Abstract Security policies play an important role in today's computer systems. We show some severe limitations of the widespread standard role-based access control (RBAC) model, namely that object-based dynamic separation of duty as in- Role-based access control (RBAC) [18, 1, 2, 9] has received considerable attention as a promising alternative to traditional discretionary and mandatory access control. Moreover, an extensive field study by the National Institute of Standards and Technology (NIST) pointed out that in practice permissions are assigned to users according to their roles/functions in the organization [8] . The explicit representation of roles greatly simplifies the security management and makes possible to use security principles like separation of duty and least privilege [18] . In the following, we give an overview of RBAC96, a widespread RBAC model introduced by Sandhu et al. [18] . In Figures 1 and 2 the entity sets of RBAC96 and the relationships between them are shown. A further important concept of the advanced RBAC96 models are constraints on the relations assigned to, auth, active in, etc. With help of these constraints, separation of duty (SOD) can be enforced. SOD is a well-known principle that prevents fraud and error by requiring that at least two persons are required to complete a task. SOD is often applied in everyday life, e.g., a paper submitted to a conference typically is required to be reviewed by three referees who must be different from the author. There are several attempts to express SOD constraints in the computer security world, specifically in the area of banking like the ClarkWilson model [6] or Sandhu's Transaction Control Expressions [17] . Usually, it can be differentiated between static and dynamic SOD. Static SOD means that a user is not permitted to perform certain steps of a task. By contrast, in dynamic SOD a user may carry out those steps, but only if he has not done/does not certain other steps of the task. Thus, dynamic SOD is more flexible than static SOD and hence better satisfies real-world requirements. Usually, RBAC is expressed in set-theoretic notation. When using formal methods, one needs to express RBAC in some definite formalism (like the Z formalism used in [5] ). We here formalize RBAC in many-sorted first-order logic, which also is a well-studied and tool-supported formalism [14] . In the specification given in Fig. 3 , the axiom states that a session may activate a role only if its user is assigned to the role.
For example, REF shows how to express various types of sod constraints in the Role Based Access Control model by using first-order ltl.
A temporal-logic extension of role-based access control covering dynamic separation of duties
10th International Symposium on Temporal Representation and Reasoning, 2003 and Fourth International Conference on Temporal Logic. Proceedings.
10th International Symposium on Temporal Representation and Reasoning, 2003 and Fourth International Conference on Temporal Logic. Proceedings.
Computer Science