Separation Of Duty Constraints Research Articles

Enforcement of separation of duty constraints in attribute-based access control

While the verification of separation of duty (SoD) constraints on attribute based access control (ABAC) systems has been defined and examined in existing works, it still remains an open problem since the existing approaches are either inefficient or inadequate to check all SoD constraints; furthermore, the problem of solving SoD violations has not yet been addressed in the literature. In this paper, we present an integer linear programming (ILP) based approach to check the satisfiability of all SoD constraints. It can be applied to different SoDs. Hence, it is feasible in real-world scenarios. Moreover, we present an ILP based violation solution that can correct all SoD violations with a minimum number of restrictions regarding users’ normal operations on target objects. All SoD violations can be solved in a once-and-done way while simultaneously guaranteeing the satisfaction of all SoD constraints.

Policy-Engineering Optimization with Visual Representation and Separation-of-Duty Constraints in Attribute-Based Access Control

Recently, attribute-based access control (ABAC) has received increasingly more attention and has emerged as the desired access control mechanism for many organizations because of its flexibility and scalability for authorization management, as well as its security policies, such as separation-of-duty constraints and mutually exclusive constraints. Policy-engineering technology is an effective approach for the construction of ABAC systems. However, most conventional methods lack interpretability, and their constructing processes are complex. Furthermore, they do not consider the separation-of-duty constraints. To address these issues in ABAC, this paper proposes a novel method called policy engineering optimization with visual representation and separation of duty constraints (PEO_VR&SOD). First, to enhance interpretability while mining a minimal set of rules, we use the visual technique with Hamming distance to reduce the policy mining scale and present a policy mining algorithm. Second, to verify whether the separation of duty constraints can be satisfied in a constructed policy engineering system, we use the method of SAT-based model counting to reduce the constraints and construct mutually exclusive constraints to implicitly enforce the given separation of duty constraints. The experiments demonstrate the efficiency and effectiveness of the proposed method and show encouraging results.

Role-Mining Optimization with Separation-of-Duty Constraints and Security Detections for Authorizations

Role-based access control (RBAC), which has been regarded as one of the most popular access-control mechanisms, is featured by the separation-of-duty constraints, mutually exclusive constraints, and the least-privileges principle. Role mining, a bottom-up role-engineering technology, is an effective method to migrate from a non-RBAC system to an RBAC system. However, conventional role-mining approaches not only do not consider the separation of duty constraints, but also cannot ensure the security of a constructed RBAC system when the corresponding mined results violate the separation of a duty constraint and/or the least-privileges principle. To solve these problems, this paper proposes a novel method called role-mining optimization with separation-of-duty constraints and security detections for authorizations (RMO_SODSDA), which mainly includes two aspects. First, we present a role-mining-optimization approach for satisfying the separation of duty constraints, and we constructed different variants of mutually exclusive constraints to correctly implement the given separation of duty constraints based on unconstrained role mining. Second, to ensure the security of the constructed system and evaluate authorization performance, we reduced the authorization-query problem to a maximal-satisfiability problem. The experiments validate the effectiveness and efficiency of the proposed method.

Static compliance checking beyond separation of duty constraints

In many application domains, processes often have to comply with business level rules and policies, called compliance constraint. Separation of duty requirement is one of such constraint, and enhancement measures are taken to make sure the business process is compliance with the constraints. Separation of duty Algebra is a high level policy designed to specify Separation of duty constraints, which can describe both quantification requirements and qualification requirements. In this article, we improve the high level description SoDA by involving task information. The improved specification expresses relations between user and task, describes bind of duty constraint beyond separation of duty. In order to make the high level policy act on concrete process, we proceed by constructing mapping rules to translate high level policies to low level constraints, which is representing by Description Logic. Then, we propose a framework for business process compliance checking. At last we give a case study to show the suitably of the method.

Static compliance checking beyond separation of duty constraints

Static compliance checking beyond separation of duty constraints

A Novel Permission Hierarchy for RBAC for Dealing with SoD in MAC Models

Separation of duty (SoD) is a fundamental principle of computer security that has not been addressed sufficiently in multi-level security (MLS) mandatory access control (MAC) models, as realized through the adoption of the Bell-LaPadula (BLP) model. This is due to the lack of means at present to express SoD constraints in MAC. The primary objective of this paper is to overcome this but within a framework that allows for rigour and linguistic features to express SoD constraints, while retaining the core security properties of BLP, namely the Simple Security Property and |$\bigstar $|-Property. To this end, we propose a formal framework which bridges the BLP model with the more general hierarchical role-based access control (RBAC) model. Our framework is based on a hierarchy of permissions that is founded on a novel concept of permission capacity, determined on the basis of the security levels that characterize objects in MLS models. Such a hierarchy naturally provides a solid basis for defining role seniority and deriving a hierarchical ordering on roles within MLS models. SoD constraints are expressed by means of conflicting permissions that give rise to mutually exclusive roles.

Enforcing mobile security with location-aware role-based access control

This paper describes how location-aware role-based access control RBAC can be implemented on top of the Geospatial eXtensible Access Control Markup Language GeoXACML. It furthermore sketches how spatial separation of duty constraints both static and dynamic can be implemented using GeoXACML on top of the XACML RBAC profile. The solution uses physical addressing of geographical locations, which facilitates easy deployment of authorisation profiles to the mobile device. Location-aware RBAC can be used to implement location-dependent access control and also other security enhancing solutions on mobile devices, such as location-dependent device locking, firewall, intrusion prevention or payment anti-fraud systems. The system has been implemented and tested, both to verify the server capacity and also the client capacity running on a mobile device. Copyright © 2013 John Wiley & Sons, Ltd.

Constraint-Aware Role Mining Via Extended Boolean Matrix Decomposition

The role mining problem has received considerable attention recently. Among the many solutions proposed, the Boolean matrix decomposition (BMD) formulation has stood out, which essentially discovers roles by decomposing the binary matrix representing user-to-permission assignment (UPA) into two matrices-user-to-role assignment (UA) and permission-to-role assignment (PA). However, supporting certain embedded constraints, such as separation of duty (SoD) and exceptions, is critical to the role mining process. Otherwise, the mined roles may not capture the inherent constraints of the access control policies of the organization. None of the previously proposed role mining solutions, including BMD, take into account these underlying constraints while mining. In this paper, we extend the BMD so that it reflects such embedded constraints by proposing to allow negative permissions in roles or negative role assignments for users. Specifically, by allowing negative permissions in roles, we are often able to use less roles to reconstruct the same given user-permission assignments. Moreover, from the resultant roles we can discover underlying constraints such as separation of duty constraints. This feature is not supported by any existing role mining approaches. Hence, we call the role mining problem with negative authorizations the constraint-aware role mining problem (CRM). We also explore other interesting variants of the CRM, which may occur in real situations. To enable CRM and its variants, we propose a novel approach, extended Boolean matrix decomposition (EBMD), which addresses the ineffectiveness of BMD in its ability of capturing underlying constraints. We analyze the computational complexity for each of CRM variants and present heuristics for problems that are proven to be NP-hard.

Semantics-based Access Control Approach for Web Service

Due to the open and distributed characteristics of web service, its access control becomes a challenging problem which has not been addressed properly. In this paper, we show how semantic web technologies can be used to build a flexible access control system for web service. We follow the Role-based Access Control model and extend it with credential attributes. The access control model is represented by a semantic ontology, and specific semantic rules are constructed to implement such as dynamic roles assignment, separation of duty constraints and roles hierarchy reasoning, etc. These semantic rules can be verified and executed automatically by the reasoning engine, which can simplify the definition and enhance the interoperability of the access control policies. The basic access control architecture based on the semantic proposal for web service is presented. Finally, a prototype of the system is implemented to validate the proposal.

RAR: A role-and-risk based flexible framework for secure collaboration

Collaboration among virtual organizations enables domains to effectively share resources. However, it also opens ways for several security and privacy breaches; the problem becomes severe along with the increasing complexity and dynamics of grid environments. As such, in this paper, we propose a flexible secure collaboration framework: called RAR (Role-And-Risk). We introduce the architecture of RAR, and two major components of RAR. The first component is for generating inter-domain role mappings ( IDRM) as a basis for collaboration. We study the complexity of IDRM while taking the separation of duty constraints and administrative cost into account; it turns out to be intractable for most cases. RAR addresses IDRM related problems by reducing them to well-known problems (e.g., the satisfiability problem SAT), which have been studied for decades and various mature solvers exist in literature. On the other hand, to deal with the dynamics and uncertainty of distributed environments, we employ the notion of risk to monitor and manage the security threat induced by collaboration. RAR’s flexibility lies in the tunable interoperability and the use of risk for timely monitoring users’ accesses.

Classification and formulation of Role-based Separation of Duty Constraints

Separation of Duty (SOD) is a fundamental principle in security systems and has a long history in computer security research. It is also an important characteristic in the Role-Based Access Control (RBAC) system. Various categories of this principle have been pointed out for RBAC environment by different researchers, but they have neither been classified nor formulated. This paper beside classifying and formulating all the former introduced types of SOD in Rolebased environment; presents and defines formally new types of Role-based SOD.

Using colored Petri nets to model and analyze workflow with separation of duty constraints

Workflow provides a promising solution for organizations to achieve their business goals by interactions and collaborations between users. Separation of duty (SoD) is a security principle to prevent fraud and errors in collaborative workflow environments. It is crucial to verify and ensure the correctness and consistence of workflow with SoD constraints during the design time. In this paper, we propose a method to model and analyze workflow with SoD constraints based on colored Petri nets (CPN). The control flow, authorization rules and SoD constraints in a workflow are all represented by CPN and combined into one integrated CPN model. Then the execution paths of this model can be derived by reachability tree analysis. By analyzing these execution paths, some latent deadlocks caused by the inconsistency between authorization rules and SoD constraints can be detected.

GEO-RBAC

Securing access to data in location-based services and mobile applications requires the definition of spatially aware access-control systems. Even if some approaches have already been proposed either in the context of geographic database systems or context-aware applications, a comprehensive framework, general and flexible enough to deal with spatial aspects in real mobile applications, is still missing. In this paper, we make one step toward this direction and present GEO-RBAC, an extension of the RBAC model enhanced with spatial-and location-based information. In GEORBAC, spatial entities are used to model objects, user positions, and geographically bounded roles. Roles are activated based on the position of the user. Besides a physical position, obtained from a given mobile terminal or a cellular phone, users are also assigned a logical and device-independent position, representing the feature (the road, the town, the region) in which they are located. To enhance flexibility and reusability, we also introduce the concept of role schema, specifying the name of the role, as well as the type of the role spatial boundary and the granularity of the logical position. We then extend GEO-RBAC to support hierarchies, modeling permission, user, and activation inheritance, and separation of duty constraints. The proposed classes of constraints extend the conventional ones to deal with different granularities (schema/instance level) and spatial information. We conclude the paper with an analysis of several properties concerning the resulting model.

Role delegation on multiple-attractor cellular automata based on pseudo-exhaustive bit patterns

Role-based access control (RBAC) is arguably the most fundamental and most pervasive security mechanism in use today. RBAC shows up in virtually all systems and imposes great architectural and administrative challenges at all levels of enterprise computing. For efficient and simple management, we map RBAC onto multiple-attractor cellular automata (MACA). Separation of Duty (SoD) constraint and role delegations can be easily demonstrated in MACA based on pseudo-exhaustive (PE)-bit patterns. We also show how conflicts between specified SoD constraints and delegation activities can be resolved by PE-bit patterns. Thus we expect that our methodology can be effectively used for granting strategy in complex automatic system.

Role-based authorizations for workflow systems in support of task-based separation of duty

Role-based authorizations for assigning tasks of workflows to roles/users are crucial to security management in workflow management systems. The authorizations must enforce separation of duty (SoD) constraints to prevent fraud and errors. This work analyzes and defines several duty-conflict relationships among tasks, and designs authorization rules to enforce SoD constraints based on the analysis. A novel authorization model that incorporates authorization rules is then proposed to support the planning of assigning tasks to roles/users, and the run-time activation of tasks. Different from existing work, the proposed authorization model considers the AND/XOR split structures of workflows and execution dependency among tasks to enforce separation of duties in assigning tasks to roles/users. A prototype system is developed to realize the effectiveness of the proposed authorization model.

Role-based security, object oriented databases and separation of duty

In this paper we combined concepts of role-based protection and object oriented (O-O) databases to specify and enforce separation of duty as required for commercial database integrity [5, 23, 24]. Roles essentially partition database information into access contexts. Methods (from the O-O world) associated with a database object, also partition the object interface to provide windowed access to object information. By specifying that all database information is held in database objects and authorizing methods to roles, we achieve object interface distribution across roles. For processing in the commercial world we can design objects and distribute their associated methods to different roles. By authorizing different users to the different roles, we can enforce both the order of execution on the objects and separation of duty constraints on method execution.