Role-based authorization constraints specification

TLDR

Constraints are a key motivation for RBAC yet have received limited attention. The article introduces RCL 2000, an intuitive formal language for specifying role‑based authorization constraints, detailing its basic elements, syntax, and semantics. The authors demonstrate that RCL 2000 can express known constraints such as separation of duty and provide a formal mapping to these concepts. They prove RCL 2000 sound and complete relative to a restricted first‑order logic, identify previously unknown SOD properties, show multiple alternative formulations of basic SOD, and establish a rigorous foundation for systematic study of role‑based authorization constraints.

Abstract

Constraints are an important aspect of role-based access control (RBAC) and are often regarded as one of the principal motivations behind RBAC. Although the importance of contraints in RBAC has been recogni zed for a long time, they have not recieved much attention. In this article, we introduce an intuitive formal language for specifying role-based authorization constraints named RCL 2000 including its basic elements, syntax, and semantics. We give soundness and completeness proofs for RCL 2000 relative to a restricted form of first-order predicate logic. Also, we show how previously identified role-based authorization constraints such as separtation of duty (SOD) can be expressed in our language. Moreover, we show there are other significant SOD properties that have not been previously identified in the literature. Our work shows that there are many alternate formulations of even the simplest SOD properties, with varying degree of flexibility and assurance. Our language provides us a rigorous foundation for systematic study of role-based authorization constraints.