Abstract:In large enterprise software systems, users often need to delegate their authority to others. Permission base delegation model (PBDM) based on RBAC96 currently is the most attractive model to fulfill the delegation requirement since it supports partly delegation and multiple steps delegation. However in PBDM there is no explicit specification of the separation of duty (SOD) constraint, which is one of the most important constraints and is essential to the security of the system. In this paper, we analyze the SOD constraint in PBDM delegation model and give the formal definition for the constraint. We prove that the constraint violation will not happen at the stage of the delegation role definition whereas it can only happen at the stage of role assignment. We then propose a protective mechanism to prevent the illegal role delegation utilizing the prerequisite conditions which are a set of Boolean expressions. We also give the algorithm to check the prerequisite conditions to help the security administrator guarantee the safe role delegation.

Using Semantic Web Technologies to Specify Constraints of RBAC

Ontology-Based RBAC specification for interoperation in distributed environment

A Semantic and Trust Based Framework for Rbac User-Role Assignment

A Task-Role Based Access Control Model with Multi-Constraints

The research for spatial role-based access control model

Semantic-Aware Access Control for Grid Application

An ontology-based functional modeling approach for multi-agent distributed design on the semantic web

A Security Violation Detection Method For Rbac Based Interoperation

Design and Implementation of Context-Aware RBAC Model Based on Reasoning

An OWL-Based approach for RBAC with negative authorization

A Semantic Mapping System for Bridging the Gap between Relational Database and Semantic Web

Realization Distributed Access Control Based on Ontology and Attribute with OWL

Separation of Duty Constraint for Permission Based Delegation Model

RBAC based access control model for services compositions cross multiple enterprises

XACML-based Access Control and RBAC Constraints

Role Engineering with SKAOS for Systems Employing RBAC

An Administration Model of DRBAC on the Web

Security Violation Detection for RBAC Based Interoperation in Distributed Environment

Constraint access control for direct authorization

Realization Method about Access Control of System Based on Web

The research of semantic similarity algorithm consideration of multi-factor ontology-based in access control