American National Standard

ANSI INCITS 359-2004

ANSI INCITS 359-2004

for Information Technology –Role Based Access Control

Developed by

ANSI ®
INCITS 359-2004

American National Standard
for Information Technology –Role Based Access Control

Secretariat

Information Technology Industry Council

Approved February 3, 2004

American National Standards Institute, Inc.

American
National
Standard

Approval of an American National Standard requires review by ANSI that therequirements for due process, consensus, and other criteria for approval havebeen met by the standards developer.
Consensus is established when, in the judgement of the ANSI Board ofStandards Review, substantial agreement has been reached by directly andmaterially affected interests. Substantial agreement means much more thana simple majority, but not necessarily unanimity. Consensus requires that all
views and objections be considered, and that a concerted effort be madetowards their resolution.
The use of American National Standards is completely voluntary; their
existence does not in any respect preclude anyone, whether he has approved
the standards or not, from manufacturing, marketing, purchasing, or using
products, processes, or procedures not conforming to the standards.
The American National Standards Institute does not develop standards andwill in no circumstances give an interpretation of any American National
Standard. Moreover, no person shall have the right or authority to issue aninterpretation of an American National Standard in the name of the American
National Standards Institute. Requests for interpretations should be
addressed to the secretariat or sponsor whose name appears on the title
page of this standard.
CAUTION NOTICE: This American National Standard may be revised orwithdrawn at any time. The procedures of the American National Standards
Institute require that action be taken periodically to reaffirm, revise, orwithdraw this standard. Purchasers of American National Standards may
receive current information on all standards by calling or writing the American
National Standards Institute.

CAUTION: The developers of this standard have requested that holders of patents that may berequired for the implementation of the standard disclose such patents to the publisher. However,neither the developers nor the publisher have undertaken a patent search in order to identify
which, if any, patents may apply to this standard. As of the date of publication of this standard
and following calls for the identification of patents that may be required for the implementation of
the standard, no such claims have been made. No further patent search is conducted by the developer or publisher in respect to any standard it processes. No representation is made or impliedthat licenses are not required to avoid infringement in the use of this standard.

Published byAmerican National Standards Institute, Inc.
25 West 43rd Street, New York, NY 10036
Copyright © 2004 by Information Technology Industry Council (ITI)
All rights reserved.
No part of this publication may be reproduced in any
form, in an electronic retrieval system or otherwise,
without prior written permission of ITI, 1250 Eye Street NW,
Washington, DC 20005.

Printed in the United States of America

Contents
Page

Foreword ............................................................................................................. iii
Introduction ............................................................................................................v
1

Scope................................................................................................... 1

2

Conformance ....................................................................................... 1

3

Normative References ......................................................................... 2

4

Terms and Definitions .......................................................................... 2

5

RBAC Reference Model....................................................................... 2

5.1
5.2
5.3
5.3.1
5.3.2

Core RBAC .......................................................................................... 3
Hierarchical RBAC ............................................................................... 5
Constrained RBAC............................................................................... 7
Static Separation of Duty Relations ..................................................... 8
Dynamic Separation of Duty Relations ................................................ 9

6

RBAC System and Administrative Functional Specification .............. 11

6.1

Core RBAC ........................................................................................ 11

6.1.1
6.1.2
6.1.3
6.1.4
6.2
6.2.1
6.2.1.1
6.2.1.2
6.2.1.3
6.2.1.4
6.2.2
6.2.2.1
6.2.2.2
6.2.2.3
6.2.2.4
6.3
6.3.1
6.3.1.1
6.3.1.2
6.3.1.3
6.3.1.4
6.3.2
6.3.2.1
6.3.2.2

Administrative Commands for Core RBAC ........................................ 11
Supporting System Functions for Core RBAC ................................... 14
Review Functions for Core RBAC...................................................... 15
Advanced Review Functions for Core RBAC..................................... 16
Hierarchical RBAC ............................................................................. 17
General Role Hierarchies................................................................... 17
Administrative Commands for General Role Hierarchies .................. 17
Supporting System Functions for General Role Hierarchies ............. 19
Review Functions for General Role Hierarchies ................................ 19
Advanced Review Functions for General Role Hierarchies ............... 20
Limited Role Hierarchies.................................................................... 21
Administrative Commands for Limited Role Hierarchies.................... 21
Supporting System Functions for Limited Role Hierarchies............... 22
Review Functions for Limited Role Hierarchies ................................. 22
Advanced Review Functions for Limited Role Hierarchies ................ 22
Static Separation of Duty (SSD) Relations ........................................ 22
Core RBAC ........................................................................................ 22
Administrative commands for SSD Relations .................................... 22
Supporting System Functions for SSD .............................................. 24
Review Functions for SSD ................................................................. 24
Advanced Review Functions for SSD ................................................ 25
SSD with General Role Hierarchies................................................... 25
Administrative Commands for SSD with General Role Hierarchies... 25
Supporting System Functions for SSD with
General Role Hierarchies................................................................... 27
Review Functions for SSD with General Role Hierarchies ................ 28
Advanced Review Functions for SSD with
General Role Hierarchies................................................................... 28
SSD Relations with Limited Role Hierarchies .................................... 28
Administrative Commands for SSD with Limited Role Hierarchies.... 28
Supporting System Functions for SSD with
Limited Role Hierarchies.................................................................... 28
Review Functions for SSD with Limited Role Hierarchies ................. 29

6.3.2.3
6.3.2.4
6.3.3
6.3.3.1
6.3.3.2
6.3.3.3iPage

6.3.3.4
6.4
6.4.1
6.4.1.1
6.4.1.2
6.4.1.3
6.4.1.4
6.4.2
6.4.2.1
6.4.2.2
6.4.2.3
6.4.2.4
6.4.3
6.4.3.1
6.4.3.2
6.4.3.3
6.4.3.4

Advanced Review Functions for SSD with
Limited Role Hierarchies.................................................................... 29
Dynamic Separation of Duties (DSD) Relations ................................ 29
Core RBAC ........................................................................................ 29
Administrative Commands for DSD Relations ................................... 29
Supporting System Functions for DSD Relations .............................. 31
Review Functions for DSD Relations................................................. 32
Advanced Review Functions for DSD Relations................................ 33
DSD Relations with General Role Hierarchies .................................. 33
Administrative commands for DSD Relations with
General Role Hierarchies .................................................................. 33
Supporting System Functions for DSD Relations with
General Role Hierarchies .................................................................. 33
Review Functions for DSD Relations with
General Role Hierarchies .................................................................. 34
Advanced Review Functions for DSD Relations with
General Role Hierarchies .................................................................. 34
DSD Relations with Limited Role Hierarchies.................................... 34
Administrative Commands for DSD Relations with
Limited Role Hierarchies.................................................................... 34
Supporting System Functions for DSD Relations with
Limited Role Hierarchies.................................................................... 34
Review Functions for DSD Relations with Limited Role Hierarchies . 35
Advanced Review Functions for DSD Relations with
Limited Role Hierarchies.................................................................... 35

Figures1

Core RBAC .......................................................................................... 4

2

Hierarchical RBAC............................................................................... 6

3

SSD within Hierarchical RBAC ............................................................ 9

4

Dynamic Separation of Duty Relations .............................................. 10

AnnexesA

Functional Specification Overview ..................................................... 36

B

Rationale............................................................................................ 44ii

Foreword(This foreword is not part of American National Standard ANSI INCITS 359-2004.)

A process to develop this standard was initiated by the National Institute of Standards and Technology (NIST) in recognition of a need among government and industry purchasers of information technology products for a consistent and uniform
definition of role based access control (RBAC) features. In recent years, vendors
have begun implementing role based access control features in their database management systems, security management and network operating system products,
without general agreement on the definition of RBAC features. This lack of a widely
accepted model results in uncertainty and confusion about RBAC’s utility and meaning. This standard seeks to resolve this situation by using a reference model to define
RBAC features and then describing the functional specifications for those features.
This standard incorporates contributions from several rounds of open public review.
An initial draft of a consensus standard for RBAC was proposed at the 2000 ACM
Workshop on Role Based Access Control.1) Published comments on this earlier document2) and panel session discussions at the 2000 ACM Workshop assisted in developing the reference model and functional specification in a second version
released publicly in 2001.3) The second version was submitted to the InterNational
Committee for Information Technology Standards (INCITS) for fast track processing
on October 15, 2001. The public review of INCITS BSR 359 (November 16, 2001 to
December 31, 2001) resulted in comments from INCITS Technical Committee T4. In
response to these comments, editorial and some substantive changes have been incorporated into this version.
This standard contains two annexes. Annex A is normative and is considered part ofthe standard. Annex B is informative and is not considered part of the standard.
Requests for interpretation, suggestions for improvement or addenda, or defect reports are welcome. They should be sent to InterNational Committee for Information
Technology Standards (INCITS), ITI, 1250 Eye Street, NW, Suite 200, Washington,
DC 20005.
This standard was processed and approved for submittal to ANSI by INCITS. Committee approval of this standard does not necessarily imply that all committee members voted for its approval. At the time it approved this standard, INCITS had thefollowing members:

1) R. Sandhu, D. Ferraiolo, R. Kuhn. The NIST model for role-based access

control: Towards a unified standard. In Proceedings of 5th ACM Workshop on
Role-Based Access Control, pp. 47-63 (Berlin, Germany, July 2000). ACM.
2)

T. Jaeger and J. Tidswell. Rebuttal to the NIST RBAC model proposal. In
Proceedings of 5th ACM Workshop on Role-Based Access Control, pp. 65-66(Berlin, Germany, July 2000). ACM.

3)

D. Ferraiolo, R. Sandhu, S. Gavrila, D.R. Kuhn, R. Chandramouli, "A Proposed Standard for Role Based Access Control," ACM Transactions on Information and System Security, vol. 4, no. 3 (August 2001).
iii

Karen Higginbottom, Chair
Jennifer Garner, Secretary
Organization Represented
Name of Representative
Apple Computer, Inc. .................................................................. David Michael
Wanda Cox (Alt.)
Farance, Inc................................................................................ Frank Farance
Hewlett-Packard Company ......................................................... Karen Higginbottom
Scott Jameson (Alt.)
Steve Mills (Alt.)
EIA .............................................................................................. Edward Mikoski, Jr.
Suan Hoyler (Alt.)
IBM Corporation.......................................................................... Ronald F. Silletti
Institute for Certification of Computer Professionals................... Kenneth M. Zemrowski
Thomas Kurihara (Alt.)
IEEE............................................................................................ Judith Gorman
Richard Holleman (Alt.)
Robert Pritchard (Alt.)Intel Corporation ......................................................................... Gregory Kisor
Dave Thewlis (Alt.)
Microsoft Corporation ................................................................. Mike Ksar
Frank Camara (Alt.)
National Institute of Standards & Technology............................. Michael Hogan
William LaPlant, Jr. (Alt.)
Network Appliance...................................................................... James Davis
Office of the Secretary Defense/Science & Technology............. Robert Gaskill
Bruce Peoples (Alt.)
Oracle Corporation ..................................................................... Donald R. Deutsch
Jim Melton (Alt.)
Connie Myers (Alt.)
Panasonic Technologies, Inc...................................................... Terence Nelson
Rudolf Vitti (Alt.)
Purdue University ....................................................................... Stephen Elliott
Sony Electronics, Inc .................................................................. Ed Barrett
Jean Baronas (Alt.)
Sun Microsystems, Inc................................................................ Carman MondelloJohn Hill (Alt.)
Douglas Johnson (Alt.)
Carl Cargill (Alt.)
UCC............................................................................................ Stephen Brown
Frank Sharkey (Alt.)iv

Introduction
This standard describes RBAC features that have achieved acceptance in thecommercial marketplace. It includes a reference model and functional specifications for the RBAC features defined in the reference model. It is intended for (1)software engineers and product development managers who design products incorporating access control features; and (2) managers and procurement officials
who seek to acquire computer security products with features that provide access control capabilities in accordance with commonly known and understoodterminology and functional specifications.

v

AMERICAN NATIONAL STANDARD

ANSI INCITS 359-2004

American National Standard
for Information Technology –Role Based Access Control
1

SCOPE

This standard consists of two main parts – the RBAC Reference Model and the RBAC
System and Administrative Functional Specification.
The RBAC Reference Model defines sets of basic RBAC elements (i.e., users, roles,
permissions, operations and objects) and relations as types and functions that are includedin this standard. The RBAC reference model serves two purposes. First, the reference
model defines the scope of RBAC features that are included in the standard. This
identifies the minimum set of features included in all RBAC systems, aspects of role
hierarchies, aspects of static constraint relations, and aspects of dynamic constraint
relations. Second, the reference model provides a precise and consistent language, interms of element sets and functions for use in defining the functional specification.
The RBAC System and Administrative Functional Specification specifies the featuresthat are required of an RBAC system. These features fall into three categories,
administrative operations, administrative reviews, and system level functionality. The
administrative operations define functions in terms of an administrative interface and an
associated set of semantics that provide the capability to create, delete and maintain
RBAC elements and relations (e.g., to create and delete user role assignments). The
administrative review features define functions in terms of an administrative interface
and an associated set of semantics that provide the capability to perform query operations
on RBAC elements and relations. System level functionality defines features for thecreation of user sessions to include role activation/deactivation, the enforcement ofconstraints on role activation, and for calculation of an access decision. Informative
Annex B provides a rationale for the major RBAC components defined in this document.
2

CONFORMANCE

Not all RBAC features are appropriate for all applications. As such, this standard
provides a method of packaging features through the selection of functional components
and feature options within a component, beginning with a core set of RBAC features thatmust be included in all packages. Other components that may be selected in arriving at arelevant package of features pertain to role hierarchies, static constraints (Static
Separation of Duty), and dynamic constraints (Dynamic Separation of Duty).
To conform to this standard, an RBAC system shall comply with all of the core set of
RBAC functional specifications in 6.1. Conformance of an RBAC system to any otherfunctional specifications for a particular component and feature option, found in 6.2

1

ANSI INCITS 359-2004

through 6.4, is optional and dependent upon the functional requirements of a particularapplication.
3

NORMATIVE REFERENCES. This document makes use of the Z formal description language as defined in•
4

ISO/IEC 13568:2002. Information technology - Z formal specification notation.

TERMS AND DEFINITIONS

The following terms have specialized meanings within this standard.
component: As used in this standard, component refers to one of the major blocks of RBAC features, core
RBAC, hierarchical RBAC, SSD relations, and DSD relations.
objects: As used in this standard, an object can be any system resource subject to access control, such as afile, printer, terminal, database record, etc.
operations: An operation is an executable image of a program, which upon invocation executes somefunction for the user.
permissions: Permission is an approval to perform an operation on one or more RBAC protected objects.
Role: A role is a job function within the context of an organization with some associated semantics
regarding the authority and responsibility conferred on the user assigned to the role.
User: A user is defined as a human being. Although the concept of a user can be extended to include
machines, networks, or intelligent autonomous agents, the definition is limited to a person in this document
for simplicity reasons.

5

RBAC REFERENCE MODEL

The RBAC reference model is defined in terms of four model components—Core RBAC,
Hierarchical RBAC, Static Separation of Duty Relations, and Dynamic Separation of
Duty Relations. Core RBAC defines a minimum collection of RBAC elements, element
sets, and relations in order to completely achieve a Role-Based Access Control system.
This includes user-role assignment and permission-role assignment relations, considered
fundamental in any RBAC system. In addition, Core RBAC introduces the concept ofrole activation as part of a user’s session within a computer system. Core RBAC isrequired in any RBAC system, but the other components are independent of each otherand may be implemented separately.
The Hierarchical RBAC component adds relations for supporting role hierarchies. A
hierarchy is mathematically a partial order defining a seniority relation between roles,
whereby senor roles acquire the permissions of their juniors and junior roles acquire usersof their seniors. In addition, Hierarchical RBAC goes beyond simple user and permissionrole assignment by introducing the concept of a role’s set of authorized users andauthorized permissions. A third model component, Static Separation of Duty Relations,

2

ANSI INCITS 359-2004

adds exclusivity relations among roles with respect to user assignments. Because of thepotential for inconsistencies with respect to static separation of duty relations andinheritance relations of a role hierarchy, the SSD relations model component defines
relations in both the presence and absence of role hierarchies. The fourth modelcomponent, Dynamic Separation of Duty Relations, defines exclusivity relations withrespect to roles that are activated as part of a user’s session.
Each model component is defined by the following sub-components:•••

a set of basic element setsa set of RBAC relations involving those element sets (containing subsets ofCartesian products denoting valid assignments)
a set of Mapping Functions, which yield instances of members from one element,
set for a given instance from another element set.

It is important to note that the RBAC reference model defines a taxonomy of RBAC
features that can be composed into a number of feature packages. Rather then attempting
to define a complete set of RBAC features, this model focuses on providing a standard setof terms for defining the most salient features as represented in existing models andimplemented in commercial products.
5.1

Core RBAC

Core RBAC model element sets and relations are defined in Figure 1. Core RBAC
includes sets of five basic data elements called users (USERS), roles (ROLES), objects(OBS), operations (OPS), and permissions (PRMS). The RBAC model as a whole isfundamentally defined in terms of individual users being assigned to roles andpermissions being assigned to roles. As such, a role is a means for naming many-to-many
relationships among individual users and permissions. In addition, the core RBAC model
includes a set of sessions (SESSIONS) where each session is a mapping between a user
and an activated subset of roles that are assigned to the user.
A user is defined as a human being. Although the concept of a user can be extended toinclude machines, networks, or intelligent autonomous agents, the definition is limited toa person in this document for simplicity reasons. A role is a job function within thecontext of an organization with some associated semantics regarding the authority andresponsibility conferred on the user assigned to the role. Permission is an approval toperform an operation on one or more RBAC protected objects. An operation is an
executable image of a program, which upon invocation executes some function for theuser. The types of operations and objects that RBAC controls are dependent on the typeof system in which it will be implemented. For example, within a file system, operations
might include read, write, and execute; within a database management system, operations
might include insert, delete, append and update.
The purpose of any access control mechanism is to protect system resources (i.e.,
protected objects). Consistent with earlier models of access control an object is an entitythat contains or receives information. For a system that implements RBAC, the objects

3

ANSI INCITS 359-2004

can represent information containers (e.g., files, directories, in an operating system,
and/or columns, rows, tables, and views within a database management system) or
objects can represent exhaustible system resources, such as printers, disk space, and CPU
cycles. The set of objects covered by RBAC includes all of the objects listed in thepermissions that are assigned to roles.
Central to RBAC is the concept of role relations, around which a role is a semantic
construct for formulating policy. Figure 1 illustrates user assignment (UA) andpermission assignment (PA) relations. The arrows indicate a many-to-many relationship(e.g., a user can be assigned to one or more roles, and a role can be assigned to one ormore users). This arrangement provides great flexibility and granularity of assignment ofpermissions to roles and users to roles. Without these conveniences there is an enhanced
danger that a user may be granted more access to resources than is needed because oflimited control over the type of access that can be associated with users and resources.
Users may need to list directories and modify existing files, for example, without creating
new files, or they may need to append records to a file without modifying existing
records. Any increase in the flexibility of controlling access to resources also strengthens
the application of the principle of least privilege.

Figure 1: Core RBAC

Each session is a mapping of one user to possibly many roles, i.e., a user establishes asession during which the user activates some subset of roles that he or she is assigned.
Each session is associated with a single user and each user is associated with one or moresessions. The function session_roles gives us the roles activated by the session and thefunction session_users gives us the user that is associated with a session. The permissions
available to the user are the permissions assigned to the roles that are currently active
across all the user’s sessions.
Core RBAC specification:

4•

USERS, ROLES, OPS, and OBS (users, roles, operations and objects respectively).

•UA ⊆ USERS × ROLES, a many-to-many mapping user-to-role assignment
relation.

ANSI INCITS 359-2004•

assigned_users: (r:ROLES) → 2USERS, the mapping of role r onto a set of users.

•

Formally: assigned_users(r) = {u∈USERS _ (u, r) ∈ UA}
PRMS = 2(OPS × OBS), the set of permissions.

•PA ⊆ PERMS × ROLES, a many-to-many mapping permission-to-role assignment
relation.

•assigned_permissions(r: ROLES) → 2PRMS, the mapping of role r onto a set of
permissions. Formally:
assigned_permissions(r) = {p∈PRMS _ (p, r) ∈ PA}•

Op(p: PRMS) → {op⊆OPS}, the permission to operation mapping, which gives
the set of operations associated with permission p.

•

Ob(p: PRMS) → {ob⊆OBS}, the permission to object mapping, which gives theset of objects associated with permission p.

•

SESSIONS = the set of sessions•

session_users (s: SESSIONS) → USERS, the mapping of session s onto thecorresponding user.

•

session_roles (s: SESSIONS) → 2ROLES, the mapping of session s onto a set ofroles.
Formally: session_roles (si) ⊆ {r∈ROLES _ (session_users (si), r) ∈ UA}
avail_session_perms(s:SESSIONS) → 2PRMS, the permissions available to a user
in a session = assigned _ permissions(r )•r∈session _ roles ( s )5.2

Hierarchal RBAC

This model component introduces role hierarchies (RH) as indicated in Figure 2. Rolehierarchies are commonly included as a key aspect of RBAC models and are often
included as part of RBAC product offerings. Hierarchies are a natural means ofstructuring roles to reflect an organization’s lines of authority and responsibility.
Role hierarchies define an inheritance relation among roles. Inheritance has been
described in terms of permissions; i.e., r1 “inherits” role r2 if all privileges of r2 are alsoprivileges of r1. For some distributed RBAC implementations, role permissions are not
managed centrally, while the role hierarchies are. For these systems, role hierarchies aremanaged in terms of user containment relations: role r1 “contains” role r2 if all users
authorized for r1 are also authorized for r2. Note, however, that user containment implies
that a user of r1 has (at least) all the privileges of r2, while the permission inheritance forr1 and r2 does not imply anything about user assignment.

5

ANSI INCITS 359-2004

Figure 2: Hierarchical RBAC

This standard recognizes two types of role hierarchies—general role hierarchies andlimited role hierarchies. General role hierarchies provide support for an arbitrary partial
order to serve as the role hierarchy, to include the concept of multiple inheritances of
permissions and user membership among roles. Limited role hierarchies impose
restrictions resulting in a simpler tree structure (i.e., a role may have one or more
immediate ascendants, but is restricted to a single immediate descendent).
General Role Hierarchies:•

RH ⊆ ROLES × ROLES is a partial order on ROLES called the inheritance
relation, written as , where r1 r2 only if all permissions of r2 are also
permissions of r1, and all users of r1 are also users of r2, i.e., r1 r2 ⇒authorized_permissions(r2)⊆ authorized_permissions(r1).

•authorized_users(r: ROLES) → 2USERS, the mapping of role r onto a set of users in
the presence of a role hierarchy. Formally:
authorized_users(r) = {u∈USERS _ r ’ r , (u, r’) ∈ UA}•

authorized_permissions(r: ROLES) → 2PRMS, the mapping of role r onto a set of
permissions in the presence of a role hierarchy. Formally:
authorized_permissions(r) = {p∈PRMS _ r’ r, (p, r’) ∈ PA}

General role hierarchies support the concept of multiple inheritance, which provides theability to inherit permission from two or more role sources and to inherit user
membership from two or more role sources. Multiple inheritances provide two importanthierarchy properties. The first is ability to compose a role from multiple subordinate roles

6

ANSI INCITS 359-2004(with fewer permissions) in defining roles and relations that are characteristic of theorganization and business structures, which these roles are intended to represent. Second,
multiple inheritances provides uniform treatment of user/role assignment relations androle/role inheritance relations. Users can be included in the role hierarchy, using the same
relation to denote the user assignment to roles, as well as well as permission
inheritance from a role to its assigned users.
Roles in a limited role hierarchy are restricted to a single immediate descendent.
Although limited role hierarchies do not support multiple inheritances, they nonethelessprovide clear administrative advantages over Core RBAC.

r2 , if r1 r2 , but no role
Node r1 is represented as an immediate descendent of r2 by r1
in the role hierarchy lies between r1 and r2. That is, there exists no role r3 in the role
hierarchy such that r1 r3 r2 , where r1r2 and r2r3.
Limited role hierarchies are defined as a restriction on the immediate descendents of thegeneral role hierarchy.
Limited Role Hierarchies:•

General Role Hierarchies with the following limitation:∀ r, r1, r2∈ROLES, r r1 ∧ r r2 ⇒ r1 = r2

A general role hierarchy can be represented as a Hasse Diagram. Nodes in the graphrepresent the roles of the hierarchy and there is a directed line segment (arrow) drawn
from r1 to r2 whenever r1 is an immediate descendent of r2. By definition, r1→r2 if
r1
r2 . In the graph thus created, rx ry if and only if there is a directed path (sequenceof arrows) from rx to ry. In addition, there are no (directed) cycles in the graph of RH
since the order relation is anti-symmetric and transitive. Usually, the graph is represented
with the arcs corresponding to the inheritance relation o oriented top-down. Thus, user
membership is inherited top-down, and the role permissions are inherited bottom-up.
5.3

Constrained RBAC

Constrained RBAC adds Separation of Duty relations to the RBAC model. Separation of
duty relations are used to enforce conflict of interest policies that organizations may
employ to prevent users from exceeding a reasonable level of authority for theirpositions.
As a security principle, separation of duty has long been recognized for its wide
application in business, industry, and government. Its purpose is to ensure that failures ofomission or commission within an organization are caused only as a result of collusion
among individuals. To minimize the likelihood of collusion, individuals of different skills
or divergent interests are assigned to separate tasks required in the performance of abusiness function. The motivation is to ensure that fraud and major errors cannot occur

7

ANSI INCITS 359-2004

without deliberate collusion of multiple users. This RBAC standard allows for both staticand dynamic separation of duty as defined within the next two subsections.
5.3.1

Static Separation of Duty Relations

Conflict of interest in a role-based system may arise as a result of a user gaining
authorization for permissions associated with conflicting roles. One means of preventing
this form of conflict of interest is through static separation of duty, that is, to enforce
constraints on the assignment of users to roles. Static constraints can take on a wide
variety of forms. A common example is that of Static Separation of Duty (SSD) thatdefines mutually disjoint user assignments with respect to sets of roles. Static constraints
have also been shown to be a powerful means of implementing a number of otherimportant Separation of Duty policies.
The static constraints defined in this model are limited to those relations that that place
restrictions on sets of roles and in particular on their ability to form UA relations. Thismeans that if a user is assigned to one role, the user is prohibited from being a member ofa second role. An SSD policy can be centrally specified and then uniformly imposed on
specific roles. From a policy perspective, static constraint relations provides a powerfulmeans of enforcing conflict of interest and other separation rules over sets of RBAC
elements. Static constraints generally place restrictions on administrative operations thathave the potential to undermine higher-level organizational Separation of Duty policies.
RBAC models have defined SSD relations with respect to constraints on user-role
assignments over pairs of roles (i.e., no user can be simultaneously assigned to both roles
in SSD). Although real world examples of this SSD policy exist, this definition is overly
restrictive in two important aspects. The first aspect being the size of the set of roles in
the SSD and the second being the combination of roles in the set for which user
assignment is restricted. In this model SSD is defined with two arguments—a role set that
includes two or more roles and cardinality greater than one indicating a combination ofroles that would constitute a violation of the SSD policy. For example, an organization
may require that no one user may be assigned to three of the four roles that represent thepurchasing function.
As illustrated in figure 3, SSD relations may exist within hierarchical RBAC. When
applying SSD relations in the presence of a role hierarchy, special care must be applied toensure that user inheritance does not undermine SSD policies. As such, role hierarchies
have been defined to include the inheritance of SSD constraints. To address this potential
inconsistency SSD is defined as a constraint on the authorized users of the roles that havean SSD relation.

8

ANSI INCITS 359-2004

Figure 3: SSD within Hierarchical RBAC
Static Separation of Duty:•
SSD ⊆ (2ROLES × N ) is collection of pairs (rs, n) in Static Separation of Duty,
where each rs is a role set, t a subset of roles in rs, and n is a natural number ZLWKthe property that no user is assigned to n or more roles from the set rs in each(rs, n)∈ SSD. Formally:∀( rs , n ) ∈ SSD , ∀t ⊆ rs : t ≥ n ⇒ assigned_u sers (r ) = ∅.
r∈tStatic Separation of Duty in the Presence of a Hierarchy:
In the presence of a role hierarchy Static Separation of Duty is redefined based on
authorized users rather than assigned users as follows:∀(rs, n) ∈ SSD, ∀t ⊆ rs : t ≥ n ⇒  authorized_users (r ) = ∅.
r∈t

5.3.2

Dynamic Separation of Duty Relations

Static separation of duty relations reduce the number of potential permissions that can bemade available to a user by placing constraints on the users that can be assigned to a setof roles. Dynamic Separation of duty (DSD) relations, like SSD relations, are intended
to limit the permissions that are available to a user. However, DSD relations differ from
SSD relations by the context in which these limitations are imposed. SSD relations define
and place constraints on a user’s total permission space. This model component defines
DSD properties that limit the availability of the permissions over a user’s permission
space by placing constraints on the roles that can be activated within or across a user’s
9

ANSI INCITS 359-2004

sessions. DSD properties provide extended support for the principle of least privilege inthat each user has different levels of permission at different times, depending on the role
being performed. These properties ensure that permissions do not persist beyond the timethat they are required for performance of duty. This aspect of least privilege is often
referred to as timely revocation of trust. Dynamic revocation of permissions can be arather complex issue without the facilities of dynamic separation of duty, and as such it
has been generally ignored in the past for reasons of expediency.
This model component provides the capability to enforce an organization-specific policyof dynamic separation of duty (DSD). SSD relations provide the capability to address
potential conflict-of-interest issues at the time a user is assigned to a role. DSD allows auser to be authorized for two or more roles that do not create a conflict of interest when
acted in independently, but produce policy concerns when activated simultaneously. For
example, a user may be authorized for both the roles of Cashier and Cashier Supervisor,
where the supervisor is allowed to acknowledge corrections to a Cashier’s open cash
drawer. If the individual acting in the role Cashier attempted to switch to the role CashierSupervisor, RBAC would require the user to drop the Cashier role, and thereby force theclosure of the cash drawer before assuming the role Cashier Supervisor. As long as thesame user is not allowed to assume both of these roles at the same time, a conflict ofinterest situation will not arise. Although this effect could be achieved through theestablishment of a static separation of duty relationship, DSD relationships generally
provide the enterprise with greater operational flexibility.
Dynamic separation of duty relations are defined as a constraint on the roles that are
activated in a user’s session (see Figure 4).

Figure 4: Dynamic Separation of Duty Relations

Dynamic Separation of Duty:•

DSD ⊆ (2ROLES × N) is collection of pairs (rs, n) in Dynamic Separation of Duty,
where each rs is a role set and n is a natural number ZLWKWKHSURSHUW\WKDWQR
subject may activate n or more roles from the set rs in each dsd∈DSD. Formally:

10

ANSI INCITS 359-2004∀rs∈2ROLES, n∈N, (rs, n)∈DSD ⇒ n _rs| n, and∀s∈SESSIONS, ∀rs∈2ROLES, ∀role_subset∈2ROLES, ∀n∈N, (rs, n)∈DSD,

role_subset ⊆ rs, role_subset ⊆ session_roles(s) ⇒ |role_subset| < n.

6

RBAC SYSTEM AND ADMINISTRATIVE FUNCTIONAL SPECIFICATIONThe RBAC Functional specification specifies administrative operations for the creationand maintenance of RBAC element sets and relations; administrative review functions for
performing administrative queries; and system functions for creating and managing
RBAC attributes on user sessions and making access control decisions. Functions aredefined with sufficient precision to meet the needs of conformance testing and assurance,
while providing developers with design flexibility and the ability to incorporate
additional features to meet the needs of users.
The notation used in the formal specification of the RBAC functions is a subset of the Z
notation. The only change is the representation of a schema as follows:
Schema-Name (Declaration)  Predicate; …; Predicate  .
Most abstract data types and functions used in the formal specification are defined in
Section 3, RBAC Reference Model. New abstract data types and functions are introduced
as needed. NAME is an abstract data type whose elements represent identifiers of entities
that may or may not be included in the RBAC system (roles, users, sessions, etc.).
6.1
6.1.1

Core RBAC
Administrative Commands for Core RBAC

AddUserThis command creates a new RBAC user. The command is valid only if the new user is
not already a member of the USERS data set. The USER data set is updated. The new user
does not own any session at the time of its creation. The following schema formallydescribes the command AddUser:
AddUser (user: NAME ) user ∉USERS
USERS ′ = USERS ∪ {user}
user _ sessions ′ = user _ sessions ∪ {user  ∅} 

DeleteUser
This command deletes an existing user from the RBAC database. The command is valid
if and only if the user to be deleted is a member of the USERS data set. The USERS and
UA data sets and the assigned_users function are updated. It is an implementation
decision how to proceed with the sessions owned by the user to be deleted. The RBAC
system could wait for such a session to terminate normally, or it could force its
termination. The following schema formally describes the command DeleteUser:

11

ANSI INCITS 359-2004

DeleteUser (user: NAME ) user ∈USERS[ ∀s ∈ SESSIONS • s ∈ user _ sessions(user ) ⇒ DeleteSession( s)]UA ′ = UA \ {r: ROLES • user  r}assigned _ users ′ = {r: ROLES • r  ( assigned _ users(r ) \ {user})}
USERS ′ = USERS \ {user} 

AddRoleThis command creates a new role. The command is valid if and only if the new role is notalready a member of the ROLES data set. The ROLES data set and the functions
assigned_users and assigned_permissions are updated. Initially, no user or permission is
assigned to the new role. The following schema formally describes the command
AddRole:AddRole(role: NAME ) role ∉ ROLESROLES ′ = ROLES ∪ {role}assigned _ users ′ = assigned _ users ∪ {role  ∅}assigned _ permissions ′ = assigned _ permissions ∪ {role  ∅} 

DeleteRole
This command deletes an existing role from the RBAC database. The command is valid
if and only if the role to be deleted is a member of the ROLES data set. It is an
implementation decision how to proceed with the sessions in which the role to be deleted
is active. The RBAC system could wait for such a session to terminate normally, it could
force the termination of that session, or it could delete the role from that session whileallowing the session to continue.
DeleteRole(role: NAME ) role ∈ ROLES[ ∀s ∈ SESSIONS • role ∈ session _ roles( s) ⇒ DeleteSession( s)]UA ′ = UA \ {u: USERS • u  role}assigned _ users ′ = assigned _ users \ {role  asigned _ users(role)}
PA ′ = PA \ {op: OPS , obj: OBJS • (op, obj )  role}assigned _ permissions ′ = assigned _ permissions \ {role  assigned _ permissions(role)}
ROLES ′ = ROLES \ {role} 

AssignUser
This command assigns a user to a role. The command is valid if and only if the user is amember of the USERS data set, the role is a member of the ROLES data set, and the user
is not already assigned to the role. The data set UA and the function assigned_users are
updated to reflect the assignment. The following schema formally describes thecommand:

12

ANSI INCITS 359-2004

AssignUser (user , role: NAME ) user ∈USERS ; role ∈ ROLES ; (user  role) ∉UA
UA ′ = UA ∪ {user  role}assigned _ users ′ = assigned _ users \ {role  assigned _ users(role)} ∪{role  (assigned _ users(role) ∪ {user})} 

DeassignUser
This command deletes the assignment of the user user to the role role. The command isvalid if and only if the user is a member of the USERS data set, the role is a member ofthe ROLES data set, and the user is assigned to the role.
It is an implementation decision how to proceed with the sessions in which the session
user is user and one of his/her active roles is role. The RBAC system could wait for sucha session to terminate normally, could force its termination, or could inactivate the role.
The following schema formally describes the command DeassignUser:
DeassignUser (user , role: NAME ) user ∈USERS ; role ∈ ROLES ; (user  role) ∈UA[ ∀s: SESSIONS • s ∈ user _ sessions(user ) ∧ role ∈ session _ roles( s) ⇒ DeleteSession( s)]UA ′ = UA \ {user  role}assigned _ users ′ = assigned _ users \ {role  asigned _ users(role)} ∪{role  (asigned _ users( role) \ {user})} GrantPermission
This command grants a role the permission to perform an operation on an object to a role.
The command may be implemented as granting permissions to a group corresponding tothat role, i.e., setting the access control list of the object involved.
The command is valid if and only if the pair (operation, object) represents a permission,and the role is a member of the ROLES data set. The following schema formally defines
the command:
GrantPermission(object , operation, role: NAME ) (operation, object ) ∈ PERMS ; role ∈ ROLES
PA ′ = PA ∪ {(operation, object )  role}assigned _ permissions ′ = assigned _ permissions \ {role  assigned _ permissions( roles)} ∪{role  (assigned _ permissions(role) ∪ {(operation, object )})} 

RevokePermission
This command revokes the permission to perform an operation on an object from the setof permissions assigned to a role. The command may be implemented as revoking
permissions from a group corresponding to that role, i.e., setting the access control list of
the object involved.

13

ANSI INCITS 359-2004

The command is valid if and only if the pair (operation, object) represents a permission,
the role is a member of the ROLES data set, and the permission is assigned to that role.
The following schema formally describes the command:
RevokePermission( operation, object , role: NAME ) (operation, object ) ∈ PERMS ; role ∈ ROLES ; ((operation, object )  role) ∈ PA
PA ′ = PA \ {(operation, object )  role}assigned _ permissions ′ = assigned _ permissions \ {role  assigned _ permissions(role)} ∪{role  (assigned _ permissions(role) \ {(operation, object )})} 

6.1.2

Supporting System Functions for Core RBAC

CreateSession(user, session)
This function creates a new session with a given user as owner and an active role set. The
function is valid if and only if:- the user is a member of the USERS data set, and- the active role set is a subset of the roles assigned to that user. In a RBAC
implementation, the session’s active roles might actually be the groups that represent
those roles.
The following schema formally describes the function. The session parameter, which
represents the session identifier, is actually generated by the underlying system.
CreateSession(user: NAME ; ars:2 NAMES ; session: NAME ) user ∈USERS ; ars ⊆ {r: ROLES |(user  r ) ∈UA}; session ∉ SESSIONSSESSIONS ′ = SESSIONS ∪ {session}user _ sessions ′ = user _ sessions \ {user  user _ sessions(user )} ∪{user  (user _ sessions(user ) ∪ {session})}session _ roles ′ = session _ roles ∪ {session  ars} DeleteSession(user, session)
This function deletes a given session with a given owner user. The function is valid if andonly if the session identifier is a member of the SESSIONS data set, the user is a memberof the USERS data set, and the session is owned by the given user. The following schema
formally describes the function:
DeleteSession(user , session: NAME ) user ∈USERS ; session ∈ SESSIONS ; session ∈ user _ sessions(user )user _ sessions ′ = user _ sessions \ {user  user _ sessions(user )} ∪{user  (user _ sessions(user ) \ {session})}session _ roles ′ = session _ roles \ {session  session _ roles( session)}
SESSIONS ′ = SESSIONS \ {session} 

AddActiveRole
This function adds a role as an active role of a session whose owner is a given user. The
function is valid if and only if:- the user is a member of the USERS data set, and- the role is a member of the ROLES data set, and

14

ANSI INCITS 359-2004- the session identifier is a member of the SESSIONS data set, and- the role is assigned to the user, and- the session is owned by that user.
In an implementation, the new active role might be a group that corresponds to that role.
The following schema formally describes the function:
AddActiveRole(user , session, role: NAME ) user ∈USERS ; session ∈ SESSIONS ; role ∈ ROLES ; session ∈ user _ sessions(user )(user  role) ∈UA; role ∉ session _ roles( session)
session _ roles ′ = session _ roles \ {session  session _ roles( session)} ∪{session  ( session _ roles( session) ∪ {role})} 

DropActiveRole
This function deletes a role from the active role set of a session owned by a given user.
The function is valid if and only if the user is a member of the USERS data set, thesession identifier is a member of the SESSIONS data set, the session is owned by the user,
and the role is an active role of that session. The following schema formally describes
this function:
DropActiveRole(user , session, role: NAME ) user ∈USERS ; role ∈ ROLES ; session ∈ SESSIONS
session ∈ user _ sessions(user ); role ∈ session _ roles( session)
session _ roles ′ = session _ roles \ {session  session _ roles( session)} ∪{session  ( session _ roles( session) \ {role}) 

CheckAccessThis function returns a Boolean value meaning whether the subject of a given session isallowed or not to perform a given operation on a given object. The function is valid if andonly if the session identifier is a member of the SESSIONS data set, the object is amember of the OBJS data set, and the operation is a member of the OPS data set. The
session’s subject has the permission to perform the operation on that object if and only ifthat permission is assigned to (at least) one of the session’s active roles. An
implementation might use the groups that correspond to the subject’s active roles andtheir permissions as registered in the object’s access control list. The following schema
formally describes the function:
CheckAccess( session, operation, object: NAME ; out result: BOOLEAN ) session ∈ SESSIONS ; operation ∈ OPS ; object ∈ OBJS
result = ( ∃r: ROLES • r ∈ session _ roles( session) ∧ ((operation, object )  r ) ∈ PA) 

6.1.3

Review Functions for Core RBAC

AssignedUsers
This function returns the set of users assigned to a given role. The function is valid if andonly if the role is a member of the ROLES data set. The following schema formallydescribes the function:

15

ANSI INCITS 359-2004

AssignedUsers(role: NAME ; out result:2USERS ) role ∈ ROLES
result = {u: USERS |(u  role) ∈UA} 

AssignedRoles
This function returns the set of roles assigned to a given user. The function is valid if andonly if the user is a member of the USERS data set. The following schema formallydescribes the function:
AssignedRoles(user: NAME ; result:2 ROLES ) user ∈USERS
result = {r: ROLES |(user  r ) ∈UA} 
6.1.4

Advanced Review Functions for Core RBAC

RolePermissions
This function returns the set of permissions (op, obj) granted to a given role. The function
is valid if and only if the role is a member of the ROLES data set. The following schema
formally describes the function:
RolePermissions(role: NAME ; result:2 PERMS ) role ∈ ROLES
result = {op: OPS ; obj: OBJS |((op, obj )  role) ∈ PA} 

UserPermissions
This function returns the permissions a given user gets through his/her assigned roles.
The function is valid if and only if the user is a member of the USERS data set. The
following schema formally describes this function:
UserPermissions(user: NAME ; result:2 PERMS ) user ∈USERS
result = {r: ROLES ; op: OPS ; obj: OBJS |(user  r ) ∈UA ∧ (( op, obj )  r ) ∈ PA • (op, obj )} 

SessionRoles
This function returns the active roles associated with a session. The function is valid if
and only if the session identifier is a member of the SESSIONS data set. The following
schema formally describes this function:
SessionRoles( session: NAME ; out result:2 ROLES ) session ∈ SESSIONS
result = session _ roles( session) SessionPermissions
This function returns the permissions of the session session, i.e., the permissions assigned
to its active roles. The function is valid if and only if the session identifier is a member of
the SESSIONS data set. The following schema formally describes this function:

16

ANSI INCITS 359-2004

SessionPermissions( session: NAME ; out result:2 PERMS ) session ∈ SESSIONS
result = {r: ROLES ; op ∈ OPS ; obj ∈ OBJS | r ∈ session _ roles( session) ∧ ((op, obj )  r ) ∈ PA •(op, obj )} 

RoleOperationsOnObject
This function returns the set of operations a given role is permitted to perform on a given
object. The function is valid only if the role is a member of the ROLES data set, and theobject is a member of the OBJS data set. The following schema formally describes thefunction:
RoleOperationsOnObject (role: NAME ; obj: NAME ; result:2 OPS ) role ∈ ROLES
obj ∈ OBJS
result = {op: OPS |((op, obj )  role) ∈ PA} 

UserOperationsOnObject
This function returns the set of operations a given user is permitted to perform on a given
object, obtained either directly or through his/her assigned roles. The function is valid if
and only if the user is a member of the USERS data set and the object is a member of the
OBJS data set. The following schema formally describes this function:
UserOperationsOnObject (user: NAME ; obj: NAME ; result:2 OPS ) user ∈USERS
obj ∈ OBJS
result = {r: ROLES ; op: OPS |(user  r ) ∈UA ∧ ((op, obj )  r ) ∈ PA • op} 
6.2
6.2.1

6.2.1.1

Hierarchical RBAC
General Role Hierarchies

Administrative Commands for General Role Hierarchies

All functions of 6.1.1 remain valid. In addition, this section defines the following new,specific functions:
AddInheritanceThis commands establishes a new immediate inheritance relationship r_asc
r_descbetween existing roles r_asc, r_desc. The command is valid if and only if r_asc andr_desc are members of the ROLES data set, r_asc is not an immediate ascendant of
r_desc, and r_desc does not properly inherit r_asc (in order to avoid cycle creation). The
following schema uses the notations:

17

ANSI INCITS 359-2004





>> ==
to formally describes the command:
AddInheritance(r _ asc, r _ desc: NAME ) 
r _ asc ∈ ROLES ; r _ desc ∈ ROLES ; ¬(r _ asc >> r _ desc); ¬(r _ desc ≥ r _ asc)
≥ ′ = ≥ ∪{r , q: ROLES | r ≥ r _ asc ∧ r _ desc ≥ q • r  q} 

DeleteInheritancer_desc.
This command deletes an existing immediate inheritance relationship r_asc
The command is valid if and only if the roles r_asc and r_desc are members of the
ROLES data set, and r_asc is an immediate ascendant of r_desc. The new inheritance
relation is computed as the reflexive-transitive closure of the immediate inheritancer_desc. The following schema
relation resulted after deleting the relationship r_asc
formally describes this command:
DeleteInheritance( r _ asc, r _ desc: NAME ) 
r _ asc ∈ ROLES ; r _ desc ∈ ROLES ; r _ asc >> r _ desc
≥ ′= ( >> \ {r _ asc  r _ desc}) * 

AddAscendantThis commands creates a new role r_asc, and inserts it in the role hierarchy as an
immediate ascendant of the existing role r_desc. The command is valid if and only ifr_asc is not a member of the ROLES data set, and r_desc is a member of the ROLES data
set. Note that the validity conditions are verified in the schemas AddRole and
AddInheritance, referred to by AddAscendant.
AddAscendant (r _ asc, r _ desc: NAME ) 
AddRole(r _ asc)
AddInheritance(r _ asc, r _ desc) 

AddDescendantThis commands creates a new role r_desc, and inserts it in the role hierarchy as an
immediate descendant of the existing role r_asc. The command is valid if and only if
r_desc is not a member of the ROLES data set, and r_asc is a member of the ROLES data
set. Note that the validity conditions are verified in the schemas AddRole and
AddInheritance, referred to by AddDescendant.
AddDescendant (r _ asc, r _ desc: NAME ) 
AddRole(r _ desc)
AddInheritance(r _ asc, r _ desc) 

18

ANSI INCITS 359-2004

6.2.1.2

Supporting System Functions for General Role Hierarchies

This section redefines the functions CreateSession and AddActiveRole of 7.1.2. The
other functions of 6.1.2 remain valid.
CreateSession(user, session)
This function creates a new session with a given user as owner, and a given set of activeroles. The function is valid if and only if:- the user is a member of the USERS data set, and- the active role set is a subset of the roles authorized for that user. Note that if a role isactive for a session, its descendants or ascendants are not necessarily active for thatsession. In a RBAC implementation, the session’s active roles might actually be thegroups that represent those roles.
The following schema formally describes the function. The parameter session, which
identifies the session, is actually generated by the underlying system.
CreateSession(user: NAME ; ars:2 NAME ; session: NAME ) user ∈USERS ; ars ⊆ {r , q: ROLES |( user  q ) ∈UA ∧ q ≥ r • r}; session ∉ SESSIONSSESSIONS ′ = SESSIONS ∪ {session}user _ sessions ′ = user _ sessions \ {user  user _ sessions(user )} ∪{user  (user _ sessions(user ) ∪ {session})}session _ roles ′ = session _ roles ∪ {session  ars} 

AddActiveRole
This function adds a role as an active role of a session whose owner is a given user. The
function is valid if and only if:- the user is a member of the USERS data set, and- the role is a member of the ROLES data set, and- the session identifier is a member of the SESSIONS data set, and- the user is authorized to that role, and- the session is owned by that user.
The following schema formally describes the function:
AddActiveRole(user , session, role: NAME ) user ∈USERS ; session ∈ SESSIONS ; role ∈ ROLES ; session ∈ user _ sessions(user )user ∈ authorized _ users(role); role ∉ session _ roles( session)
session _ roles ′ = session _ roles \ {session  session _ roles( session)} ∪{session  ( session _ roles( session) ∪ {role})} 

6.2.1.3

Review Functions for General Role Hierarchies

All functions of 6.1.3 remain valid. In addition, this section defines the following review
functions:

19

ANSI INCITS 359-2004

AuthorizedUsers
This function returns the set of users authorized to a given role, i.e., the users that areassigned to a role that inherits the given role. The function is valid if and only if the givenrole is a member of the ROLES data set. The following schema formally describes thefunction:
AuthorizedUsers( role: NAME ; out result:2USERS ) role ∈ ROLES
result = authorized _ users(role) AuthorizedRoles
This function returns the set of roles authorized for a given user. The function is valid if
and only if the user is a member of the USERS data set. The following schema formallydescribes the function:
AuthorizedRoles(user: NAME ; result:2 ROLES ) user ∈USERS
result = {r , q: ROLES |(user  q ) ∈UA ∧ q ≥ r} 

6.2.1.4

Advanced Review Functions for General Role Hierarchies

This section redefines the functions RolePermissions and UserPermissions of 6.1.4. Allother functions of 6.1.4 remain valid.

RolePermissions
This function returns the set of all permissions (op, obj), granted to or inherited by agiven role. The function is valid if and only if the role is a member of the ROLES data
set. The following schema formally describes the function:
RolePermissions (role : NAME ; result : 2 PERMS ) role ∈ ROLES
result = {q : ROLES ; op : OPS ; obj : OBJS | (role ≥ q) ∧ ((op, obj )  role) ∈ PA • (op, obj )} 

UserPermissions
This function returns the set of permissions a given user gets through his/her authorized
roles. The function is valid if and only if the user is a member of the USERS data set. The
following schema formally describes this function:
UserPermissions(user: NAME ; result:2 PERMS ) user ∈USERS
result = {r , q: ROLES ; op: OPS ; obj: OBJS |(user  q ) ∈UA ∧ (q ≥ r ) ∧ ((op, obj )  r ) ∈ PA •(op, obj )} 

20

ANSI INCITS 359-2004

RoleOperationsOnObject
This function returns the set of operations a given role is permitted to perform on a given
object. The set contains all operations granted directly to that role or inherited by that rolefrom other roles. The function is valid only if the role is a member of the ROLES data set,
and the object is a member of the OBJS data set. The following schema formallydescribes the function:
RoleOperationsOnObject (role: NAME ; obj: NAME ; result:2 OPS ) role ∈ ROLES
obj ∈ OBJS
result = {q: ROLES ; op: OPS |(role ≥ q ) ∧ ((op, obj )  role) ∈ PA • op} 

UserOperationsOnObject
This function returns the set of operations a given user is permitted to perform on a given
object. The set consists of all the operations obtained by the user either directly, or
through his/her authorized roles. The function is valid if and only if the user is a memberof the USERS data set and the object is a member of the OBJS data set. The following
schema formally describes this function:
UserOperationsOnObject (user: NAME ; obj: NAME ; result:2 OPS ) user ∈USERS
obj ∈ OBJS
result = {r , q: ROLES ; op: OPS |(user  q ) ∈UA ∧ (q ≥ r ) ∧ ((op, obj )  r ) ∈ PA • op} 

6.2.2

6.2.2.1

Limited Role Hierarchies

Administrative Commands for Limited Role Hierarchies

This section redefines the function AddInheritance of 6.2.1.1. All other functions of
6.2.1.1 remain valid.
AddInheritanceThis commands establishes a new immediate inheritance relationship r_asc
r_descbetween existing roles r_asc, r_desc. The command is valid if and only if r_asc andr_desc are members of the ROLES data set, r_asc has no descendants, and r_desc does
not properly inherit r_asc (in order to avoid cycle creation). The following schema uses
the notations:




>> ==
to formally describes the command:
AddInheritance(r _ asc, r _ desc: NAME ) 
r _ asc ∈ ROLES ; r _ desc ∈ ROLES ; ∀r ∈ ROLES • ¬( r _ asc >> r ); ¬(r _ desc ≥ r _ asc)
≥ ′ = ≥ ∪{r , q: ROLES | r ≥ r _ asc ∧ r _ desc ≥ q • r  q} 

21

ANSI INCITS 359-2004

6.2.2.2

Supporting System Functions for Limited Role Hierarchies

All functions of 6.2.1.2 remain valid.
6.2.2.3

Review Functions for Limited Role Hierarchies

All functions of 6.2.1.3 remain valid.
6.2.2.4

Advanced Review Functions for Limited Role Hierarchies

Advanced review functions of 6.2.1.4 remain valid.
6.3
6.3.1

Static Separation of Duty (SSD) Relations
Core RBAC

The static separation of duty property, as defined in the model, uses a collection SSD ofpairs of a role set and an associated cardinality. This section defines the new data type
SSD, which in an implementation could be the set of names used to identify the pairs in
the collection.
The functions ssd_set and respectively ssd_card are used to obtain the role set and theassociated cardinality from each SSD pair:
ssd _ set: SSD → 2 ROLES
ssd _ card : SSD → N∀ssd ∈ SSD • ssd _ card ( ssd ) ≥ 2 ∧ ssd _ card ( ssd ) ≤| ssd _ set ( ssd )|6.3.1.1

Administrative commands for SSD Relations

This section redefines the function AssignUser of 6.1.1 and defines a set of new, specificfunctions. The other functions of 6.1.1 remain valid.
AssignUser
The AssignUser command replaces the command with the same name of Core RBAC.
This command assigns a user to a role. The command is valid if and only if:- the user is a member of the USERS data set, and- the role is a member of the ROLES data set, and- the user is not already assigned to the role, and- the SSD constraints are satisfied after assignment.
The data set UA and the function assigned_users are updated to reflect the assignment.
The following schema formally describes the command:

22

ANSI INCITS 359-2004

AssignUser (user , role: NAME ) user ∈USERS ; role ∈ ROLES ; (user  role) ∉UA∀ssd ∈ SSD • (assigned _ users(r ) ∪ us) = ∅r ∈subset
subset ⊆ ssd _ set ( ssd )|subset |= ssd _ card ( ssd )us = if r = role then {user } else ∅UA ′ = UA ∪ {user  role}assigned _ users ′ = assigned _ users \ {role  assigned _ users(role)} ∪{role  (assigned _ users(role) ∪ {user})} 

CreateSsdSet
This command creates a named SSD set of roles and sets the cardinality n of its subsetsthat cannot have common users. The command is valid if and only if:- the name of the SSD set is not already in use- all the roles in the SSD set are members of the ROLES data set- n is a natural number greater than or equal to 2 and less than or equal to thecardinality of the SSD role set, and- the SSD constraint for the new role set is satisfied.
The following schema formally describes this command:
CreateSsdSet ( set _ name: NAME ; role _ set:2 NAMES ; n: N) 
set _ name ∉ SSD; (n ≥ 2) ∧ ( n ≤| role _ set |); role _ set ⊆ ROLES

 assigned _ users(r ) = ∅r ∈subset
subset ⊆ role _ set|subset |= n

SSD ′ = SSD ∪ {set _ name}ssd _ set ′ = ssd _ set ∪ {set _ name  role _ set}
ssd _ card ′ = ssd _ card ∪ {set _ name  n} 

AddSsdRoleMember
This command adds a role to a named SSD set of roles. The cardinality associated withthe role set remains unchanged. The command is valid if and only if:- the SSD role set exists, and- the role to be added is a member of the ROLES data set but not of a member of the
SSD role set, and- the SSD constraint is satisfied after the addition of the role to the SSD role set.
The following schema formally describes the command:
AddSsdRoleMember ( set _ name: NAME ; role: NAME ) 
set _ name ∈ SSD; role ∈ ROLES ; role ∉ ssd _ set ( set _ name) assigned _ users(r ) = ∅r ∈subset
subset ⊆ ssd _ set ( set _ name ) ∪{role}|subset |= nssd _ set ′ = ssd _ set \ {set _ name  ssd _ set ( set _ name)} ∪{set _ name  ( ssd _ set ( set _ name) ∪ {role})} 

23

ANSI INCITS 359-2004

DeleteSsdRoleMember
This command removes a role from a named SSD set of roles. The cardinality associatedwith the role set remains unchanged. The command is valid if and only if:- the SSD role set exists, and- the role to be removed is a member of the SSD role set, and- the cardinality associated with the SSD role set is less than the number of elements of
the SSD role set.
Note that the SSD constraint should be satisfied after the removal of the role from the
SSD role set. The following schema formally describes the command:
DeleteSsdRoleMember ( set _ name: NAME ; role: NAME ) 
set _ name ∈ SSD; role ∈ ssd _ set ( set _ name); ssd _ card ( set _ name) < | ssd _ set ( set _ name)|
ssd _ set ′ = ssd _ set \ {set _ name  ssd _ set ( set _ name)} ∪{set _ name  ( ssd _ set ( set _ name) \ {role})} 

DeleteSsdSet
This command deletes a SSD role set completely. The command is valid if and only if the
SSD role set exists. The following schema formally describes the command:
DeleteSsdSet ( set _ name: NAME ) 
set _ name ∈ SSD; ssd _ card ′ = ssd _ card \ {set _ name  ssd _ card ( set _ name)}
ssd _ set ′ = ssd _ set \ {set _ name  ssd _ set ( set _ name)}
SSD ′ = SSD \ {set _ name} 

SetSsdSetCardinality
This command sets the cardinality associated with a given SSD role set. The command isvalid if and only if:- the SSD role set exists, and- the new cardinality is a natural number greater than or equal to 2 and less than orequal to the number of elements of the SSD role set, and- the SSD constraint is satisfied after setting the new cardinality.
The following schema formally describes the command:
SetSsdSetCardinality ( set _ name: NAME ; n: N) 
set _ name ∈ SSD; (n ≥ 2) ∧ (n ≤| ssd _ set ( set _ name)|) assigned _ users(r ) = ∅r ∈subset
subset ⊆ ssd _ set ( set _ name )|subset |= nssd _ card ′ = ssd _ card \ {set _ name  ssd _ card ( set _ name)} ∪ {set _ name  n} 6.3.1.2

Supporting System Functions for SSD

All functions in 6.1.2 remain valid.
6.3.1.3

Review Functions for SSD

All functions in 6.1.3 remain valid. In addition, this section defines the following
functions:24

ANSI INCITS 359-2004

SsdRoleSets
This function returns the list of all SSD role sets. The following schema formallydescribes the function:
SsdRoleSets( out result:2 NAME )  result = SSD 

SsdRoleSetRoles
This function returns the set of roles of a SSD role set. The function is valid if and only if
the role set exists. The following schema formally describes the function:
SsdRoleSetRoles( set _ name: NAME ; out result:2 ROLES ) 
set _ name ∈ SSD
result = ssd _ set ( set _ name) SsdRoleSetCardinality
This function returns the cardinality associated with a SSD role set. The function is valid
if and only if the role set exists. The following schema formally describes the function:
SsdRoleSetCardinality ( set _ name: NAME ; out result: N) 
set _ name ∈ SSD
result = ssd _ card ( set _ name) 
6.3.1.4

Advanced Review Functions for SSD

All functions in 6.1.4 remain valid.
6.3.2

6.3.2.1

SSD with General Role Hierarchies

Administrative Commands for SSD with General Role Hierarchies

This section redefines the functions AssignUser and AddInheritance of 6.2.1.1, and thefunctions CreateSsdSet, AddSsdRoleMember, SetSsdSetCardinality of 6.3.1.1. The otherfunctions of 6.2.1.1 and 6.3.1.1 remain valid.
AssignUser
The command AssignUser replaces the command with the same name from Core RBAC
with Static Separation of Duties. This command assigns a user to a role. The command isvalid if and only if:- the user is a member of the USERS data set, and- the role is a member of the ROLES data set, and- the user is not already assigned to the role, and- the SSD constraints are satisfied after assignment.
The data set UA and the function assigned_users are updated to reflect the assignment.
The following schema formally describes the command:

25

ANSI INCITS 359-2004

AssignUser (user , role: NAME ) user ∈USERS ; role ∈ ROLES ; (user  role) ∉UA∀ssd ∈ SSD • (authorized _ users(r ) ∪ au) = ∅r ∈subset
subset ⊆ ssd _ set ( ssd )|subset |= ssd _ card ( ssd )au = if r = role then {user } else ∅UA ′ = UA ∪ {user  role}assigned _ users ′ = assigned _ users \ {role  assigned _ users(role)} ∪{role  (assigned _ users(role) ∪ {user})} 

AddInheritanceThis commands establishes a new immediate inheritance relationship r_asc
between existing roles r_asc, r_desc. The command is valid if and only if:-

r_asc and r_desc are members of the ROLES data set, and-r_asc is not an immediate ascendant of r_desc, and-

r_desc does not properly inherit r_asc, and-the SSD constraints are satisfied after establishing the new inheritance.

r_descThe following schema uses the notations:




>> ==
to formally describes the command:
AddInheritance(r _ asc, r _ desc: NAME ) 
r _ asc ∈ ROLES ; r _ desc ∈ ROLES ; ¬(r _ asc >> r _ desc); ¬(r _ desc ≥ r _ asc)
∀ssd ∈ SSD • (authorized _ users(r ) ∪ au) = ∅r ∈subset
subset ⊆ ssd _ set ( ssd )|subset |= ssd _ card ( ssd )au = if r = r _ desc then authorized _ users ( r _ asc ) else ∅≥ ′ = ≥ ∪{r , q: ROLES | r ≥ r _ asc ∧ r _ desc ≥ q • r  q} CreateSsdSet
This command creates a named SSD set of roles and sets the associated cardinality n of
its subsets that cannot have common users. The command is valid if and only if:- the name of the SSD set is not already in use- all the roles in the SSD set are members of the ROLES data set- n is a natural number greater than or equal to 2 and less than or equal to thecardinality of the SSD role set, and- the SSD constraint for the new role set is satisfied.
The following schema formally describes this command:

26

ANSI INCITS 359-2004

CreateSsdSet ( set _ name: NAME ; role _ set:2 NAMES ; n: N) 
set _ name ∉ SSD; (n ≥ 2) ∧ ( n ≤| role _ set |); role _ set ⊆ ROLES

 authorized _ users(r ) = ∅r ∈subset
subset ⊆ role _ set|subset |= n

SSD ′ = SSD ∪ {set _ name}ssd _ set ′ = ssd _ set ∪ {set _ name  role _ set}
ssd _ card ′ = ssd _ card ∪ {set _ name  n} 

AddSsdRoleMember
This command adds a role to a named SSD set of roles. The cardinality associated withthe role set remains unchanged. The command is valid if and only if:- the SSD role set exists, and- the role to be added is a member of the ROLES data set but not of a member of the
SSD role set, and- the SSD constraint is satisfied after the addition of the role to the SSD role set.
The following schema formally describes the command:
AddSsdRoleMember ( set _ name: NAME ; role: NAME ) 
set _ name ∈ SSD; role ∈ ROLES ; role ∉ ssd _ set ( set _ name) authorized _ users(r ) = ∅r ∈subset
subset ⊆ ssd _ set ( set _ name ) ∪{role}|subset |= nssd _ set ′ = ssd _ set \ {set _ name  ssd _ set ( set _ name)} ∪{set _ name  ( ssd _ set ( set _ name) ∪ {role})} 

SetSsdSetCardinality
This command sets the cardinality associated with a given SSD role set. The command isvalid if and only if:- the SSD role set exists, and- the new cardinality is a natural number greater than or equal to 2 and less than orequal to the number of elements of the SSD role set, and- the SSD constraint is satisfied after setting the new cardinality.
The following schema formally describes the command:
SetSsdSetCardinality ( set _ name: NAME ; n: N) 
set _ name ∈ SSD; (n ≥ 2) ∧ (n ≤| ssd _ set ( set _ name)|) authorized _ users(r ) = ∅r ∈subset
subset ⊆ ssd _ set ( set _ name )|subset |= nssd _ card ′ = ssd _ card \ {set _ name  ssd _ card ( set _ name)} ∪ {set _ name  n} 6.3.2.2

Supporting System Functions for SSD with General Role Hierarchies

All functions of 6.2.1.2 remain valid.

27

ANSI INCITS 359-2004

6.3.2.3

Review Functions for SSD with General Role Hierarchies

All functions of 6.2.1.3 and 6.3.1.3 remain valid.

6.3.2.4

Advanced Review Functions for SSD with General Role Hierarchies

Advanced review functions of 6.2.1.4 above remain valid.

6.3.3

6.3.3.1

SSD Relations with Limited Role Hierarchies

Administrative Commands for SSD with Limited Role Hierarchies

This section redefines the function AddInheritance of 6.3.2.1. All other functions of
6.3.2.1 above remain valid.
AddInheritanceThis commands establishes a new immediate inheritance relationship r_asc
r_desc between existingroles r_asc, r_desc. The command is valid if and only if r_asc and r_desc are members of the ROLES dataset, r_asc has no descendants, and r_desc does not properly inherit r_asc (in order to avoid cycle creation).
The following schema uses the notations:




>> ==
to formally describes the command:

AddInheritance(r _ asc, r _ desc: NAME ) 
r _ asc ∈ ROLES ; r _ desc ∈ ROLES ; ∀r ∈ ROLES • ¬( r _ asc >> r ); ¬(r _ desc ≥ r _ asc)
∀ssd ∈ SSD • (authorized _ users(r ) ∪ au) = ∅r ∈subset
subset ⊆ ssd _ set ( ssd )|subset |= ssd _ card ( ssd )au = if r = r _ desc then authorized _ users ( r _ asc ) else ∅≥ ′ = ≥ ∪{r , q: ROLES | r ≥ r _ asc ∧ r _ desc ≥ q • r  q} 
6.3.3.2

Supporting System Functions for SSD with Limited Role Hierarchies

All functions of 6.3.2.1 above remain valid.

28

ANSI INCITS 359-2004

6.3.3.3

Review Functions for SSD with Limited Role Hierarchies

All functions of 6.2.1.3 above and 6.3.1.3 above remain valid.

6.3.3.4

Advanced Review Functions for SSD with Limited Role Hierarchies

All functions of 6.2.1.4 above remain valid.

6.4
6.4.1

Dynamic Separation of Duties (DSD) Relations
Core RBAC

The dynamic separation of duty property, as defined in the model, uses a collection DSDof pairs of a role set and an associated cardinality. This section defines the new data type
DSD, which in an implementation could be the set of names used to identify the pairs in
the collection.
The functions dsd_set and respectively dsd_card are used to obtain the role set and theassociated cardinality from each DSD pair:dsd _ set: DSD → 2 ROLES
dsd _ card : DSD → N∀dsd ∈ SSD • dsd _ card (dsd ) ≥ 2 ∧ dsd _ card (dsd ) ≤| dsd _ set (dsd )|6.4.1.1

Administrative Commands for DSD Relations

All functions of 6.1.1 above remain valid. In addition, this section defines the following
functions:
CreateDsdSet
This command creates a named DSD set of roles and sets an associated cardinality n. The
DSD constraint stipulates that the DSD role set cannot contain n or more roles
simultaneously active in the same session.
The command is valid if and only if:- the name of the DSD set is not already in use- all the roles in the DSD set are members of the ROLES data set- n is a natural number greater than or equal to 2 and less than or equal to thecardinality of the DSD role set, and- the DSD constraint for the new role set is satisfied.
The following schema formally describes this command:

29

ANSI INCITS 359-2004

CreateDsdSet ( set _ name: NAME ; role _ set:2 NAMES ; n: N) 
set _ name ∉ DSD; (n ≥ 2) ∧ (n ≤| role _ set |); role _ set ⊆ ROLES∀s: SESSIONS ; role _ subset:2 role _ set • role _ subset ⊆ session _ roles( s) ⇒| role _ subset | < n
DSD ′ = DSD ∪ {set _ name}dsd _ set ′ = dsd _ set ∪ {set _ name  role _ set}
dsd _ card ′ = dsd _ card ∪ {set _ name  n} 

AddDsdRoleMember
This command adds a role to a named DSD set of roles. The cardinality associated withthe role set remains unchanged. The command is valid if and only if:- the DSD role set exists, and- the role to be added is a member of the ROLES data set but not of a member of the
DSD role set, and- the DSD constraint is satisfied after the addition of the role to the DSD role set.
The following schema formally describes the command:
AddDsdRoleMember ( set _ name: NAME ; role: NAME ) 

set _ name ∈ DSD; role ∈ ROLES ; role ∉ dsd _ set ( set _ name)∀s: SESSIONS ; role _ subset:2 dsd _ set ( set _ name) ∪{role} •role _ subset ⊆ session _ roles( s) ⇒| role _ subset | < dsd _ card ( set _ name)dsd _ set ′ = dsd _ set \ {set _ name  dsd _ set ( set _ name)} ∪{set _ name  ( dsd _ set ( set _ name) ∪ {role})} 

DeleteDsdRoleMember
This command removes a role from a named DSD set of roles. The cardinality associatedwith the role set remains unchanged. The command is valid if and only if:- the DSD role set exists, and- the role to be removed is a member of the DSD role set, and- the cardinality associated with the DSD role set is less than the number of elements of
the DSD role set.
Note that the DSD constraint should be satisfied after the removal of the role from the
DSD role set. The following schema formally describes the command:
DeleteDsdRoleMember ( set _ name: NAME ; role: NAME ) 
set _ name ∈ DSD; role ∈ dsd _ set ( set _ name); dsd _ card ( set _ name) < | dsd _ set ( set _ name)|
dsd _ set ′ = dsd _ set \ {set _ name  dsd _ set ( set _ name)} ∪{set _ name  (dsd _ set ( set _ name) \ {role})} 

DeleteDsdSet
This command deletes a DSD role set completely. The command is valid if and only if
the DSD role set exists. The following schema formally describes the command:

30

ANSI INCITS 359-2004

DeleteDsdSet ( set _ name: NAME ){set _ name ∈ DSD
dsd _ card ′ = dsd _ card \ {set _ name  dsd _ card ( set _ name)}
dsd _ set ′ = dsd _ set \ {set _ name  dsd _ set ( set _ name)}
DSD ′ = DSD \ {set _ name}}

SetDsdSetCardinality
This command sets the cardinality associated with a given DSD role set. The command isvalid if and only if:- the DSD role set exists, and- the new cardinality is a natural number greater than or equal to 2 and less than orequal to the number of elements of the DSD role set, and- the DSD constraint is satisfied after setting the new cardinality.
The following schema formally describes the command:
SetDsdSetCardinality ( set _ name: NAME ; n: N) 
set _ name ∈ DSD; (n ≥ 2) ∧ (n ≤| dsd _ set ( set _ name)|)∀s: SESSIONS ; role _ subset:2 dsd _ set ( set _ name ) •role _ subset ⊆ session _ roles( s) ⇒| role _ subset | < ndsd _ card ′ = dsd _ card \ {set _ name  dsd _ card ( set _ name)} ∪ {set _ name  n} 6.4.1.2

Supporting System Functions for DSD Relations

This section redefines the functions CreateSession and AddActiveRole of 6.1.2 above.
The other functions of 6.1.2 above remain valid.
CreateSession
This function creates a new session whose owner is the user user and a given active roleset. The function is valid if and only if:- the user is a member of the USERS data set, and- the session’s active role set is a subset of the roles assigned to the session’s owner,and- the session’s active role set satisfies the DSD constraints.
The following schema formally describes the function. The session parameter, which
identifies the new session, is actually generated by the underlying system.

31

ANSI INCITS 359-2004

CreateSession(user: NAME ; ars:2 NAME ; session: NAME ) user ∈USERS ; ars ⊆ {r: ROLES |(user  r ) ∈UA}; session ∉ SESSIONS∀dset: DSD; rset:2 NAME •rset ⊆ dsd _ set (dset ) ∧ rset ⊆ ars ⇒| rset | < dsd _ card (dset )SESSIONS ′ = SESSIONS ∪ {session}user _ sessions ′ = user _ sessions \ {user  user _ sessions(user )} ∪{user  (user _ sessions(user ) ∪ {session})}session _ roles ′ = session _ roles ∪ {session  ars} 

AddActiveRole
This function adds a role as an active role of a session whose owner is a given user. The
function is valid if and only if:- the user is a member of the USERS data set, and- the role is a member of the ROLES data set, and- the session identifier is a member of the SESSIONS data set, and- the role is assigned to the user, and- the old active role set completed with the role to be activated satisfies the DSD
constraints, and- the session is owned by that user.
The following schema formally describes the function:
AddActiveRole(user , session, role: NAME ) user ∈USERS ; session ∈ SESSIONS ; role ∈ ROLES ; session ∈ user _ sessions(user )user ∈ assigned _ users( role); role ∉ session _ roles( session)∀dset: DSD; rset:2 NAME •rset ⊆ dsd _ set (dset ) ∧ rset ⊆ session _ roles( session) ∪ {role} ⇒| rset | < dsd _ card (dset )session _ roles ′ = session _ roles \ {session  session _ roles( session)} ∪{session  ( session _ roles( session) ∪ {role})} 
6.4.1.3

Review Functions for DSD Relations

All functions of 6.1.3 above remain valid. In addition, this section defines new, specificfunctions.
DsdRoleSets
This function returns the list of all DSD role sets. The following schema formallydescribes the function:
DsdRoleSets(out result:2 NAME )  result = DSD 

DsdRoleSetRoles
This function returns the set of roles of a DSD role set. The function is valid if and only if
the role set exists. The following schema formally describes the function:

32

ANSI INCITS 359-2004

DsdRoleSetRoles( set _ name: NAME ; out result:2 ROLES ) 
set _ name ∈ DSD
result = dsd _ set ( set _ name) 

DsdRoleSetCardinality
This function returns the cardinality associated with a DSD role set. The function is valid
if and only if the role set exists. The following schema formally describes the function:
DsdRoleSetCardinality ( set _ name: NAME ; out result: N) 
set _ name ∈ DSD
result = dsd _ card ( set _ name) 

6.4.1.4

Advanced Review Functions for DSD Relations

All functions of 6.1.4 above remain valid.
6.4.2

6.4.2.1

DSD Relations with General Role Hierarchies

Administrative commands for DSD Relations with General Role Hierarchies

All functions of 6.2.1.1 and 6.4.1.1 remain valid.
6.4.2.2

Supporting System Functions for DSD Relations with General Role Hierarchies

This section redefines the functions CreateSession and AddActiveRole of 6.1.2 (or 6.2.1.2). All otherfunctions of 6.1.2 remain valid.

CreateSession
This function creates a new session whose owner is the user user and a given active roleset. The function is valid if and only if:- the user is a member of the USERS data set, and- the session’s active role set is a subset of the roles authorized for the session’s owner,and- the session’s active role set satisfies the DSD constraints.
The underlying system generates a new session identifier, which is included in theSESSIONS data set.
The following schema formally describes the function:

33

ANSI INCITS 359-2004

CreateSession(user: NAME ; ars:2 NAME ; session: NAME ) user ∈USERS ; ars ⊆ {r , q: ROLES |( user  q ) ∈UA ∧ q ≥ r • r}; session ∉ SESSIONS∀dset: DSD; rset:2 NAME •rset ⊆ dsd _ set (dset ) ∧ rset ⊆ ars ⇒| rset | < dsd _ card ( dset )SESSIONS ′ = SESSIONS ∪ {session}user _ sessions ′ = user _ sessions \ {user  user _ sessions( user )} ∪{user  (user _ sessions(user ) ∪ {session})}session _ roles ′ = session _ roles ∪ {session  ars} 

AddActiveRole
This function adds a role as an active role of a session whose owner is a given user. The
function is valid if and only if:- the user is a member of the USERS data set, and- the role is a member of the ROLES data set, and- the session identifier is a member of the SESSIONS data set, and- the role is authorized for that user, and- the old active role set completed with the role to be activated satisfies the DSD
constraints, and- the session is owned by that user.
The following schema formally describes the function:
AddActiveRole(user , session, role: NAME ) user ∈USERS ; session ∈ SESSIONS ; role ∈ ROLES ; session ∈ user _ sessions(user )user ∈ authorized _ users(role); role ∉ session _ roles( session)∀dset: DSD; rset:2 NAME •rset ⊆ dsd _ set (dset ) ∧ rset ⊆ session _ roles( session) ∪ {role} ⇒| rset | < dsd _ card (dset )session _ roles ′ = session _ roles \ {session  session _ roles( session)} ∪{session  ( session _ roles( session) ∪ {role})} 
6.4.2.3

Review Functions for DSD Relations with General Role Hierarchies

All functions of 6.4.1.3 and 6.2.1.3 remain valid.
6.4.2.4

Advanced Review Functions for DSD Relations with General Role Hierarchies

All functions of 6.2.1.4 remain valid.
6.4.3

6.4.3.1

DSD Relations with Limited Role Hierarchies

Administrative Commands for DSD Relations with Limited Role Hierarchies

All functions of 6.2.2 and 6.4.1.1 remain valid.
6.4.3.2

Supporting System Functions for DSD Relations with Limited Role Hierarchies

All functions of 6.4.2.2 remain valid.
34

ANSI INCITS 359-2004

6.4.3.3

Review Functions for DSD Relations with Limited Role Hierarchies

All functions of 6.4.2.3 remain valid.
6.4.3.4

Advanced Review Functions for DSD Relations with Limited Role Hierarchies

All functions of 6.2.1.4 remain valid.

35

ANSI INCITS 359-2004

A

FUNCTIONAL SPECIFICATION OVERVIEWThis annex provides an overview of the specifications for each of the components definedin the previous section. In Section 3, RBAC was defined as four Model Components interms of an abstract set of element sets, relations, and administrative queries. In thisannex, the abstract model concepts are cast into functional specifications foradministrative operations, session management, and administrative review. The RBAC
Functional specification outlines the semantics of the various functions that are requiredfor creation and maintenance of the RBAC Model components (element sets andrelations), as well as supporting system functions.
The three categories of functions in the RBAC functional specification and their purpose
are:
•
•
•

Administrative Functions: Creation and maintenance of elements sets andrelations for building the various component RBAC models;Supporting System Functions: Functions that are required by the RBAC
implementation to support the RBAC model constructs (e.g., RBAC session
attributes and access decision logic) during user interaction with an IT system;
Review Functions: Review the results of the actions created by administrative
functions.

A complete specification of these functions using the Z notation is given in Section 6.
Each section in annex A provides an overview of the correspondingly numbered
subsection in Section 6 (e.g., 6.1.2 summarizes 7.1.2.) Function descriptions in Section
6 are intended to provide a level of detail sufficient for evaluating RBAC
implementations for conformance with the RBAC Reference Model.
A.1
A.1.1

Functional specification for Core RBAC
Administrative Functions

Creation and Maintenance of Element Sets: The basic element sets in Core RBAC are
USERS, ROLES, OPS and OBS. Of these element sets, OPS and OBS are considered
predefined by the underlying information system for which RBAC is deployed. For
example, a banking system may have predefined transactions (OPS) for savings deposit
and others, and predefined data sets (OBS) such as savings files, address files, and othernecessary data. Administrators create and delete USERS and ROLES, and establish
relationships between roles and existing operations and objects. Required administrative
functions for USERS are AddUser and DeleteUser, and for ROLES are AddRole andDeleteRole.
Creation and Maintenance of Relations: The two main relations of Core RBAC are (a)user-to-role assignment relation (UA) and (b) permission-to-role assignment relation(PA). Functions to create and delete instances of User-to-Role Assignment (UA) relations
are AssignUser and DeassignUser. For Permission-to-Role Assignment (PA) therequired functions are GrantPermission and RevokePermission.

36

ANSI INCITS 359-2004

A.1.2

Supporting System Functions

Supporting System Functions are required for session management and in making access
control decisions. An Active Role is necessary for regulating access control for a user ina session. The function that creates a session establishes a default set of active roles forthe user at the start of the session. The composition of this default set can then be alteredby the user during the session by adding or deleting roles. Functions relating to additionand dropping of active roles and other auxiliary functions are given below:
•
•
•
•
A.1.3

CreateSession: Creates a User Session and provides the user with a default set of
active roles
AddActiveRole: Adds a role as an active role for the current session
DropActiveRole: Deletes a role from the active role set for the current session
CheckAccess: Determines if the session subject has permission to perform therequested operation on an object.
Review Functions

When User-to-Role Assignment (UA) and Permission-to-Role relation (PA) instances
have been created, it should be possible to view the contents of those relations from boththe user and role perspectives. For example, from the UA relation, the administrator
should have the facility to view all the users assigned to a given role as well to view all
the roles assigned to a given user. In addition, it should be possible to view the results ofthe supporting system functions to determine some session attributes – like the activeroles in a given session, the total permission domain for a given session. Since not all
RBAC implementations provide facilities for viewing role, user and session permissions
or active roles for a session, these functions have been designated as optional/advancefunctions in this specification. Mandatory (M) and Optional (O) review functions are:
•
•
•
•
•
•
•
•

AssignedUsers (M): Returns the set of users assigned to a given role
AssignedRoles (M): Returns the set of roles assigned to a given user
RolePermissions (O): Returns the set of permissions granted to a given role
UserPermissions (O): Returns the set of permissions a given user gets throughhis/her assigned roles
SessionRoles(O): Returns the set of active roles associated with a session
SessionPermissions (O): Returns the set of permissions available in the session(i.e., union of all permissions assigned to session’s active roles)
RoleOperationsOnObject (O): Returns the set of operations a given role may
perform on a given object
UserOperationsOnObject (O): Returns the set of operations a given user may
perform on a given object (obtained either directly or through his/her assigned
roles)37

ANSI INCITS 359-2004

A.2

Functional specification for Hierarchical RBAC

A.2.1

Hierarchical Administrative Functions

The administrative functions required for hierarchical RBAC include all theadministrative functions that were required for Core RBAC. However, the semantics for
DeassignUser must be redefined because the presence of role hierarchies gives rise to theconcept of authorized roles for a user. In other words, a user may inherit authorization
for a role even if he or she is not directly assigned to the role. The hierarchy allows users
to inherit permissions from roles that are junior to their assigned roles. An important
issue is whether a user can only be deassigned from a role that was directly assigned tothe user or can be deassigned from one of the (indirectly) authorized roles. The
appropriate course of action is left as an implementation issue and is not prescribed inthis specification.
The additional administrative functions required for the Hierarchical RBAC model
pertain to creation and maintenance of the partial order relation (RH) among roles. The
operations for a partial order involve either: (a) creating (or deleting) an inheritance
relationship among two existing roles in a role set or (b) adding a newly created role at an
appropriate position in the hierarchy by making it the ascendant or descendant role of ananother role in the existing hierarchy. The name and purpose of these functions are
summarized below:••••

AddInheritance: Establish a new immediate inheritance relationship between two
existing roles
DeleteInheritance: Delete an existing immediate inheritance relationship between
two roles
AddAscendant: Create a new role and add it as an immediate ascendant of an
existing role
AddDescendant: Create a new role and add it as an immediate descendant of an
existing role

The model provides for both general and limited hierarchies. A general hierarchy allows
multiple inheritance, while a limited hierarchy is essentially a tree (or inverted tree)
structure. For a limited hierarchy, the AddInheritance function is constrained to a single
ascendant (or descendent) role.
The outcome of DeleteInheritance function may result in multiple scenarios. When
DeleteInheritance is invoked with two given roles, say Role A and Role B, theimplementation system is required to do one of two things: (1) The system may preserve
the implicit inheritance relationships that roles A and B have with other roles in thehierarchy. That is, if role A inherits other roles, say C and D, through role B, role A will
maintain permissions for C and D after the relationship with role B is deleted; (2) A
second option is to break those relationships because an inheritance relationship nolonger exists between Role A and Role B. The question of which semantics theDeleteInheritance should carry is left as an implementation issue and is not prescribed inthis specification.

38

ANSI INCITS 359-2004

A.2.2

Supporting System Functions

The Supporting System Functions for Hierarchical RBAC are the same as for Core
RBAC and provide the same functionality. However, because of the presence of a role
hierarchy, the functions CreateSession and AddActiveRole have to be redefined. In a role
hierarchy, a given role may inherit one or more of other roles. When that given role isactivated by a user, the question of whether the inherited roles are automatically activatedor must be explicitly activated is left as an implementation issue and no one course ofaction is prescribed as part of this specification. However, when the latter scenario is
implemented (i.e. explicit activation) the corresponding supporting functionality shall be
provided in the supporting system functions. For example, in the case of CreateSessionfunction, the active role set created as a result of the new session shall include not only
roles directly assigned to a user but also some or all of the roles inherited by those“directly assigned roles” (that were previously included in the default Active Role Set) as
well. Similarly, in the AddActiveRole function, a user can activate a directly assignedrole or one or more of the roles inherited by the “directly assigned role”.
A.2.3

Review Functions

All the review functions specified for Core RBAC remain valid for Hierarchical RBAC
as well. In addition, since the user membership set for a given role includes not only users
directly assigned to that given role but also those users assigned to roles that inherit thegiven role. Analogously the role membership set for a given user includes not only roles
directly assigned to the given user but also those roles inherited by the directly assigned
roles. To capture this expanded “User Memberships for Roles” and “Role Memberships
for a User” the following functions are defined:••

AuthorizedUsers: Returns the set of users directly assigned to a given role as wellas those who were members of those “roles that inherited the given role”.
AuthorizedRoles: Returns the set of roles directly assigned to a given user as wellas those “roles that were inherited by the directly assigned roles”.

Because of the presence of partial order among the roles, the permission set for a givenrole includes not only the permissions directly assigned to a given role but also
permissions obtained from the roles that the given role inherited. Consequently, thepermission set for user who is assigned that given role becomes expanded as well. These“Permissions Review” functions are listed below. As already alluded to, since not all
RBAC implementations provide this facility, these are treated as advanced/optional
functions:•••

RolePermissions: Returns the set of all permissions either directly granted to or
inherited by a given role
UserPermissions: Returns the set of permissions of a given user through his/herauthorized roles (sum of directly assigned roles and roles inherited by those roles)
RoleOperationsOnObject: Returns the set of operations a given role may perform
on a given object (obtained either directly or by inheritance)

39

ANSI INCITS 359-2004•

A.3

UserOperationsOnObject: Returns the set of operations a given user may perform
on a given object (obtained directly or through his/her assigned roles or throughroles inherited by those roles)
Functional specification for SSD Relation

A.3.1

Administrative Functions

The administrative functions for an SSD RBAC model without hierarchies shall include
all the administrative functions for Core RBAC. However, since the SSD property relates
to membership of users in conflicting roles, the AssignUser function shall incorporate
functionality to verify and ensure that a given user assignment does not violate theconstraints associated with any instance of an SSD relation.
As already described under the SSD RBAC reference model, an SSD relation consists ofa triplet – (SSD_Set_Name, role_set,SSD_Card). The SSD_Set_Name indicates thetransaction or business process in which common user membership must be restricted inorder to enforce a conflict of interest policy. The role_set is a set containing theconstituent roles for the named SSD relation (and referred to as Named SSD role set).
The SSD_Card designates the cardinality of the subset within the role_set to which
common user memberships must be restricted. Hence, administrative functions relating tocreation and maintenance of an SSD relation are operations that Create and Delete an
instance of an SSD relation, add and delete role members to the role-set parameter of the
SSD relation, as well as to change/set the SSD_Card parameter for the SSD relation.
These functions are summarized below:
•
•
•
•
•

CreateSSDSet: Create a named instance of an SSD relation
DeleteSSDSet: Deletes an existing SSD relation
AddSSDRoleMember: Adds a role to a named SSD role set
DeleteSSDRoleMember: Deletes a role from a named SSD role set
SetSSDCardinality: Sets the cardinality of the subset of roles from named SSD
role set for which common user membership restriction applies

For the case of SSD RBAC models with role hierarchies (both General Role Hierarchies
and Limited Role Hierarchies), the above functions produce the same end-result with one
exception: constraints governing the combination of role hierarchies and SSD relations
shall be enforced when these functions are invoked. For example, roles within ahierarchical chain cannot be made members of a role set in an SSD relation.
A.3.2

Supporting System Functions

The Supporting System Functions for an SSD RBAC Model are the same as those for theCore RBAC Model.

40

ANSI INCITS 359-2004

A.3.3

Review Functions

All the review functions for Core RBAC model are needed for implementation of SSD
RABC model. In addition, functions to view the results of administrative functions listed
in 4.3.1 shall also be provided. These include: (a) a function to reveal the set of named
SSD relations created, (b) a function that returns the set of roles associated with a named
SSD role set, and (c) a function that gives the cardinality of the subset within the named
SSD role set for which common user membership restriction applies.
•
•
•
A.4

SSDRoleSets: Returns the set of named SSD relations created for the SSD RBAC
model
SSDRoleSetRoles: Returns the set of roles associated with a named SSD role set
SSDRoleSetCardinality: Returns the cardinality of the subset within the named
SSD role set for which common user membership restriction applies
Functional specification for DSD Relation

A.4.1

Administrative Functions

The semantics of creating an instance of DSD relation are identical to that of an SSD
relation. While constraints associated with an SSD relation are enforced during user
assignments (as well as while creating role hierarchies), the constraints associated with
DSD are enforced only at the time of role activation within a user session. The list ofadministrative functions that shall be provided for DSD RBAC model and their purpose
are listed below:
•
•
•
•
•
A.4.2

CreateDSDSet: Create a named instance of DSD relation
DeleteDSDSet: Deletes an existing DSD relation
AddDSDRoleMember: Adds a role to a named DSD role set
DeleteDSDRoleMember: Deletes a role from a named DSD role set
SetDSDCardinality: Sets the cardinality of the subset of roles from named DSD
role set for which user activation restriction within the same session applies
Supporting System Functions

Recall from 4.1.2 that the supporting system functions for Core RBAC are: (a)CreateSession, (b) AddActiveRole, and (c) DeleteActiveRole. These system functions
shall be available for a DSD RBAC model implementation without role hierarchies aswell. However, the additional functionality required of these functions in the DSD RBAC
model context is that they should enforce the DSD constraints. For example, during the
invocation of the CreateSession function, the default active role set that is madeavailable to the user should not violate any of the DSD constraints. Similarly, theAddActiveRole function shall check and prevent the addition of any active role to thesession’s active role set that violates any of the DSD constraints.
The semantics of the Supporting System Functions for a DSD RBAC Model with role
hierarchies (both General Role Hierarchy and Limited Role Hierarchy) are the same as
those for corresponding functions for hierarchical RBAC in 4.2.2.

41

ANSI INCITS 359-2004

•
•
•
A.4.3

CreateSession: Creates a User Session and provides the user with a default set of
active roles
AddActiveRole: Adds a role as an active role for the current session
DropActiveRole: Deletes a role from the active role set for the current session
Review Functions

All the review functions for Core RBAC model are needed for implementation of DSD
RABC model. In addition, functions to view the results of administrative functions listed
in 4.4.1 shall also be provided. These include: (a) a function to reveal the set of named
DSD relations created, (b) a function that returns the set of roles associated with a named
DSD role set and (c) a function that gives the cardinality of the subset within the named
DSD role set for which common user membership restriction applies.
•
•
•

A.5

DSDRoleSets: Returns the set of named SSD relations created for the DSD RBAC
model
DSDRoleSetRoles: Returns the set of roles associated with a named DSD role set
DSDRoleSetCardinality: Returns the cardinality of the subset within the named
DSD role set for which user activation restriction within the same session applies
Functional Specification Packages

As eluded in section 1, RBAC is a technology that provides a diverse set of access
control management features. In a categorization of these features, Section 4 defined afamily of four functional components to include Core RBAC, Hierarchical RBAC, Static
Separation of Duty Relations, and Dynamic Separation of Duty Relations. Eachfunctional component includes three sections—administrative operations for the creationand maintenance of RBAC sets and relations, administrative review functions, andsystem level functions for the binding of roles to a user’s session and making access
control decisions.
This section describes a logical approach for defining packages of functional
components, where each package may pertain to a different threat environment and/or
market segment. The basic concept is that each component can optionally be selected forinclusion into a package with one exception—Core RBAC must be included as a part ofall packages. In selecting components, the reader is referred to section 2 for a rationale ofeach component. Also, see Figure A.1 for an overview of the methodology for composing
functional packages.

42

ANSI INCITS 359-2004

Select Core RBAC
Option: Advanced Review
Core RBAC

Choose a. or b
Option: Advanced Review
Hier. RBAC
a. Limitedb. General

Adhere to dependency
SSD Relations
a. w/hierarchies
b. wo/hierarchies

Re
Pa quick remag
e entsDSD Relations

Figure A.1: Methodology for creating functional packages

In defining functional packages, Core RBAC is unique in that it is fundamental and must
be included in all packages. As such, any package must begin with the selection of Core
RBAC. Core RBAC includes an advanced review feature that may be optionally selected.
For some environments, the selection of the single Core RBAC component may besufficient.
Hierarchical RBAC includes two subcomponents—General Role Hierarchies and Limited
Role Hierarchies. If Hierarchical RBAC is selected to be included in a package then achoice must be made as to which of these subcomponents is to be included. Like Core
RBAC, Hierarchical RBAC includes an advanced review feature that may be optionallyselected.
The Static Separation of Duty Relations component also includes two subcomponents—
Static Separation of Duty Relations and Static Separation of Duty Relations in the
Presence of a Hierarchy. If this component is selected for inclusion in a package then adependency relation must be recognized. That is, if the package includes a Hierarchical
RBAC component then Static Separation of Duty Relations in the Presence of a
Hierarchy must be included in the package; otherwise the Static Separation of Duty
Relations subcomponent must be selected.
The final component is Dynamic Separation of Duty Relations. This component does notinclude any options or dependency relations other than with Core RBAC.

43

ANSI INCITS 359-2004

B

RATIONALE (INFORMATIVE)

This RBAC standard is organized into two main parts—the RBAC Reference Model andthe RBAC Functional Specifications. The RBAC Reference Model provides a rigorous
definition of RBAC sets and relations. The Reference Model has two primaryobjectives—to define a common vocabulary of terms for use in consistently specifying
requirements and to set the scope of the RBAC features included in the standard. The
RBAC Functional Specification defines functions over administrative operations for thecreation and maintenance of RBAC element sets and relations; administrative review
functions for performing administrative queries; and system functions for creating andmanaging RBAC attributes on user sessions and making access control decisions
The RBAC model and functional specification are organized into four RBAC
components, as described below. A rationale for each of these components is also
provided
B.1

Core RBAC

Core RBAC embodies the essential aspects of RBAC. The basic concept of RBAC is thatusers are assigned to roles, permissions are assigned to roles and users acquire
permissions by being members of roles. Core RBAC includes functions that user-role andpermission-role assignment can be many-to-many. Thus, the same user can be assigned tomany roles and a single role can have many users. Similarly, for permissions, a single
permission can be assigned to many roles and a single role can be assigned to many
permissions. Core RBAC includes functions for user-role review whereby the roles
assigned to a specific user can be determined as well as users assigned to a specific role.
A similar function for permission-role review is included as an advanced review function.
Finally, core RBAC requires that users can simultaneously exercise permissions ofmultiple roles. This precludes products that restrict users to activation of one role at atime.
Rationale. Core RBAC captures the features of traditional group-based access control as
implemented in operating systems through the current generation. As such, it is widely
deployed and familiar technology. The features required of core RBAC are essential for
any form of RBAC. The main issue in defining core RBAC is to determine whichfeatures to exclude. This standard has deliberately kept a very minimal set of features incore RBAC. In particular, these features accommodate traditional but robust group-based
access control. Not every group-based mechanism qualifies because of the specifications
given above. One of the features omitted as mandatory for core RBAC is permission role
review. Although highly desirable, many well-accepted RBAC systems do not provide
this feature.

44

ANSI INCITS 359-2004

B.2 Hierarchical RBAC
Hierarchical RBAC adds functions for supporting role hierarchies. A hierarchy ismathematically a partial order defining a seniority relation between roles, whereby senior
roles acquire the permissions of their juniors, and junior roles acquire the user
membership of their seniors. This standard recognizes two types of role hierarchies.
•

General Hierarchical RBAC
In this case, there is support for an arbitrary partial order to serve as the role
hierarchy, to include the concept of multiple inheritance of permissions and user
membership among roles.

•

Limited Hierarchical RBAC
Some systems may impose restrictions on the role hierarchy. Most commonly,
hierarchies are limited to simple structures such as trees or inverted trees.

Rationale. Roles can have overlapping capabilities, that is, users belonging to different
roles may be assigned common permissions. Furthermore, within many organizations
there are a number of general permissions that are performed by a large number of users.
As such, it would prove inefficient and administratively cumbersome to specify
repeatedly their general permission-role assignments. To improve efficiency and support
organizational structure, RBAC models as well as commercial implementations include
the concept of role hierarchies. Role hierarchies in the form of an arbitrary partial
ordering are arguably the single most desirable feature in addition to core RBAC. Thisfeature has often been mentioned in the literature and has precedence in existing RBAC
implementations. Justification for requiring the transitive, reflexive and antisymmetricproperties of a partial order has been extensively discussed in the literature. There is astrong consensus on this issue. Nevertheless, there are a number of products that support
only restricted hierarchies, which provide substantially improved capabilities beyond core
RBAC.
B.3

Static Separation of Duty Relations

Separation of duty relations are used to enforce conflict of interest policies. Conflict ofinterest in a role-based system may arise as a result of a user gaining authorization for
permissions associated with conflicting roles. One means of preventing this form ofconflict of interest is though static separation of duty, that is, to enforce constraints on theassignment of users to roles. An example of such a static constraint is the requirementthat two roles be mutually exclusive; e.g., if one role requests expenditures and anotherapproves them, the organization may prohibit the same user from being assigned to bothroles. The SSD policy can be centrally specified and then uniformly imposed on specificroles. Because of the potential for inconsistencies with respect to static separation of
duty relations and inheritance relations of a role hierarchy, SSD specifications are definedin both the presence and absence of role hierarchies.

45

ANSI INCITS 359-2004•

Static Separation of Duty
SSD relations place constraints on the assignments of users to roles. Membershipin one role may prevent the user from being a member of one or more other roles,
depending on the SSD rules enforced.

•

Static Separation of Duty in the Presence of a Hierarchy
This type of SSD relation works in the same way as basic SSD except that bothinherited roles as well as directly assigned roles are considered when enforcing
the constraints.

With respect to the constraints placed on the user-role assignments for defined sets ofroles, SSD is defined as a pair (role set, n) where no user is assigned to n or more roles
from the role set. As such, there exist a variety of SSD policies. For example, a user may
not be assignable to every role in a specified role set, while a strong deployment of thesame feature may restrict a user from being assigned to any combination of two or moreroles in the role set.
Rationale. From a policy perspective, SSD relations provide a powerful means ofenforcing conflict of interest and other separation rules over sets of RBAC elements.
Static constraints generally place restrictions on administrative operations that have thepotential to undermine higher-level organizational Separation of Duty policies.
Static constraints can take on a wide variety of forms. A common example is that of
Static Separation of Duty (SSD), which defines mutually disjoint user assignments withrespect to sets of roles. However, static constraints have been shown to be a powerfulmeans of implementing a number of other important separation of duty policies. The
static constraints defined in this standard are limited to those relations that place
restrictions on sets of roles and in particular on their ability to form user-role assignment
relations.
B.4

Dynamic Separation of Duty Relations

Dynamic separation of duty (DSD) relations, like SSD relations, limit the permissions
that are available to a user. However, DSD relations differ from SSD relations by thecontext in which these limitations are imposed. DSD specifications limit the availabilityof the permissions by placing constraints on the roles that can be activated within or
across a user’s sessions.
Similar to SSD relations DSD relations define constraints as a pair (role set, n) where n isa natural number ZLWKWKHSURSHUW\WKDWQRXVHUVHVVLRQPD\DFWLYDWHn or more roles
from the role set.
Rationale. DSD properties provide extended support for the principle of least privilege inthat each user has different levels of permission at different times, depending on the task
being performed. This ensures that permissions do not persist beyond the time that they46

ANSI INCITS 359-2004

are required for performance of duty. This aspect of least privilege is often referred to as
timely revocation of trust. Dynamic revocation of permissions can be a complex issue
without the facilities of dynamic separation of duty, and as such, it has been generally
ignored in the past for reasons of expediency.
SSD provides the capability to address potential conflict-of-interest issues at the time auser is assigned to a role. DSD allows a user to be authorized for roles that do not cause aconflict of interest when acted in independently, but which produce policy concerns when
activated simultaneously. Although this separation of duty could be achieved through theestablishment of a static separation of duty relationship, DSD relationships generally
provide the enterprise with greater operational flexibility.

47