The RBAC96 access control model has been the basis for extensive work on role-based constraint specification and role-based delegation. However, these practical extensions can also lead to conflicts at compile and run-time. We demonstrate, following a rule-based, declarative approach, how conflicts between specified Separation of Duty constraints and delegation activities can be detected. This approach also demonstrates the general suitability of Prolog as an executable specification language for the simulation and analysis of role-based systems. Using an extended definition of a role we show how at least one of the conflicts can be resolved and discuss the impacts of this extension on the specified constraints.
展开▼
