关键词: 静态职责分离, 互斥角色约束, 授权管理, 访问控制

Abstract: Static Separation Of Duty (SSOD) is an important principle of information system security. In Role-Based Access Control (RBAC), it is difficult to enforce 2-n SSOD policy directly based on 2-2 Static Mutually Exclusive Role (SMER) constraints. In this paper, the necessary and sufficient conditions of realizing 2-n SSOD policy based on 2-2 SMER constraints were proposed and proved. The sufficient condition proposed was less restrictive than the existing research and allowed more flexible privilege assignment. By the operation rules of authorization management, the sufficient condition was kept and the satisfaction of 2-n SSOD policy during the dynamic change of application environment could be maintained. The application example shows that the method is correct and effective.

Key words: static separation of duty, mutual exclusive roles, authorization management, access control