Sciweavers

ESORICS
2009
Springer

Dynamic Enforcement of Abstract Separation of Duty Constraints

14 years 4 months ago
Dynamic Enforcement of Abstract Separation of Duty Constraints
Separation of Duty Constraints David Basin1 , Samuel J. Burri1,2 , and G?unter Karjoth2 1 ETH Zurich, Department of Computer Science, Switzerland 2 IBM Research, Zurich Research Laboratory, Switzerland Separation of Duties (SoD) aims to prevent fraud and errors by distributing tasks and associated privileges among multiple users. Li and Wang proposed an algebra (SoDA) for specifying SoD requirements, both expressive in the requirements it formalizes and abstract in that it is not bound to any specific workflow model. In this paper, we both generalize SoDA and map it to enforcement mechanisms. First, we increase SoDA's expressiveness by extending its semantics to multisets. This better suits policy enforcement over workflows, where users may execute multiple tasks. Second, we further generalize SoDA to allow for changing role assignments. This lifts the strong restriction that authorizations do not change during workflow execution. Finally, we map SoDA terms to CSP processes, takin...
David A. Basin, Günter Karjoth, Samuel J. Bur
Added 23 Nov 2009
Updated 23 Nov 2009
Type Conference
Year 2009
Where ESORICS
Authors David A. Basin, Günter Karjoth, Samuel J. Burri
Comments (0)