Enforcement of Spatial Separation of Duty
RBAC model with spatial characteristics allows express various role-based constraints with spatial characteristics for not only specify fine-grained spatial semantics that are typical in location-aware systems but also strengthen the security capability.In this paper,we study enforcement of spatial Separation of Duty(SSoD) constraints.We show that directly enforcing SSoD constraints is intractable(coNP-complete),while checking whether a system state satisfies a set of Mutually Exclusive Spatial Role(MESR) constraints is efficient.So MESR constraints are used to enforce SSoD constraints.There are often multiple MESR constraints that can enforce the same SSoD.Although the different MESR constraints can enforce the same effect on the same session,we have found that different MESR constraints are varying greatly in the enforcement efficiency.The more precise the MESR sets are defined for enforcing an SSoD constraint,the less overhead the system is suffered.By comparing the different MESR constraints which can enforce the same SSoD,we conclude the minimal MESR constraints can avoid redundant restrictiveness effectively and enforce the SSoD policy precisely.We also present an algorithm that generates all minimal MESR constraints that are precise for enforcing one SSoD policy.