## 3 Proposed Method
### Satisfying Separation-of-Duty Constraints
#### Correctness Analysis  
**Statement 1.**_Given an \(m\)-\(m\) RSSOD constraint \(e_{1}\), \(t\)-\(m\) SMER constraint \(c_{1}\) can precisely enforce \(e_{1}\) if and only if \(t=2\)._  
**Proof.** We analyze the statement from the two sides of sufficiency and necessity.  
Sufficiency. When constraint \(c_{1}\)=_smer_\(<\){\(r_{1}\),\(r_{2}\),... \(r_{m}\)},2\(>\) holds, that is,\(\forall u\in U:\left\lceil\mathit{Roles}(u)\cap\{r_{1},r_{2},\ldots r_{m}\} \right\rceil<2\), this indicates that at least \(m\) users are required together to have all roles of set \(\{r_{1}\),\(r_{2}\),... \(r_{m}\)}. Any set of (\(m\)-1) users should not be able to have all \(m\) roles, that is, \(\forall(u_{1},u_{2},\ldots u_{m-1})\in U:\cup_{i=1}^{m-1}\mathit{Roles}(u_{i}) \{r_{1},r_{2},\ldots r_{m}\}\). According to RSSOD, \(c_{1}\) can enforce \(e_{1}\).  
Necessity. It is proved by contradiction. Assume that there exist \((m-1)\) users who can cover all the \(m\) roles, that is, \(\exists(u_{1},u_{2},\ldots u_{m-1})\in U:\cup_{i=1}^{m-1}\mathit{Roles}(u_{i}) \supseteq\{r_{1},r_{2},\ldots r_{m}\}\). In other words, there exists some user who has two of the \(n\) roles, that is, \(\exists u\in U:\left\lceil\mathit{Roles}(u)\cap\{r_{1},r_{2},\ldots r_{m}\} \right\rceil=2\), which is contradictory to constraint _smer_\(<\){\(r_{1}\),\(r_{2}\),... \(r_{m}\)},2\(>\). Thus, the assumption is false. \(\Box\)  
**Statement 2.**_Given a \(2\)-\(m\) RSSOD constraint \(e_{2}\), \(t\)-\(m\) SMER constraint \(c_{2}\) can precisely enforce \(e_{2}\) if and only if \(t=m\)._  
**Proof.** We also analyze the statement from the two sides of sufficiency and necessity.  
Sufficiency. When constraint \(c_{2}\)=_smer_\(<\){\(r_{1}\),\(r_{2}\),... \(r_{m}\)},\(m\)\(>\) holds, that is, \(\forall u\in U:\left\lceil\mathit{Roles}(u)\cap\{r_{1},r_{2},\ldots r_{m}\} \right\rceil<m\), this indicates that no user has all roles of the set \(\{r_{1}\),\(r_{2}\),... \(r_{m}\)}. In other words, at least two users are required together to have all the \(m\) roles. According to RSSOD, \(c_{2}\) can enforce \(e_{2}\).  
Necessity. It is proved by contradiction. Assume that there exists some user who has all the \(m\) roles, that is, \(\exists u\in U:\left\lceil\mathit{Roles}(u)\cap\{r_{1},r_{2},\ldots r_{m}\} \right\rceil=m\), which is contradictory to the constraint _smer_\(<\){\(r_{1}\),\(r_{2}\),... \(r_{m}\)},\(m\)\(>\). Thus, the assumption is false. \(\Box\)  
**Theorem 1.**_Given a \(k\)-\(n\) RSSOD constraint (\(k>2\)) and a candidate role set \(CR\), where \(k\leq n\leq|CR|\), \(t\)-\(m\) SMER constraints constructed by our algorithms can precisely enforce \(k\)-\(n\) RSSOD if \(t\leq\left(\left\lfloor\frac{n-1}{k-1}\right\rfloor+1\right)\)._Proof.: According to Definition 1, any user has \((t-1)\) roles at most, and any \((k-1)\) users have \((k-1)\)\(\times(t-1)\) roles at most. It is also proved by contradiction. Without loss of generality, \(t\)=\(\left(\begin{bmatrix}\frac{n-1}{k-1}\end{bmatrix}+1+1\right)\), we assume that the RSSOD constraint holds, that is, the number of roles assigned to \((k-1)\) users is \((k-1)\times\left(\left\lfloor\frac{n-1}{k-1}\right\rfloor+2-1\right)\approx n-1+ k-1=n+k-2>n\), which breaches the \(k\)-\(n\) RSSOD. Thus, the assumption is false and the theorem is proved.  
**Example 1**.: _Constructing \(t\)-m SMER constraints based on our method can enforce rssod<\(t\)r\({}_{1}\),\(r\)\({}_{2}\),\(r\)\({}_{3}\),\(r\)\({}_{4}\),\(r\)\({}_{5}\)],\(k\)\(>\) with different \(k\) in Table 2, where 2\(\leq\) k\(\leq\) 5._