Abstract
Aiming at the problems that a role-mapping process isn't related to role-spliting and evaluation methods, a theoretical support of role-spliting is put forward. Role-spliting is evaluated on three aspects based on ontology: excess rate of permission, split rate of role, destructive degree of role hierarchies. An entire algorithm of role-spliting is given. The feasibility of role-spliting is illustrated by an example. It is shows quantitatively that role-spliting is effective on role mapping of inter-domain and role hierarchy, and will be effective on modification of permission assignment, dipartition of lower-roles and adjustment of the whole role hierarchy.