Dynamic Enforcement of Abstract Separation of Duty Constraints

Separation of Duty Constraints David Basin1 , Samuel J. Burri1,2 , and G?unter Karjoth2 1 ETH Zurich, Department of Computer Science, Switzerland 2 IBM Research, Zurich Research Laboratory, Switzerland Separation of Duties (SoD) aims to prevent fraud and errors by distributing tasks and associated privileges among multiple users. Li and Wang proposed an algebra (SoDA) for specifying SoD requirements, both expressive in the requirements it formalizes and abstract in that it is not bound to any specific workflow model. In this paper, we both generalize SoDA and map it to enforcement mechanisms. First, we increase SoDA's expressiveness by extending its semantics to multisets. This better suits policy enforcement over workflows, where users may execute multiple tasks. Second, we further generalize SoDA to allow for changing role assignments. This lifts the strong restriction that authorizations do not change during workflow execution. Finally, we map SoDA terms to CSP processes, takin...

• Type: Conference
• Year: 2009
• Where: ESORICS
• Authors: David A. Basin, Günter Karjoth, Samuel J. Burri
• Keywords: ESORICS 2009, Security Privacy, SoD Requirements, SoDA Terms, Suits Policy Enforcement