Enforcing Separation of Duty in Attribute Based Access Control Systems

  • Sadhana Jha
  • Shamik Sural
  • Vijayalakshmi Atluri
  • Jaideep Vaidya
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 9478)


Conventional access control models like discretionary access control and role based access control are suitable for regulating access to resources by known users of an organization. However, for systems where the user population is dynamic and the identities of all users are not known in advance, attribute based access control (ABAC) can be more conveniently used. The set of constraints supported by an access control model acts as a deciding factor for the type of restrictions it can put on unauthorized access. Among the various types of constraints, enforcement of Separation of Duty (SoD) is considered to be the most important in any commercial application. In this paper, we introduce the problem of SoD enforcement in the context of ABAC. We analyze the complexity of the problem and provide a methodology for solving it. Experiments on a wide range of data sets show encouraging results.


Attribute based access control Separation of duty Mutually exclusive policies Policy enforcement 


  1. 1.
    Cormen, T.H.: Introduction to Algorithms. MIT press, Cambridge (2009)MATHGoogle Scholar
  2. 2.
    Xu, Z., Stoller, S.D.: Mining attribute-based access control policies. In: IEEE Transactions on Dependable and Secure Computing (2015)Google Scholar
  3. 3.
    Medvet, E., Bartoli, A., Carminati, B., Ferrari, E.: Evolutionary Inference of Attribute-Based Access Control Policies. In: Gaspar-Cunha, A., Henggeler Antunes, C., Coello, C.C. (eds.) EMO 2015. LNCS, vol. 9018, pp. 351–365. Springer, Heidelberg (2015) Google Scholar
  4. 4.
    Hu, V.C., Ferraiolo, D., Kuhn, R., Schnitzer, A., Sandhu, R., Miller, R., Scarfone, K.: Guide to Attribute Based Access Control (ABAC) Definition and Considerations. NIST Special Publication (2014)Google Scholar
  5. 5.
    Nurmamat, H., Rahman, K.: Attribute based access control constraint based on subject similarity. In: Proceedings of the IEEE Workshop on Advanced Research and Technology in Industry Applications, pp. 226–229 (2014)Google Scholar
  6. 6.
    Lakkaraju, S., Dianxiang, X.: Integrated modeling and analysis of attribute based access control policies and workflows in healthcare. In: Proceedings of the International Conference on Trustworthy Systems and their Applications (TSA), pp. 36–43. IEEE (2014)Google Scholar
  7. 7.
    Zaman, B.K., Krishnan, R., Sandhu, R.: Towards an attribute based constraints specification language. In: Proceedings of the IEEE International Conference on Social Computing, pp. 108–113 (2013)Google Scholar
  8. 8.
    Xu, Z., Stoller, S.D.: Mining attribute-based access control policies from RBAC policies. In: Proceedings of the International Conference and Expo on Emerging Technologies for a Smarter World, pp. 1–6. IEEE (2013)Google Scholar
  9. 9.
    Jin, X., Krishnan, R., Sandhu, R.S.: A unified attribute-based access control model covering DAC, MAC and RBAC. In: Proceedings of the 26th Annual Conference on Data and Applications Security and Privacy, pp. 41–55 (2012)Google Scholar
  10. 10.
    Huang, J., Nicol, D.M., Bobba, R., Huh, J.H.: A framework integrating attribute-based policies into role-based access control. In: Proceedings of the 17th ACM Symposium on Access Control Models and Technologies, pp. 187–196. ACM (2012)Google Scholar
  11. 11.
    Li, N., Tripunitara, M.V., Bizri, Z.: On mutually exclusive roles and separation-of-duty. In: ACM Transactions on Information and System Security (TISSEC) (2007)Google Scholar
  12. 12.
    Chakraborty, S., Ray, I.: TrustBAC: integrating trust relationships into the RBAC model for access control in open systems. In: Proceedings of the Eleventh ACM Symposium on Access Control Models and Technologies, pp. 49–58. ACM (2006)Google Scholar
  13. 13.
    Yuan, E. Tong, J.: Attributed based access control (ABAC) for web services. In: Proceedings of the IEEE International Workshop on Web Services (2005)Google Scholar
  14. 14.
    Ernesto, D., Vimercati, S.D.C.D., Samarati, P.: New paradigms for access control in open environments. In: Proceedings of the Fifth IEEE International Symposium on Signal Processing and Information Technology, pp. 540–545 (2005)Google Scholar
  15. 15.
    Lingyu, W., Wijesekera, D., Jajodia, S.: A logic-based framework for attribute based access control. In: Proceedings of the ACM Workshop on Formal Methods in Security Engineering, pp. 45–55 (2004)Google Scholar
  16. 16.
    Sandhu, R.S., Coyne, E.J., Feinstein, H.L., Youman, C.E.: Role-based access control models. In: IEEE Computer, pp. 38–47 (1999)Google Scholar
  17. 17.
    Osborn, S.: Mandatory access control and role-based access control revisited. In: Proceedings of the 2nd ACM Workshop on Role-Based Access Control, pp. 31–40 (1997)Google Scholar
  18. 18.
    Harrison, M.A., Ruzzo, W.L., Ullman, J.D.: On protection in operating systems. In: Communications of the ACM, pp. 461–471 (1976)Google Scholar
  19. 19.
    Clark, D.D., Wilson, D.R.: A comparision of commercial and military computer security policies. In: Proceedings of the 1987 IEEE Symposium on Security and Privacy, pp. 184–194. IEEE Computer Society (1987)Google Scholar

Copyright information

© Springer International Publishing Switzerland 2015

Authors and Affiliations

  • Sadhana Jha
    • 1
  • Shamik Sural
    • 2
  • Vijayalakshmi Atluri
    • 3
  • Jaideep Vaidya
    • 3
  1. 1.Advanced Technology Development CentreIndian Institute of TechnologyKharagpurIndia
  2. 2.School of Information TechnologyIndian Institute of TechnologyKharagpurIndia
  3. 3.MSIS DepartmentRutgers UniversityNewarkUSA

Personalised recommendations