- Title
- SoDA : a model for the administration of separation of duty requirements in workflow systems
- Creator
- Perelson, Stephen
- Subject
- Electronic data processing departments -- Security measures
- Subject
- Computers -- Access control
- Date Issued
- 2001
- Date
- 2001
- Type
- Thesis
- Type
- Masters
- Type
- MTech (Information Technology)
- Identifier
- vital:10796
- Identifier
- http://hdl.handle.net/10948/68
- Identifier
- Electronic data processing departments -- Security measures
- Identifier
- Computers -- Access control
- Description
- The increasing reliance on information technology to support business processes has emphasised the need for information security mechanisms. This, however, has resulted in an ever-increasing workload in terms of security administration. Security administration encompasses the activity of ensuring the correct enforcement of access control within an organisation. Access rights and their allocation are dictated by the security policies within an organisation. As such, security administration can be seen as a policybased approach. Policy-based approaches promise to lighten the workload of security administrators. Separation of duties is one of the principles cited as a criterion when setting up these policy-based mechanisms. Different types of separation of duty policies exist. They can be categorised into policies that can be enforced at administration time, viz. static separation of duty requirements and policies that can be enforced only at execution time, viz. dynamic separation of duty requirements. This dissertation deals with the specification of both static separation of duty requirements and dynamic separation of duty requirements in role-based workflow environments. It proposes a model for the specification of separation of duty requirements, the expressions of which are based on set theory. The model focuses, furthermore, on the enforcement of static separation of duty. The enforcement of static separation of duty requirements is modelled in terms of invariant conditions. The invariant conditions specify restrictions upon the elements allowed in the sets representing access control requirements. The sets are themselves expressed as database tables within a relational database management system. Algorithms that stipulate how to verify the additions or deletions of elements within these sets can then be performed within the database management system. A prototype was developed in order to demonstrate the concepts of this model. This prototype helps demonstrate how the proposed model could function and flaunts its effectiveness.
- Format
- 139 leaves
- Format
- Publisher
- Port Elizabeth Technikon
- Publisher
- Faculty of Computer Studies
- Language
- English
- Rights
- Nelson Mandela Metropolitan University
- Hits: 643
- Visitors: 726
- Downloads: 99
Collections
PET Faculty of Computer Science
| Thumbnail | File | Description | Size | Format | |||
|---|---|---|---|---|---|---|---|
| View Details Download | SOURCEPDF | 837 KB | Adobe Acrobat PDF | View Details Download |