CONFLICT CHECKING OF SEPARATION OF DUTY CONSTRAINTS IN RBAC - IMPLEMENTATION EXPERIENCES

摘要

Separation of duty constraints define mutual exclusion relations between two entities (e.g. two permissions). Thus, a software component that supports the definition of separation of duty constraints implicitly requires a means to control their definition and to ensure the consistency of the resulting runtime structures. In this paper, we present our experiences with the implementation of conflict-checking methods for separation of duty constraints in the xoRBAC access control service.