NDLI: Dynamic enforcement of abstract separation of duty constraints

Content Provider	ACM Digital Library
Author	Burri, Samuel J. Basin, David Karjoth, Günter
Copyright Year	2012
Abstract	Separation of Duties (SoD) aims at preventing fraud and errors by distributing tasks and associated authorizations among multiple users. Li and Wang [2008] proposed an algebra (SoDA) for specifying SoD requirements, which is both expressive in the requirements it formalizes and abstract in that it is not bound to a workflow model. In this article, we bridge the gap between the specification of SoD constraints modeled in SoDA and their enforcement in a dynamic, service-oriented enterprise environment. We proceed by generalizing SoDA's semantics to traces, modeling workflow executions that satisfy the respective SoDA terms. We then refine the set of traces induced by a SoDA term to also account for a workflow's control-flow and role-based authorizations. Our formalization, which is based on the process algebra CSP, supports the enforcement of SoD on general workflows and handles changing role assignments during workflow execution, addressing a well-known source of fraud. The resulting CSP model serves as blueprint for a distributed and loosely coupled architecture where SoD enforcement is provisioned as a service. This concept, which we call SoD as a Service, facilitates a separation of concerns between business experts and security professionals. As a result, integration and configuration efforts are minimized and enterprises can quickly adapt to organizational, regulatory, and technological changes. We describe an implementation of SoD as a Service, which combines commercial components such as a workflow engine with newly developed components such as an SoD enforcement monitor. To evaluate our design decisions and to demonstrate the feasibility of our approach, we present a case study of a drug dispensation workflow deployed in a hospital.
Starting Page	1
Ending Page	30
Page Count	30
File Format	PDF
ISSN	10949224
e-ISSN	15577406
DOI	10.1145/2382448.2382451
Volume Number	15
Issue Number	3
Journal	ACM Transactions on Information and System Security (TISSEC)
Language	English
Publisher	Association for Computing Machinery (ACM)
Publisher Date	2012-11-30
Publisher Place	New York
Access Restriction	One Nation One Subscription (ONOS)
Subject Keyword	Access control Authorization enforcement Security architecture Separation of duties Workflows
Content Type	Text
Resource Type	Article
Subject	Computer Science Safety, Risk, Reliability and Quality

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

The specification and enforcement of authorization constraints in workflow management systems

Role-based authorization constraints specification

On mutually exclusive roles and separation-of-duty

Toward a Usage-Based Security Framework for Collaborative Computing Systems

Access control with IBM Tivoli access manager

Consistency analysis of authorization hook placement in the Linux security modules framework

Proposed NIST standard for role-based access control

Practical safety in flexible access control models

Authorization recycling in hierarchical RBAC systems

Dynamic enforcement of abstract separation of duty constraints

Similar Documents

The specification and enforcement of authorization constraints in workflow management systems

Role-based authorization constraints specification

On mutually exclusive roles and separation-of-duty

Toward a Usage-Based Security Framework for Collaborative Computing Systems

Access control with IBM Tivoli access manager

Consistency analysis of authorization hook placement in the Linux security modules framework

Proposed NIST standard for role-based access control

Practical safety in flexible access control models

Authorization recycling in hierarchical RBAC systems

Dynamic enforcement of abstract separation of duty constraints