Safety and Availability Checking for User Authorization Queries in RBAC

This paper introduces the notion of safety and availability checking for user authorization query processing, and develop a recursive algorithm use the ideas from backtracking-based search techniques to search for the optimal solution. For the availability checking, we introduce the notion of max activatable set (MAS), and show formally how MAS can be determined in a hybrid role hierarchy. For the safety checking, we give a formal definition of dynamic separation-of-duty (DSoD) policies, and show how to reduce the safety checking for DSoD to a SAT instance.