基于活动的职责分离模型
An Activity-Based Model for Separation of Duty
摘要：
本文提供了几个贡献的职责分离（SoD）管理基于角色的访问控制（RBAC）系统。我们首先介绍了一个新的正式框架，基于业务的角度来看，SoD的约束进行了分析，引入活动的概念。这个概念有助于组织根据业务需求定义SoD约束，并降低大规模RBAC系统中的管理复杂性。该模型允许定义冲突类型的广泛分类。特别是，基于对象的SoD引入使用SoD域的概念，即一组数据，其中可能发生事务冲突。连同上述属性的形式化，在本文中，我们还显示了我们的建议的有效性：我们已经将该模型应用到一个大型的，现有的组织，结果突出了采用所提出的模型在降低管理成本方面的好处。
英文摘要：
This paper offers several contributions for separation of duty (SoD) administration in role-based access control (RBAC) systems. We first introduce a new formal framework, based on business perspective, where SoD constraints are analyzed introducing the activity concept. This notion helps organizations define SoD constraints in terms of business requirements and reduces management complexity in large-scale RBAC systems. The model enables the definition of a wide taxonomy of conflict types. In particular, object-based SoD is introduced using the SoD domain concept, namely the set of data in which transaction conflicts may occur. Together with the formalization of the above properties, in this paper we also show the effectiveness of our proposal: we have applied the model to a large, existing organization; results highlight the benefits of adopting the proposed model in terms of reduced administration cost.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
