The RSL99 language for role-based separation of duty constraints
- 28 October 1999
- proceedings article
- Published by Association for Computing Machinery (ACM)
Abstract
Separation of duty (SOD) is a fundamental technique for prevention of fraud and errors, known and practiced long before the existence of computers. It is discussed at several places in the literature, but there has been Iit- tle work on specifying SOD policies in a systematic way. This paper describes a framework for specifying separa- tion of duty and conflict of interest policies in role-based systems. To specify these policies, we need an appropri- ate language. We propose an intuitive formal language which uses system functions and sets as its basic ele- ments. The semantics for this language is defined by its translation to a restricted form of first order pred- icate logic. We show how previously identified SOD properties can be expressed in our language. More- over, we show there are other significant SOD proper- ties which have not been previously identified in the literature. Unlike much of the previous work, this pa- per deals with SOD in the presence of role hierarchies. Our work shows that there are many alternate formula- tions of even the simplest SOD properties, with varying degree of flexibility and assurance. Our language pro- vides us a rigorous foundation for systematic study of SOD properties.Keywords
This publication has 13 references indexed in Scilit:
- Transaction control expressions for separation of dutiesPublished by Institute of Electrical and Electronics Engineers (IEEE) ,2003
- Conceptual foundations for a model of task-based authorizationsPublished by Institute of Electrical and Electronics Engineers (IEEE) ,2002
- On the formal definition of separation-of-duty policies and their compositionPublished by Institute of Electrical and Electronics Engineers (IEEE) ,2002
- The role graph model and conflict of interestACM Transactions on Information and System Security, 1999
- A role-based access control model and reference implementation within a corporate intranetACM Transactions on Information and System Security, 1999
- Rationale for the RBAC96 family of access control modelsPublished by Association for Computing Machinery (ACM) ,1996
- Role-based access control modelsComputer, 1996
- Lattice-based access control modelsComputer, 1993
- Naming and grouping privileges to simplify security management in large databasesPublished by Institute of Electrical and Electronics Engineers (IEEE) ,1990
- A Comparison of Commercial and Military Computer Security PoliciesPublished by Institute of Electrical and Electronics Engineers (IEEE) ,1987