空间职责分离约束的实施

Enforcement of Spatial Separation of Duty

支持空间特性的RBAC模型描述了多种空间约束,这些空间约束不但表达了位置感知系统中细粒度空间语义,而且给模型增加了空间安全描述能力.能否准确实施空间约束直接影响应用系统功能和开销.本文研究空间职责分离(SSoD)约束的两种实施策略:(1)直接实施(2)间接实施.证明了直接实施是一个NP完全问题,而通过互斥空间角色(MESR)约束间接实施SSoD是有效的.多个MESR约束可以实施同一个SSoD,在比较后发现,当使用最小MESR约束作为实施机制时,能有效避免冗余约束准确实施该SSoD.为获得最小MESR约束本文给出了GEN-MESR算法.

RBAC model with spatial characteristics allows express various role-based constraints with spatial characteristics for not only specify fine-grained spatial semantics that are typical in location-aware systems but also strengthen the security capability. In this paper, we study enforcement of spatial Separation of Duty （ SSoD） constraints. We show that direcdy enforcing SSoD constraints is intractable （ coNP-complete）, while checking whether a system state satisfies a set of Mutually Exclusive Spatial Role （ MESR ） constraints is efficient. So MESR constraints are used to enforce SSoD constraints. There are often multiple MFSR constraints that can enforce the same SSoD. Although the different MESR constraints can enforce the same effect on the same session, we have found that different MESR constraints are varying greatly in the enforcement efficiency. The more precise the MESR sets are defined for enforcing an SSoD constraint, the less overhead the system is suffered. By comparing the different MESR constraints which can enforce the same SSoD, we conclude the minimal MESR constraints can avoid redundant restrictiveness effectively and enforce the SSoD policy precisely. We also present an algorithm that generates all minimal MESR constraints that are precise for enforcing one SSoD policy.