1. Introduction
Currently, role-based access control (RBAC) [1,2] has become the predominant access control model because it greatly simplifies the security management. The key feature of RBAC is that each role is a collection of permissions, and all users acquire permissions only through the roles. However, it is costly to develop and maintain an RBAC system though RBAC reduces the management cost.