbf{Lead} in order to assign those roles to a role \textbf{r\textsubscript2}. Assigning a role \it{r\textsubscript1} to role \it{r\textsubscript2} makes role \it{r\textsubscript1} junior to \it{r\textsubscript2}. In other words, it adds an entry <\it{r\textsubscript2, r\textsubscript1}> in \RH. It is also referred to as edge insetion. 

Authorization rule is specified as a logical expression on
the attributes of admin users, admin roles, and that of regular roles considered for assignment. 






conclusion.tex
\section{Conclusion}\label{sec:conclude}
In this paper, we presented ARRA, a model for attribute based role-role assignment. A design motivation behind ARRA model was to make it enough to express prior RRA models. In particular, we took RRA97 and UARBAC's RRA model as foundation. For these models, we have presented Map\textsubscript{RRA97} and Map\textsubscript{RRA-UARBAC} algorithms, which map any instances of these models to ARRA model, respectively. 

ARRA model can not only express existing RRA models but also has a capability to do more. For instance, prior models included in our research did not fit the notion of regular role attributes. However, we acknowledge that it is an essential attribute in making role assignment decisions to say the least. Motivated by this notion, we presented a simple example scenario where we made use of regular role attributes for role-role assignment. 

intro.tex
\section{Introduction}
Role-based access control (RBAC)~\cite{sandhu2000nist,sandhu-rbac96} model is well studied in academia\cite{Fuchs2011748} and well adopted in the industry\cite{Oconnor2010nist}. In RBAC, assignment of users and permissions to roles allows users to execute permissions by activating roles. 

Administrative RBAC (ARBAC), which involves in user-role assignment and revocation (URA), permission-role assignment and revocation (PRA), and role-role assignment and revocation (RRA), is a challenging task~\cite{Sandhu97}. ARBAC has been well explored~\cite{Sandhu97, Sandhu99, Oh02,
uarbac, BiswasUni}. All of these works explore URA and PRA. However, only few cover RRA~\cite{Sandhu97, uarbac}. Each of these models use few fixed set of properties of RBAC in making assignment decisions.  For example, 
In RRA97~\cite{Sandhu97}, an admin role is given admin authority over set of roles, called role range, where admin role can perform role assignment.

Recently, Attribute-Based Access Control (ABAC) has gained popularity because of its flexibility~\cite{kuhn2010adding, huNISTguide, jin2012unified, bhatt2017abac, biswas2017attribute}. ABAC has also proven its ability to represent different access control models~\cite{jin2012unified}. However, it has rarely been used in administration of RBAC. 

Among three main aspects of ARBAC, we have explored models for attribute-based user-role assignment (AURA) and attribute-based permission-role assignment (ARPA) models~\cite{ninglekhu2017attribute}. 

In this paper we present our model for attribute-based role-role assignment (ARRA), a follow-up work on AARBAC~\cite{ninglekhu2017attribute}. ARRA is driven by our objective to design attribute-based model that  allows us to express features from previous RRA models and more. For example, it allows us to express features as a combination of two prior models and in addition, allows us to add new features. Thus,
this work is motivated largely by two critical factors: (a) 
an objective to build a coherent model, which can be configured to express prior models and more (b) build a unified model that can be analyzed for various desirable security features, which can provide a \it{single} codebase to express prior models and beyond. The contributions of this paper are as follows:
\begin{itemize}
  \item We develop an attribute-based administrative model for role-role
    assignment (\textbf{ARRA}). 
%    
\item We demonstrate that ARRA is capable of expressing prior
  approaches to RRA such as RRA97~\cite{Sandhu97} and UARBAC's RRA~\cite{uarbac}.
\end{itemize}

The remainder of this paper is organized as follows. In
Section~\ref{sec:relatedwork}, we discuss related work.  In
Section~\ref{sec:aarbac}, ARRA model is presented. Section~\ref{sec:URAtranslations} 
presents algorithms that translate prior RRA instances into equivalent ARRA instances. Section~\ref{sec:conclude} concludes the paper.





mapRRA-U_sec.tex
%%%URA-UARBAC

\subsection{Map\textsubscript{RRA-UARBAC}}
\label{sec:rra-uarbac}
We presented example instances for UARBAC's RRA and its equivalent AARA instance in previous segments. Algorithm~\ref{algo:rra-uarbac} presents 
Map\textsubscript{RRA-UARBAC}, a procedure to map any instance of UARBAC's RRA~\cite{uarbac} to its equivalent ARRA instance. It take instance of UARBAC's RRA as its input and yields an equivalent AARA instance as its output. 
Sets and functions from UARBAC and ARRA are labeled with superscripts U and A, respectively.
Input consists of \it{C}\textsuperscript{U}, \it{\U}\textsuperscript{U}, \it{\R}\textsuperscript{U}, \it{P}\textsuperscript{U},
\it{\RH}\textsuperscript{U},
\it{AM}\textsuperscript{U}(\textsf{role}), For each \it{u} $\in$ \it{\U}\textsuperscript{U},
authorized\_perms\textsuperscript{{U}}[\it{u}], and
For every \it{r\textsubscript1}, \it{r\textsubscript2} $\in$ \it{\R}\textsuperscript{{U}}. Grant operation
grantRoleToRole(\it{r\textsubscript1, r\textsubscript2}) will be true if the granter has either {[\textsf{role}, \it{r\textsubscript2}, \textsf{empower}]} and  {[\textsf{role}, \it{r\textsubscript1}, \textsf{grant}]} \textbf{or},
{[\textsf{role}, \it{r\textsubscript{2}}, \textsf{empower}]} and {[\textsf{role}, \textsf{grant}]} \textbf{or},
{[\textsf{role}, \textsf{empower}]} and {[\textsf{role}, \it{r\textsubscript1}, \textsf{grant}]} \textbf{or}, {[\textsf{user}, \textsf{empower}]} and {[\textsf{role}, \textsf{grant}]} permissions towards roles. 

 For each \it{r\textsubscript1}, \it{r\textsubscript2} $\in$ \it{\R}\textsuperscript{{U}}, revokeRoleFromUser(\it{r\textsubscript1, r\textsubscript2}) is true if the granter has either  
{[\textsf{role}, \it{r\textsubscript{2}}, \textsf{empower}] and [\textsf{role}, \it{r\textsubscript1}, \textsf{grant}]} \textbf{or}, 
{[\textsf{role}, \it{r\textsubscript1}, \textsf{admin}]} \textbf{or}, 
 {[\textsf{role}, \it{r\textsubscript2}, \textsf{admin}]} \textbf{or},
 {[\textsf{role}, \textsf{admin}]} permission on roles.

Map\textsubscript{RRA-UARBAC} yields an ARRA instance consisting of \AU\textsuperscript{{A}}, \OP\textsuperscript{{A}},
\R\textsuperscript{{A}}, \AR\textsuperscript{{A}}, \AUA\textsuperscript{{A}}, \RH\textsuperscript{{A}}, \ARH\textsuperscript{{A}}, \AATT\textsuperscript{{A}}, For each attribute
\it{att} $\in$  \AATT\textsuperscript{{A}},
\scope\textsuperscript{{A}}(\it{att}), attType\textsuperscript{{A}}(\it{att}),
\isord\textsuperscript{{A}}(\it{att}) and H\textsuperscript{{A}}\textsubscript{\it{att}}, For each user
\it{au} $\in$ \AU\textsuperscript{{A}}, and for each \it{att} $\in$ \AATT\textsuperscript{{A}}, \it{att}(\it{au}), Authorization rule for assign
(auth\_assign), and Authorization rule for revoke (auth\_revoke).

In Step 1 primary sets from 
UARBAC's RRA are mapped to AURA equivalent sets. In Step 2, 
admin user attributes are defined. In UARBAC model, role-role assignment decisions are based on the admin user's \emph{access modes} such as \textsf{grant}, \textsf{empower} and \textsf{admin} towards regular roles.  
For example, for each permission [\textsf{role}, \it{r}, \textsf{grant}] in authorized\_perms\textsuperscript{U}[\it{u}], \it{grantAuth}(\it{au}) attribute extracts set of roles towards which an admin user \it{au} has \textsf{grant} authority. In other words, admin user can grant those roles to any other object such as user and role. Similarly, \it{empowerAuth} yields set of roles to which an admin user has \textsf{empower} \it{access mode} and \it{adminAuth} yields sets of roles about which admin user has \it{admin} \it{access mode}. The meaning of each \it{access mode} is preserved by UARBAC model. 
For each class level attribute [\it{c}, \it{am}] in authorized\_perms\textsuperscript{U}[\it{u}], where \it{c} is a type of class and \it{am} is type of \it{access mode},  \it{roleClassAuth}(\it{au}) specifies the nature of class level \it{access mode} such as \textsf{grant} or \textsf{admin} admin user \it{au} has on \textsf{role} class.

In Step 3, an authorization formula equivalent to
grantRoleToRole(\it{r\textsubscript1, r\textsubscript2}) in UARBAC is expressed. Equivalent expression {\isauth}R\textsubscript{\textbf{assign}}(\textit{au\textsubscript} : \AU\textsuperscript{{A}}, \it{r\textsubscript1} : \R\textsuperscript{{A}}, \textit{r\textsubscript2} : \R\textsuperscript{A}) checks if an admin user \it{au} grant authority over role \it{r\textsubscript1} and empower authority over role \it{r\textsubscript2}.
Similarly, in Step 4 revoke\_formula equivalent to revokeRoleFromRole(\it{r\textsubscript1, 
r\textsubscript2}) is constructed using revoke permissions given to admin user. It checks whether an admin user \it{au} has an authority to revoke roles \it{r\textsubscript1} and \it{r\textsubscript2}. 
%\vspace{-0.11cm}


mapRRA97_sec.tex

\subsection{Map\textsubscript{RRA97}}
%
Algorithm~\ref{alg:rra97} presents Map\textsubscript{RRA97}, a translation algorithm for any RRA97
instance into an equivalent ARRA instance. Superscript labels 97 and A in the algorithm represent sets and functions from RRA97 and ARRA, respectively. Map\textsubscript{RRA97} takes an instance of RRA97 as input.
In particular, input consists of \U\textsuperscript{{97}},
\R\textsuperscript{{97}}, \AR\textsuperscript{{97}}, \AUA\textsuperscript{{97}}, \RH\textsuperscript{{97}}, \ARH\textsuperscript{{97}}, and \it{can-modify}\textsuperscript{{97}}. 
The \it{can-modify} instruction covers operations for inserting an edge, deleting an edge, creating a role and deleting a role. ARRA can simulate inserting edge and deleting an edge. However, creating and deleting roles are beyond the scope of current ARRA model.

Output from Map\textsubscript{RRA97} algorithm is 
an equivalent ARRA instance, with following sets and functions. \AU\textsuperscript{{A}}, \OP\textsuperscript{{A}}, \R\textsuperscript{{A}}, \AUA\textsuperscript{{A}}, \RH\textsuperscript{{A}}, \ARH\textsuperscript{{A}}, \AATT\textsuperscript{{A}}, \ARATT\textsuperscript{{A}}, For each
attribute \it{att} $\in$ \ARATT\textsuperscript{{A}},
\scope\textsuperscript{{A}}(\it{att}), attType\textsuperscript{{A}}(\it{att}),
\isord\textsuperscript{{A}}(\it{att}) and H\textsuperscript{{A}}\textsubscript{\it{att}}, 
%For each admin user
%\it{au} $\in$ \AU\textsuperscript{{A}} and for each \it{att} $\in$ \AATT\textsuperscript{{A}},
%\it{att}(\it{au}), 
For each admin role \it{ar} $\in$ \AR\textsuperscript{{A}} and for each \it{att} $\in$ \ARATT\textsuperscript{{A}}, \it{att}(\it{ar}), 
Authorization rule for assign
(auth\_assign), and Authorization rule for revoke (auth\_revoke). 

Steps indicated in Map\textsubscript{RRA97} correspond to the steps described in equivalent ARRA instance for RRA97 in section~\ref{sec:arra-rra97}. We explain it here briefly.
Step 1 maps sets from RRA97 to ARRA sets and functions. 
In Step 2, admin user attributes and admin role attributes are
expressed. 
\AATT\ and \RATT\ are left empty as there is no use case for these attributes in translating RRA97. Admin role attribute \it{authRange} captures the mapping between an authority range as defined in RRA97, and an admin role.  
For each (\it{ar}, (\it{r\textsubscript{i}, r\textsubscript{j}})) in set \it{can-modify}\SS{97}, \it{authRange}(\it{ar}) populates set of authority ranges for \it{ar}.

%An authority range is symbolically represented with bottom and top end points in the role hierarchy. For example, in an authority range (a, b) that includes all the roles between a and b, a is the bottom end and b is the top end of the range. In ARRA, set of roles in an authority range (a, b) is represented by $\lceil$a, b$\rceil$ = \{\it{r} $\vert$ \it{r} $\in$ \R\ $\wedge$ a < \it{r} < b\}. 

In Step 3, we construct assign\_formula rule for ARRA that is equivalent to inserting an edge in \it{can\_modify}\textsuperscript{{97}}. For each (\it{ar}, (\it{r\textsubscript{i}, r\textsubscript{j}})) in set \it{can-modify}\SS{97}, logical expression that checks the assignment conditions is constructed.  
Equivalent translation in ARRA is given by {\isauth}R\textsubscript{\textbf{insertEdge}}(\it{au} : \AU\textsuperscript{{A}}, \it{r\ss1} :
\R\textsuperscript{{A}}, \it{r\ss2} : \R\textsuperscript{{A}}). This formula must checks if roles \it{r\ss1} and \it{r\ss2} belong in an authority range of an admin role, which is mapped to admin user \it{au}. It further checks if \it{r\ss1} and \it{r\ss2} have same immediate authority range, or checks if any other assignment action doesn't violate encapsulation of admin role's authority range. Similarly, In Step 4, revoke\_formula equivalent to deleting an edge from \it{can\_modify}\textsuperscript{{97}} is expressed. It checks if admin role mapped to admin role \it{au} has authority range where \it{r\ss1} and \it{r\ss2} belong and restricts from deleting an edge between end points of any authority range.

related.tex
\section{Related work}\label{sec:relatedwork}

Among many prominent works done for ARBAC~\cite{Sandhu97,Sandhu99,Oh02,BiswasUni,uarbac}, ARBAC97~\cite{Sandhu97} and UARBAC~\cite{uarbac} present role-role assignment (RRA) as part of their model. 

In RRA97, a set of roles in the hierarchy called authority range is given to an admin role for decentralized administration. A user with admin role can perform operations like inserting an edge or creating a role, on roles in her authority range. To confirm autonomy RRA97 requires role range to be encapsulated~\cite{Sandhu97}. 
 
UARBAC~\cite{uarbac} redefines RBAC model with class objects. It treats each entity in the RBAC system such as files, roles and users as objects. UARBAC's RRA deals with assigning/revoking role-role on the basis of admin user's authority over individual roles specified by \it{access modes}. 
Class permissions in UARBAC allows an admin user to conduct an operation over every object of a class. 

In both of these models, the policy for assigning a role to a
role is based on a fixed set of properties of the entities such as admin role, admin user and regular roles, involved in assigning/revoking roles.

Crampton et. al~\cite{crampton2002administrative} present  models for RRA with administrative scopes. Admin scopes are plausible approach for role hierarchy operations in RBAC. However, admin scopes may not be intuitive to express as a role attribute.
Many literature~\cite{kuhn2010adding,jin2012rabac,rajpoot2015attributes} present benefits of integrating attributes into an RBAC operational model. An operational model deals with making decisions on user's access request for objects. There are many works on operational aspects of ABAC~\cite{yuan2005attributed,jin2012unified,huNISTguide,servos2014hgabac}. In contrast, ARRA is an administrative model that uses attributes of RBAC entities for assigning/revoking roles.
 % 
RRA-UARBACInstance.tex
% \section{Mapping an Example Instance of \\
% UARBAC's RRA in ARRA}\label{rrau-appendix}
\subsection{Mapping UARBAC's RRA to ARRA}
In this section, we present an example instance for UARBAC's RRA and its equivalent ARRA instance. We then present an algorithm that outlines the translation procedure.  
\subsubsection{An Example UARBAC's RRA Instance}
\underline{RBAC schema}
\begin{itemize}
\item \it{C} = \{\textsf{role}\}
\item \it{OBJS}(\textsf{user}) = \textbf{USERS}, \it{OBJS}(\textsf{role}) = \textbf{ROLES}
% \item \it{AM}(\textsf{user}) = \{\textsf{empower, admin}\},
\item \it{AM}(\textsf{role}) = \{\textsf{grant, empower, admin}\}
\end{itemize}
\underline{RBAC state}
\begin{itemize}
\item \it{\U} = \it{OBJ}(\textsf{user}) = \{\textbf{u\textsubscript1, u\textsubscript2, u\textsubscript3, u\textsubscript4}\} 
\item \it{\R} = \it{OBJ}(\textsf{role})= \{\textbf{r\textsubscript{1}, r\textsubscript{2}, r\textsubscript3}\} % $\cup$ \textbf{sso}, where \textbf{sso} is a reserved role called Senior Security Officer.
\item \it{P} = [\textsf{role}, \textbf{r\textsubscript1}, \textsf{grant}], [\textsf{role}, \textbf{r\textsubscript1}, \textsf{empower}], [\textsf{role}, \textbf{r\textsubscript1}, \textsf{admin}], [\textsf{role}, \textbf{r\textsubscript2}, \textsf{grant}], [\textsf{role}, \textbf{r\textsubscript2}, \textsf{empower}], [\textsf{role}, \textbf{r\textsubscript2}, \textsf{admin}], [\textsf{role}, \textbf{r\textsubscript3}, \textsf{grant}], [\textsf{role}, \textbf{r\textsubscript3}, \textsf{empower}], [\textsf{role}, \textbf{r\textsubscript3}, \textsf{admin}], {[\textsf{role}, \textsf{grant}], [\textsf{role, empower}], [\textsf{role, admin}]\}}
%\item \it{\UA} = \{(\textbf{u\textsubscript1, r\textsubscript1}), (\textbf{u\textsubscript2, r\textsubscript1}), (\textbf{u\textsubscript2, r\textsubscript2}), (\textbf{u\textsubscript2, r\textsubscript3}), (\textbf{u\textsubscript3, r\textsubscript3}), (\textbf{u\textsubscript4, r\textsubscript2})\}
\item \it{\RH} = \{<\textbf{r\textsubscript2, r\textsubscript3}>\}
\end{itemize}
\noindent
\underline{Administrative permissions of UARBAC's RRA}\\
Following is the list of administrative permissions each user has for role-role assignment:
\begin{itemize}
\item authorized\_perms[\textbf{u\textsubscript1}]  = \{{[\textsf{role}, \textbf{r\textsubscript1}, \textsf{grant}],
\item[] \stab {[\textsf{role}, \textbf{r\textsubscript2}, \textsf{admin}]}, [\textsf{role}, \textbf{r\textsubscript2}, \textsf{empower}]}, 
\item[] \stab {[\textsf{role}, \textbf{r\textsubscript3}, \textsf{admin}]}\}

\item authorized\_perms[\textbf{u\textsubscript2}]  = \{[\textsf{role}, \textbf{r\textsubscript1}, \textsf{admin}],
\item[] \stab {[\textsf{role}, \textbf{r\textsubscript1}, \textsf{empower}]}, [\textsf{role}, \textbf{r\textsubscript2}, \textsf{empower}], 
\item[] \stab {[\textsf{role}, \textbf{r\textsubscript3}, \textsf{grant}]}\}
\item authorized\_perms[\textbf{u\textsubscript3}] = \{[\textsf{role, admin}]\}
\item authorized\_perms[\textbf{u\textsubscript4}] = \{[\textsf{role, grant}], \item[] \stab {[\textsf{role, empower}]}, {[\textsf{role, admin}]}\}
\end{itemize}
%
\underline{Role-role assignment condition}\\
One can perform following operation to assign a role \textbf{r\textsubscript1} to another role \textbf{r\textsubscript2}.
\begin{itemize}
\item grantRoleToRole(\textbf{r\textsubscript{1}, r\textsubscript{2}}) 
\end{itemize}
To perform this operation one needs one of the following two permissions:
\begin{itemize}
\item {[\textsf{role}, \textbf{r\textsubscript1}, \textsf{grant}]} and {[\textsf{role}, \textbf{r\textsubscript2}, \textsf{empower}]} or,
\item {[\textsf{role}, \textsf{grant}]} and {[\textsf{role}, \textbf{r\textsubscript2}, \textsf{empower}]} or,
\item {[\textsf{role}, \textbf{r\textsubscript1}, \textsf{grant}]} and {[\textsf{role}, \textsf{empower}]} or,
\item {[\textsf{role}, \textsf{grant}]} and {[\textsf{role}, \textsf{empower}]}
\end{itemize}
%
%
\underline{Condition for revoking a role from another role}\\
To revoke a role \textbf{r\textsubscript2} from a role \textbf{r\textsubscript3}, admin user performs following operation.
\begin{itemize}
\item revokeRoleFromUser(\textbf{r\textsubscript{2}, r\textsubscript{3}}) 
\end{itemize}
To conduct this operation one needs one of the following options:
\begin{itemize}
\item {[\textsf{role}, \textbf{r\textsubscript2}, \textsf{grant}] and [\textsf{role}, \textbf{r\textsubscript3}, \textsf{empower}]}
\item {[\textsf{role}, \textbf{r\textsubscript2}, \textsf{admin}]} 
\item {[\textsf{role}, \textbf{r\textsubscript3}, \textsf{admin}]}
\item {[\textsf{role}, \textsf{admin}]}
\end{itemize}

\vspace{0.19cm}
\noindent
%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%      URA-UARBAC      %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\subsection{ARRA instance equivalent to UARBAC's RRA instance}
This segment presents equivalent instance for UARBAC's RRA example instance presented in previous segment. \\
\underline{Map UARBAC's RRA sets to ARRA sets}
\begin{itemize}
%\item \U\ = \{\textbf{u\textsubscript{1}, u\textsubscript{2}, u\textsubscript{3}, u\textsubscript4}\}

\item \AU\ = \{\textbf{u\textsubscript{1}, u\textsubscript{2}, u\textsubscript{3}, u\textsubscript4}\}
\item \OP\ = \{\textbf{assign, revoke}\}
\item \R\ = \{\textbf{r\textsubscript{1}, r\textsubscript{2}, r\textsubscript3}\}, \item \AUA\ = \{\}
\item \RH\ = \{<\textbf{r\textsubscript2, r\textsubscript3}>\}
\end{itemize}
\underline{Define Attributes}
\begin{itemize}
\item \AATT\ = \{\textit{grantAuth, empowerAuth, adminAuth, roleClassAuth}\}, \ARATT\ = \{\}, \RATT\ = \{\}
%\item[] \tab class\_grantAuth, class\_empowerAuth,
%\item[] \tab class\_adminAuth}\}
\item \scope(\textit{grantAuth}) = \{\textbf{r\textsubscript{1}, r\textsubscript{2}, r\textsubscript3}\}
\item[] attType(\it{grantAuth}) = set, 
\item[] \isord(\it{grantAuth}) = \R, H\textsubscript{\it{grantAuth}} = \RH

\item \it{grantAuth}(\textbf{u\textsubscript{1}}) = \{\textbf{r\textsubscript1}\}, \it{grantAuth}(\textbf{u\textsubscript{2}}) = \{\textbf{r\textsubscript3}\},
\item[] \it{grantAuth}(\textbf{u\textsubscript{3}}) = \{\}, \it{grantAuth}(\textbf{u\textsubscript{4}}) = \{\}

\item \scope(\textit{empowerAuth}) = \{\textbf{r\textsubscript{1}, r\textsubscript{2}, r\textsubscript3}\}
\item[] attType(\it{empowerAuth}) = set, 
\item[] \isord(\it{empowerAuth}) = \R
\item[] H\textsubscript{\it{empowerAuth}} = \RH

\item \it{empowerAuth}(\textbf{u\textsubscript{1}}) = \{\textbf{r\textsubscript2}\}, 
\item[]\it{empowerAuth}(\textbf{u\textsubscript{2}}) = \{\textbf{r\textsubscript1, r\textsubscript2}\},
\item[] \it{empowerAuth}(\textbf{u\textsubscript{3}}) = \{\}, \it{empowerAuth}(\textbf{u\textsubscript{4}}) = \{\}

\item \scope(\textit{adminAuth}) = \{\textbf{r\textsubscript{1}, r\textsubscript{2}, r\textsubscript3}\}
\item[] attType(\it{adminAuth}) = set, 
\item[] \isord(\it{adminAuth}) = \R,
\item[] H\textsubscript{\it{adminAuth}} = \RH

\item \it{adminAuth}(\textbf{u\textsubscript{1}}) = \{\textbf{r\textsubscript2, r\textsubscript3}\}, 
\item[]\it{adminAuth}(\textbf{u\textsubscript{2}}) = \{\textbf{r\textsubscript1}\},
\item[] \it{adminAuth}(\textbf{u\textsubscript{3}}) = \{\}, \it{adminAuth}(\textbf{u\textsubscript{4}}) = \{\}
%%---------------------------------------------- class level perms
\item \scope(\textit{roleClassAuth}) = \it{AM}(\textsf{role})
\item[] attType(\it{roleClassAuth}) = set, 
\item[] \isord(\it{roleClassAuth}) = False, 
\item[] H\textsubscript{\it{roleClassAuth}} = $\phi$

\item \it{roleClassAuth}(\textbf{u\textsubscript{1}}) = \{\}, \it{roleClassAuth}(\textbf{u\textsubscript{2}}) = \{\textbf{}\},
\item[] \it{roleClassAuth}(\textbf{u\textsubscript{3}}) = \{\textsf{admin}\},
\item[] \it{roleClassAuth}(\textbf{u\textsubscript{4}}) = \{\textsf{grant, empower, admin}\}

\end{itemize}

\noindent
\underline{Construct authorization rule for role-role assignment}


 \vspace{0.13cm}
 \noindent
For each \it{op} in \OP, authorization rule to assign/revoke role-role can be expressed as follows:\\
To assign any regular role \it{r\textsubscript1} $\in$ \R\ to regular role \it{r\textsubscript2} $\in$ \R,\\
-- {\isauth}U\textsubscript{\textbf{assign}}(\it{au\textsubscript{}} : \AU, \it{r\textsubscript1} : \R, \\
\hspace*{0.3cm}\it{r\textsubscript2} : \R) $\equiv$ \\
\hspace*{0.3cm}(\it{r\textsubscript{1}} $\in$ \it{grantAuth}(\it{au\textsubscript{}}) $\wedge$ \it{r\textsubscript2} $\in$ \it{empowerAuth}(\it{au\textsubscript{}})) $\vee$\\
\hspace*{0.3cm}(\it{r\textsubscript{1}} $\in$ \it{grantAuth}(\it{au\textsubscript{}}) $\wedge$ \textsf{empower} \\
\hspace*{0.3cm}$\in$ \it{roleClassAuth}(\it{au\textsubscript{}})) $\vee$ 
(\textsf{grant} $\in$ \it{roleClassAuth}(\it{au\textsubscript{}}) $\wedge$ \\
\hspace*{0.3cm}\it{r\textsubscript2} $\in$ \it{empowerAuth}(\it{au\textsubscript{}})) $\vee$ (\textsf{grant} $\in$ \it{roleClassAuth}(\it{au\textsubscript{}}) \\
\hspace*{0.3cm}$\wedge$ \textsf{empower} $\in$ \it{roleClassAuth}(\it{au\textsubscript{}}))
 
 \vspace{0.17cm}
 \noindent
 \underline{Construct authorization rule for revoking role-role}
 
 \vspace{0.13cm}
 \noindent
 To revoke any regular role \it{r\textsubscript1} $\in$ \R\ from another regular role \it{r\textsubscript2} $\in$ \R,\\
-- {\isauth}U\textsubscript{\textbf{revoke}}(\it{au\textsubscript1} : \AU, \it{r\textsubscript1} : \R,\\
\hspace*{0.3cm}\it{r\textsubscript2} : \R) $\equiv$ \\
\hspace*{0.3cm}(\it{r\textsubscript{1}} $\in$ \it{grantAuth}(\it{au\textsubscript{}}) $\wedge$ \it{r\textsubscript2} $\in$ \it{empowerAuth}(\it{au\textsubscript{}})) $\vee$\\
\hspace*{0.3cm}\it{r\textsubscript{1}} $\in$ \it{adminAuth}(\it{au\textsubscript{}}) $\vee$ \it{r\textsubscript{2}} $\in$ \it{adminAuth}(\it{au\textsubscript{}}) $\vee$\\
\hspace*{0.3cm}\textsf{admin} $\in$ \it{roleClassAuth}(\it{au}) \\


There are four main stages in this translation process.
First, we map main sets from UARBAC's RRA to ARRA model. 
Set of admin users consists of set of users from UARBAC's RRA, namely \textbf{u\textsubscript{1}, u\textsubscript{2}, u\textsubscript{3}}, and \textbf{u\textsubscript4}. There are two admin operations, \textbf{assign} and \textbf{revoke}. Sets \R\ and \RH\ map set of roles and role hierarchy from UARBAC's RRA, respectively. \AUA\ is left empty as there is no notion of admin roles in UARBAC. 

Next, we define required attribute functions. We used admin user attributes to express ARRA for UARBAC's RRA. Among four admin user attributes, \textit{grantAuth, empowerAuth} and \it{adminAuth}  are object level attributes. Each of these attributes express the nature of authority an admin user has over different roles. For example, \it{empowerAuth} over a role \it{r\textsubscript{x}}, allows admin user to assign any object such as a user and/or another role to role \it{r\textsubscript{x}}. Class level attribtue \it{roleClassAuth} captures the nature of \it{access mode} an admin user has towards role class. The scope of this attribute is \it{AM}(\textsf{role}), which has three different types of access modes, namely \textsf{grant, empower} and \textsf{admin}. For example, an admin user with \it{roleClassAuth} of \textsf{grant} allows that admin user to grant (assign) any role to other object such as a user and/or role. Translation of UARBAC's RRA doesn't require admin role and regular role attributes, hence left empty.

After attributes have been defined we construct the assignment formula (assign\_formula), using usual logical expression. As mentioned in the UARBAC's RRA instance, there are four different combination of permissions an admin user can use to make role-role assignment. An equivalent logical expression is captured as  {\isauth}U\textsubscript{\textbf{assign}}(\it{au\textsubscript{}} : \AU, \it{r\textsubscript1} : \R, \it{r\textsubscript2} : \R). Finally, we construct a logical expression which captures four different permission options that an admin user can use for revoking a role from another role. The logical expression is equivalent to {\isauth}U\textsubscript{\textbf{revoke}}(\it{au\textsubscript1} : \AU, \it{r\textsubscript1} : \R, \it{r\textsubscript2} : \R).




RRA97Instance.tex
\begin{figure}[t]
 \centering
 \includegraphics[scale=0.27]{figs/roleh.pdf}
 \caption{Role and Administrative Role Hierarchies in RRA97}
 \label{fig:roleh}
\end{figure}
\subsection{Mapping RRA97 to AARA}
In this section, we present RRA97 example instance and manually convert it into its equivalent ARRA instance. We then present a mapping algorithm for the same, which demostrates a programmable procedure for translation of any RRA97 instance to its equivalent ARRA instance.
\subsubsection{An RRA97 Example Instance}
RRA97~\cite{Sandhu97} assumes an existing regular role hierarchy and an administrative role hierarchy as depicted in Figure~\ref{fig:roleh}.  An example instance for RRA97 model is presented as follows: \\
\underline{Sets and Functions}: 
\begin{itemize}
\item \U\ = \{\textbf{u\textsubscript1, u\textsubscript2, u\textsubscript3, u\textsubscript4}\} 
\item \R\ = \{\textbf{ED, E1, PE1, QE1, PL1, E2, PE2, 
\item[] \stab QE2, PL2, DIR}\}
\item \AR\ = \{\textbf{DSO, PSO1}\}
\item \AUA\ = \{(\textbf{u\textsubscript3, DSO}), (\textbf{u\textsubscript4, PSO1})\}
%\item \AU\ =  \{\textbf{u\textsubscript1, u\textsubscript2, u\textsubscript3, u\textsubscript4}\} 
\item \RH\ = \{<\textbf{ED, E1}>, <\textbf{E1, QE1}>, <\textbf{E1, PE1}>,
\item[] \stab <\textbf{PE1, PL1}>, <\textbf{QE1, PL1}>, <\textbf{ED, E2}>, 
\item[] \stab  <\textbf{E2, PE2}>, <\textbf{E2, QE2}>, <\textbf{PE2, PL2}>, 
\item[] \stab  <\textbf{QE2, PL2}>, <\textbf{PL1, DIR}>, <\textbf{PL2, DIR}>\}
\item \ARH\ = \{<\textbf{SSO, DSO}>, <\textbf{DSO, PSO1}>, \\
\stab <\textbf{DSO, PSO2}>\}
\item \it{can-modify} = \{(\textbf{DSO, (ED, DIR)}), 
\item[] \stab  (\textbf{PSO1, (E1, PL1)}), (\textbf{PSO1, (E2, PL2)})\}
\item[] Where, (\textbf{ED, DIR}) = \{\textbf{E1, E2, PE1, PE2, QE1,
\item[] \stab   QE2, PL1, PL2}\}, 
\item[] (\textbf{E1, PL1}) = \{\textbf{PE1, QE1}\} and, 
\item[] (\textbf{E2, PL2}) = \{\textbf{PE2, QE2}\}
\end{itemize}

\U, \R, and \AR\  are sets of users, regular roles and admin roles, respectively. User \textbf{u\textsubscript3} is given admin role \textbf{DSO} and \textbf{PSO1} is given to role \textbf{u\textsubscript4}. \RH\ and \ARH\ represent regular role and admin role hierarchies as depicted in Figure~\ref{fig:roleh}. We have taken original can-modify example from RRA97 paper~\cite{Sandhu97} where each admin role is mapped with authority ranges. The \it{can-modify} set in our instance depicts the same scenario with three elements: (\textbf{DSO}, (\textbf{ED, DIR})),  (\textbf{PSO1}, (\textbf{E1, PL1})) and (\textbf{PSO1}, (\textbf{E2, PL2})). It shows that role \textbf{DSO} is given an authority range (\textbf{ED, DIR}) while role \textbf{PSO1} is given two authority ranges (\textbf{E1, PL1}) and (\textbf{E2, PL2}). 

In RRA97, an authority range,
 (x, y) = \{\it{r} : \R\ $\vert$ x < \it{r} < y\}, where x and y are end points of the range. 

For every (\it{ar}, (x, y)) in \it{can-modify}, the range denoted by (x, y) must be an encapsulated authority range.   
A range (x, y) is said to be encapsulated if,

\vspace{0.13cm}
\noindent
$\forall$\it{r\textsubscript1} $\in$ (x, y) $\wedge$ $\forall$\it{r\textsubscript2} $\notin$ (x, y). [\it{r\textsubscript2 > r\textsubscript1} $\leftrightarrow$ 
\it{r\textsubscript2} > y $\wedge$\\
 \it{r\textsubscript2} < \it{r\textsubscript1} $\leftrightarrow$ \it{r\textsubscript2} < x]

\vspace{0.17cm}
\noindent
A new edge AB can be inserted between two incomparable roles A and B under following two conditions:
\begin{itemize}
\item %Immediate authority ranges of A and B must be same, i.e.,
\it{AR\textsubscript{immediate}}(\it{A}) = \it{AR\textsubscript{immediate}}(\it{B}).
%where, 
An immediate authority range of a role \it{r},
 \it{AR\textsubscript{immediate}}(\it{r}) is the authority range (x,y) such that \it{r} $\in$ (x, y) and for all authority ranges (x\textquotesingle, y\textquotesingle) junior to (x, y) we have \it{r} $\notin$  (x\textquotesingle, y\textquotesingle).
\textbf{or}, 
\item if (x, y) is an authority range such that (A = y $\wedge$ B > x) $\vee$ (B = x $\wedge$ A < y) then insertion of AB must preserve encapsulation of (x, y). 

\vspace{0.17cm}
\noindent
\end{itemize}%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\subsubsection{ARRA Instance Equivalent to RRA97 Instance}
\label{sec:arra-rra97}
In this section, we show a manual translation of RRA97 example instance presented in previous segment into an equivalent ARRA instance. 
Equivalent ARRA instance is as follows:

\vspace{0.17cm}
\noindent
\underline{Map RRA97 sets to ARRA sets}
\begin{itemize}
%\item \U\ =\{\textbf{u\textsubscript1, u\textsubscript2, u\textsubscript3, u\textsubscript4}\}   
\item \AU\ = \{\textbf{u\textsubscript1, u\textsubscript2, u\textsubscript3, u\textsubscript4}\} %,% where \textbf{au\textsubscript1 = u\textsubscript3}, \textbf{au\textsubscript2 = u\textsubscript4}\\
\item \OP\ = \{\textbf{insertEdge, deleteEdge}\}
\item \R\ = \{\textbf{ED, DIR, E1, PE1, QE1, PL1, E2,
\item[] \stab  PE2, QE2, PL2, DIR}\}
\item \AUA\ = \{(\textbf{u\textsubscript3, DSO}), (\textbf{u\textsubscript4, PSO1})\}
\item \RH\ = \{<\textbf{ED, E1}>, <\textbf{E1, QE1}>, <\textbf{E1, PE1}>,
\item[] \stab <\textbf{PE1, PL1}>, <\textbf{QE1, PL1}>, <\textbf{ED, E2}>, 
\item[] \stab  <\textbf{E2, PE2}>, <\textbf{E2, QE2}>, <\textbf{PE2, PL2}>, 
\item[] \stab  <\textbf{QE2, PL2}>, <\textbf{PL1, DIR}>, <\textbf{PL2, DIR}>\}
\end{itemize}

\vspace{0.1cm}
\noindent
\underline{Define attributes}
\begin{itemize}
\item \AATT\ = \{\it{}\}, \RATT\ = \{\}
%\item \scope(\it{aroles}) = \{\textbf{DSO, PSO1}\}, 
%\item[] attType(\textit{aroles}) = set, \isord(\it{aroles}) = True, 
%\item[] H\textsubscript{\it{aroles}} = \{<\textbf{DSO, PSO1}>\}
%\item \it{aroles}(\textbf{u\textsubscript3}) = \{\textbf{DSO}\}, \it{aroles}(\textbf{u\textsubscript4}) = \{\textbf{PSO1}\}

\item \ARATT = \{\it{authRange}\}
\item \scope(\it{authRange}) = \RH\textsuperscript{+}, 
\item[] attType(\textit{authRange}) = set,
\item[]  \isord(\it{authRange}) = False, H\textsubscript{\it{authRange}} = $\phi$
\item \it{authRange}(\textbf{DSO}) = \{\textbf{ED, DIR}\},
\item[] \it{authRange}(\textbf{PSO1}) = \{(\textbf{E1, PL1}), (\textbf{E2, PL2})\}
\end{itemize}

\vspace{0.1cm}
\noindent
\underline{Construct authorization rule for \textbf{insertEdge}}\\
To  assign role \it{r\textsubscript1} to role \it{r\textsubscript2} (or to insert an edge \it{r\textsubscript1}\it{r\textsubscript2} and hence add <\it{r\textsubscript2}, \it{r\textsubscript1}> to \RH),\\
 -- {\isauth}R\textsubscript{\textbf{insertEdge}}(\it{au} : \AU, \it{r\textsubscript1} : \R, \it{r\textsubscript2} : \R)
$\equiv$ \\
%
($\exists$(\it{au}, \it{ar\textsubscript1}) $\in$ \AUA, $\exists$(s, t) $\in$ \it{authRange}(\it{ar\textsubscript1}). \it{r\textsubscript1}, \it{r\textsubscript2} $\in$ $\lceil$s, t$\rceil$) 
$\wedge$
(($\exists$(m, n), (m\q, n\q) $\in$ $\bigcup\limits_{ar\textsubscript2 \in\ \textrm{\AR}}$ \it{authRange}(\it{ar\textsubscript2}). 
\it{r\textsubscript1}, \it{r\textsubscript2} $\lceil$m, n$\rceil$ $\wedge$ ($\lceil$m\q, n\q$\rceil$ $\subset$ $\lceil$m, n$\rceil$ $\rightarrow$ \it{r\textsubscript1}, \it{r\textsubscript2} $\notin$ (m\q, n\q)))
$\vee$ 
($\exists$(x,y) $\in$ $\bigcup\limits_{ar\textsubscript3 \in\ \textrm{\AR}}$ \it{authRange}(\it{ar\textsubscript3}). ((\it{r\textsubscript1} = y $\wedge$ \it{r\textsubscript2} > x) $\vee$ (\it{r\textsubscript2} = x $\wedge$ \it{r\textsubscript1} < y)) $\wedge$ ($\forall$p $\in$ $\lceil$x, y$\rceil$ $\wedge$ $\forall$q $\notin$ $\lceil$x, y$\rceil$. (<q, p> $\in$ (\RH\ $\cup$ <\it{r\textsubscript2}, \it{r\textsubscript1}>)* $\leftrightarrow$ <q, y> $\in$ (\RH\ $\cup$ <\it{r\textsubscript2}, \it{r\textsubscript1}>)*) $\wedge$ (<p, q> $\in$ (\RH\ $\cup$ <\it{r\textsubscript2}, \it{r\textsubscript1}>)*  $\leftrightarrow$ <x, q> $\in$ (\RH\ $\cup$ <\it{r\textsubscript2}, \it{r\textsubscript1}>)*))))
%

\vspace{0.13cm}
\noindent
\underline{Construct authorization rule for \textbf{deleteEdge}}\\
  -- {\isauth}R\textsubscript{\textbf{deleteEdge}}(\it{au} : \AU, \it{r\textsubscript1} : \R, \it{r\textsubscript2} : \R) 
$\equiv$ \\
$\exists$(\it{au, ar}) $\in$ \AUA, $\exists$(x, y) $\in$ \it{authRange}(\it{ar}). 
\it{r\textsubscript1}, \it{r\textsubscript2} \\
$\in$ $\lceil$x, y$\rceil$ $\wedge$ $\forall$(u, v) $\in$ $\bigcup\limits_{ar\textsubscript4 \in\ \textrm{\AR}}$ \it{authRange}(\it{ar\textsubscript4}), $\exists$<\it{r\textsubscript2, r\textsubscript1}> $\in$ \RH. (\it{r\textsubscript1} $\neq$ u $\wedge$ \it{r\textsubscript2} $\neq$ v) \\

As we can observe, the process of translation involves four main steps. First, we map given sets from RRA97 to equivalent sets in ARRA. Second, required attribute functions are defined. We have designed admin role attribute \it{authRange} that maps authority ranges given to admin roles. Attribute \it{authRange} is set valued and unordered. Scope of \it{authRange} is a transitive clousure of regular role hierarchy, \RH\textsuperscript{+}. That is, if <a, b>, <b, c>, <c, d> $\in$ \RH\textsuperscript{+}, then <a, d> is also true.

We know that authority range represents a set of roles over which an admin role have authority to conduct operations such as assign and revoke. In ARRA, we use symbolic representation of authority range with end points a and b as (a, b). However, whenever we need to work with roles present in the set represented by authority range (a, b), we denote the set of roles with $\lceil${a, b}$\rceil$. That is, $\lceil$a, b$\rceil$ = \{\it{r} $\vert$ \it{r} $\in$ \R\ $\wedge$ a < \it{r} < b\}.

Next, we construct authorization rule for the admin operation \textbf{insertEdge}. There are fundamentally three requirements that an admin user must consider to assign role \it{r\textsubscript1} to role \it{r\textsubscript2}. Firstly, both the roles \it{r\textsubscript1} and \it{r\textsubscript2} must be within the authority range of an admin role assigned to a given admin user. Secondly, both the roles taken for edge insertion must have same immediate authority range, or (thirdly) if the edge is to be inserted between a role on the top end point of an authority range and a role senior to the lower end point of authority range,  or if the edge is to be inserted between a role on the bottom end of an authority range and a role junior to the top end of the authority range, then that edge insertion must preserve encapsulation of an authority range with those (top and bottom) end points. Finally, we construct an authorization formula for operation \textbf{deleteEdge}. 
An admin user with an admin role can delete an edge between any two roles in an authority range except that any edge between the end points of an authority range can not be deleted.     

RRAtranslations.tex
\section{Mapping Prior RRA Models in ARRA}\label{sec:URAtranslations}

In this section, we demonstrate that ARRA can intuitively simulate
the features of prior RRA models. In particular, we have developed
concrete algorithms that can convert any instance of RRA97 and UARBAC's RRA into an equivalent ARRA instance. For each of these models, we first present an example instance followed by that instance's corresponding ARRA equivalent. Then finally, we present algorithms for each to show a programmable mapping procedure.

SKM_Main.bbl
% Generated by IEEEtran.bst, version: 1.14 (2015/08/26)
\begin{thebibliography}{10}
\providecommand{\url}[1]{#1}
\csname url@samestyle\endcsname
\providecommand{\newblock}{\relax}
\providecommand{\bibinfo}[2]{#2}
\providecommand{\BIBentrySTDinterwordspacing}{\spaceskip=0pt\relax}
\providecommand{\BIBentryALTinterwordstretchfactor}{4}
\providecommand{\BIBentryALTinterwordspacing}{\spaceskip=\fontdimen2\font plus
\BIBentryALTinterwordstretchfactor\fontdimen3\font minus
  \fontdimen4\font\relax}
\providecommand{\BIBforeignlanguage}[2]{{%
\expandafter\ifx\csname l@#1\endcsname\relax
\typeout{** WARNING: IEEEtran.bst: No hyphenation pattern has been}%
\typeout{** loaded for the language `#1'. Using the pattern for}%
\typeout{** the default language instead.}%
\else
\language=\csname l@#1\endcsname
\fi
#2}}
\providecommand{\BIBdecl}{\relax}
\BIBdecl

\bibitem{sandhu2000nist}
D.~F. Ferraiolo, R.~Sandhu, S.~Gavrila, D.~R. Kuhn, and R.~Chandramouli,
  ``Proposed {NIST} standard for role-based access control,'' \emph{ACM
  Transactions Inf. Syst. Secur.}, vol.~4, pp. 224--274, Aug. 2001.

\bibitem{sandhu-rbac96}
R.~S. Sandhu, E.~J. Coyne, H.~L. Feinstein, and C.~E. Youman, ``Role-based
  access control models,'' \emph{Computer}, vol.~29, pp. 38--47, Feb 1996.

\bibitem{Fuchs2011748}
L.~Fuchs, G.~Pernul, and R.~Sandhu, ``Roles in information security - {A}
  survey and classification of the research area,'' \emph{Computers \&
  Security}, vol.~30, pp. 748 -- 769, 2011.

\bibitem{Oconnor2010nist}
A.~C. OConnor and R.~J. Loomis, ``2010 economic analysis of role-based access
  control,'' \emph{NIST, Gaithersburg, MD}, 2010.

\bibitem{Sandhu97}
R.~Sandhu, V.~Bhamidipati, and Q.~Munawer, ``The {ARBAC97} model for role-based
  administration of roles,'' \emph{ACM Transactions on Information and System
  Security (TISSEC)}, vol.~2, pp. 105--135, 1999.

\bibitem{Sandhu99}
R.~Sandhu and Q.~Munawer, ``The {ARBAC99} model for administration of roles,''
  in \emph{Proc. of the 15th Annual Computer Security Applications Conference
  (ACSAC'99)}.\hskip 1em plus 0.5em minus 0.4em\relax IEEE, 1999, pp. 229--238.

\bibitem{Oh02}
S.~Oh and R.~Sandhu, ``A model for role administration using organization
  structure,'' in \emph{Proc. of the seventh ACM symposium on Access control
  models and technologies}.\hskip 1em plus 0.5em minus 0.4em\relax ACM, 2002,
  pp. 155--162.

\bibitem{uarbac}
N.~Li and Z.~Mao, ``Administration in role-based access control,'' in
  \emph{Proc. of the 2nd ACM symposium on Information, computer and
  communications security}, 2007, pp. 127--138.

\bibitem{BiswasUni}
P.~Biswas, R.~Sandhu, and R.~Krishnan, ``{Uni-ARBAC}: A unified administrative
  model for role-based access control,'' in \emph{International Conference on
  Information Security}.\hskip 1em plus 0.5em minus 0.4em\relax Springer, 2016,
  pp. 218--230.

\bibitem{kuhn2010adding}
D.~R. Kuhn, E.~J. Coyne, and T.~R. Weil, ``Adding attributes to role-based
  access control,'' \emph{Computer}, vol.~43, pp. 79--81, 2010.

\bibitem{huNISTguide}
V.~C. Hu, D.~Ferraiolo, R.~Kuhn, A.~Schnitzer, K.~Sandlin, R.~Miller,
  K.~Scarfone \emph{et~al.}, ``Guide to attribute based access control ({ABAC})
  definition and considerations,'' \emph{NIST special publication}, vol. 800,
  no. 162, 2014.

\bibitem{jin2012unified}
X.~Jin, R.~Krishnan, and R.~Sandhu, ``A unified attribute-based access control
  model covering {DAC}, {MAC} and {RBAC},'' in \emph{IFIP Annual Conference on
  Data and Applications Security and Privacy}.\hskip 1em plus 0.5em minus
  0.4em\relax Springer, 2012, pp. 41--55.

\bibitem{bhatt2017abac}
S.~Bhatt, F.~Patwa, and R.~Sandhu, ``{ABAC} with group attributes and attribute
  hierarchies utilizing the policy machine,'' in \emph{Proc. of the 2nd ACM
  Workshop on Attribute-Based Access Control}.\hskip 1em plus 0.5em minus
  0.4em\relax ACM, 2017, pp. 17--28.

\bibitem{biswas2017attribute}
P.~Biswas, R.~Sandhu, and R.~Krishnan, ``Attribute transformation for
  attribute-based access control,'' in \emph{Proc. of the 2nd ACM Workshop on
  Attribute-Based Access Control}.\hskip 1em plus 0.5em minus 0.4em\relax ACM,
  2017, pp. 1--8.

\bibitem{ninglekhu2017attribute}
J.~Ninglekhu and R.~Krishnan, ``Attribute based administration of role based
  access control: A detail description,'' \emph{arXiv preprint
  arXiv:1706.03171}, 2017.

\bibitem{crampton2002administrative}
J.~Crampton, ``Administrative scope and role hierarchy operations,'' in
  \emph{Proceedings of the seventh ACM symposium on Access control models and
  technologies}.\hskip 1em plus 0.5em minus 0.4em\relax ACM, 2002, pp.
  145--154.

\bibitem{jin2012rabac}
X.~Jin, R.~Sandhu, and R.~Krishnan, ``{RABAC}: role-centric attribute-based
  access control,'' in \emph{International Conference on Mathematical Methods,
  Models, and Architectures for Computer Network Security}.\hskip 1em plus
  0.5em minus 0.4em\relax Springer, 2012, pp. 84--96.

\bibitem{rajpoot2015attributes}
Q.~M. Rajpoot, C.~D. Jensen, and R.~Krishnan, ``Attributes enhanced role-based
  access control model,'' in \emph{International Conference on Trust and
  Privacy in Digital Business}.\hskip 1em plus 0.5em minus 0.4em\relax
  Springer, 2015, pp. 3--17.

\bibitem{yuan2005attributed}
E.~Yuan and J.~Tong, ``Attributed based access control ({ABAC}) for web
  services,'' in \emph{Proc. of the IEEE International Conference on Web
  Services (ICWS'05)}.\hskip 1em plus 0.5em minus 0.4em\relax IEEE, 2005.

\bibitem{servos2014hgabac}
D.~Servos and S.~L. Osborn, ``{HGABAC}: Towards a formal model of hierarchical
  attribute-based access control,'' in \emph{International Symposium on
  Foundations and Practice of Security (FPS 2014)}.\hskip 1em plus 0.5em minus
  0.4em\relax Springer, 2014, pp. 187--204.

\end{thebibliography}
