Abstract: Existing user to user role-based delegation models did not solve the problem of delegation conflicts.This paper describes role-based delegation module of RBAC，its properties，constraint rules and supposes a Role-based Constrained Delegation Model（RCDM），its structure and function in the practice，which satisfies the least privilege and separation of duty principles.This paper also presents the delegation constraints specification language RDCL based on RCDM.RCDL is proved equivalent to RFOPL by reduction algorithm and construction algorithm，and the soundness and completeness of RDCL is discussed.Finally，expressions of RCDM are described by RDCL，and the problem of delegation conflicts is solved efficiently.

Key words: Role-Based Access Control（RBAC）, delegation conflicts, constrained rules, Role-based Delegation Constraints Specification Language（RDCL）, Restricted First-Order Predicate Logic（RFOPL）

摘要： 针对现有用户-用户的角色转授权模型存在授权冲突问题，基于转授权的组件、相关性质以及约束规则，提出了一种约束转授权模型，该模型满足最小特权和职责分离两安全原则，给出了该模型的体系架构和功能描述；以此模型为背景介绍了一种约束描述语言及其形式化语义描述；通过规约算法和构造算法论证了它与严格形式上的一阶谓词逻辑是等价的，并对该约束语言的合理性和完整性进行了讨论；最后用该约束语言给出了模型的表现能力，较好的解决了转授权冲突问题。

关键词: 基于角色的访问控制, 转授权冲突, 约束规则, 约束描述语言, 一阶谓词逻辑