A simple model of separation of duty for access control models

The principle of separation of duty is widely studied in the literature. Techniques for enforcing separation of duty (SD) policies fall under three categories, namely: static, dynamic and history-based separation of duty. Static SD is very limited in terms of its applicability and the use case it supports. In contrast, models that enforce SD dynamically have richer semantics therefore providing support for a wider number of SD policies. However, the use cases they support may be more than what typical systems require. The generality in these approaches makes them more costly and complicated to implement.This paper proposes a formal model of separation of duty that captures a certain type of separation of duty policies. The model is accessible such that one could easily incorporate it into existing access control models that do not yet have interfaces for creation and enforcement of separation of duty policies. More concretely, we described how our model was incorporated into the Role-based Access Control (RBAC) model to extend its separation of duty capabilities. We showed that this process was straightforward and the changes we have made in the RBAC specification were controlled and mostly additive ones. Moreover we also showed that under our model, one could also reduce the number of permissions that have to be managed in an access control system.

[1]  Hamid R. Rabiee,et al.  Reliability of separation of duty in ANSI standard role-based access control , 2011, Sci. Iran..

[2]  Ravi S. Sandhu,et al.  Role-Based Access Control Models , 1996, Computer.

[3]  David W. Chadwick,et al.  Multi-session Separation of Duties (MSoD) for RBAC , 2007, 2007 IEEE 23rd International Conference on Data Engineering Workshop.

[4]  Ramaswamy Chandramouli,et al.  The Queen's Guard: A Secure Enforcement of Fine-grained Access Control In Distributed Data Analytics Platforms , 2001, ACM Trans. Inf. Syst. Secur..

[5]  Vijayalakshmi Atluri,et al.  An Authorization Model for Workflows , 1996, ESORICS.

[6]  Ravi Sandhu,et al.  Transaction control expressions for separation of duties , 1988, [Proceedings 1988] Fourth Aerospace Computer Security Applications.

[7]  Vijay Karamcheti,et al.  dRBAC: distributed role-based access control for dynamic coalition environments , 2002, Proceedings 22nd International Conference on Distributed Computing Systems.

[8]  David F. Ferraiolo,et al.  Assessment of Access Control Systems , 2006 .

[9]  Elisa Bertino,et al.  GEO-RBAC: a spatially aware RBAC , 2005, SACMAT '05.

[10]  Jorge Lobo,et al.  Privacy-aware role-based access control , 2010 .

[11]  Vijayalakshmi Atluri,et al.  Role-based Access Control , 1992 .

[12]  Jason Crampton,et al.  Specifying and enforcing constraints in role-based access control , 2003, SACMAT '03.

[13]  Ninghui Li,et al.  On mutually-exclusive roles and separation of duty , 2004, CCS '04.

[14]  Mary Ellen Zurko,et al.  Separation of duty in role-based environments , 1997, Proceedings 10th Computer Security Foundations Workshop.

[15]  D. Richard Kuhn,et al.  Mutual exclusion of roles as a means of implementing separation of duty in role-based access control systems , 1997, RBAC '97.

[16]  Ravi S. Sandhu,et al.  Separation of Duties in Computerized Information Systems , 1990, DBSec.

[17]  Aaron Elliott,et al.  Role Explosion: Acknowledging the Problem , 2010, Software Engineering Research and Practice.

[18]  Gregory D. Abowd,et al.  Securing context-aware applications using environment roles , 2001, SACMAT '01.

[19]  Ravi S. Sandhu,et al.  Task-Based Authorization Controls (TBAC): A Family of Models for Active and Enterprise-Oriented Autorization Management , 1997, DBSec.

[20]  D. Richard Kuhn,et al.  Adding Attributes to Role-Based Access Control , 2010, Computer.

[21]  Ruixuan Li,et al.  Static Enforcement of Static Separation-of-Duty Policies in Usage Control Authorization Models , 2012, IEICE Trans. Commun..

[22]  Jorge Lobo,et al.  Privacy-Aware Role-Based Access Control , 2007, IEEE Security & Privacy.

[23]  Jan H. P. Eloff,et al.  Separation of duties for access control enforcement in workflow environments , 2001, IBM Syst. J..

[24]  Messaoud Benantar,et al.  Access Control Systems: Security, Identity Management and Trust Models , 2005 .

[25]  Elisa Bertino,et al.  A generalized temporal role-based access control model , 2005, IEEE Transactions on Knowledge and Data Engineering.

[26]  Elisa Bertino,et al.  A flexible model supporting the specification and enforcement of role-based authorization in workflow management systems , 1997, RBAC '97.

[27]  David D. Clark,et al.  A Comparison of Commercial and Military Computer Security Policies , 1987, 1987 IEEE Symposium on Security and Privacy.