关键词: 访问控制, 安全策略, 风险

Abstract: Separation of duty is an extremely important and widely used security policy，which requires a sensitive task to be performed by a team of at least k users.However，current literatures do not capture the requirements of detailed qualification analysis on users involved in the task.Here，Role Based Access Control（RBAC） systems are focused on，and a novel risk-based Fuzzy Security Policy（FSP） is introduced based on the authorization risk resulted by user-role assignments.The risk-level vector is adopted to quantify such risk and the method of calculating the risk aggregation for multiple users performing multiple tasks is also presented.By using fuzzy comprehensive evaluation method，the FSP satisfiability problem under a given system configuration and an acceptable risk threshold is discussed.The corresponding algorithm is presented as well.This security policy will help to select suitable users to perform the task for an organization.

Key words: access control, security policy, risk