Verification of Dynamic Separation of Duty Policy for Role-based Business Processes

Separation of duty (SoD) is a widely used security principle to help prevent frauds in a business process. Though SoD has been studied by many researchers, most of them are concerned with specifications of various types of SoD constraints for policy enforcement. For large organizations that employ SoD policies, the ability to automatically verify if a given user-role assignment complies with SoD policies is of the great value for security management. This paper proposes an algorithm for constraint checking of simple dynamic SoD. Unlike most previous work that enforces SoD policy at run time (when roles are activated), our approach examines policy enforcement build-time (prior to run rime, i.e. when roles are assigned to users but not activated).