Outline for April 12, 2005

TakeGrant

Introduce as counterpoint to HRU result

Show symmetry

Show islands (maximal subjectonly tgconnected subgraphs)

Show bridges (as a combination of terminal and initial spans)

Predicates

can·share(r, x, y, G_{0}) iff there is an edge from x to y labelled r in G_{0}, or all of the following hold:

there is a vertex y′ with an edge from y′ to y labelled r;

there is a subject y′′ which terminally spans to y′, or y′′ = y′;

there is a subject x′ which initially spans to x, or x′ = x; and

there is a sequence of islands I_{1}, ..., I_{n} connected by bridges for which x′ is in I_{1} and y′ is in I_{n}.

Go through interpretation

Schematic Protection Model

Model components

Link function

Filter function

Example: TakeGrant as an instance of SPM

Create operations and attenuation

Expressive power

HRU vs. SPM

Multiparent joint creates in HRU

Adding multiparent joint creates to SPM (giving ESPM)

Simulation of multiparent joint creates by 2parent joint creates

Monotonic ESPM, monotonic HRU equivalent

Safety question in ESPM decidable if acyclic attenuating scheme

Comparing Expressive Power of Models

Graph representation

Go through 3parent joint create as simulated by 2parent joint create

Correspondence between two schemes in terms of graph representation

Formal definition of scheme A simulating scheme B

Model expressive power

Result: monotonic 1parent models less expressive than monotonic multiparent models (so ESPM more expressive than SPM)

Typed Access Matrix Model

Add notion of type for entitiesset of types T, set of subject types TS ⊆ T

New create rules: specify subject/object type

In command, child type if something of that type created; otherwise, a parent type

Show type graph and cycles in it

Safety decidable for systems with acyclic MTAM schemes
Here is a PDF version of this document.