January 14, 2014 Outline

Reading: text, § 2
  1. Access control matrix and entities
    1. Subject, objects (includes subjects)
    2. State is (S, O, A) where A is access control matrix
    3. Rights (represent abstract notions)
  2. Instantiating access control matrices
    1. Example 1: UNIX file system
      1. read, write, execute on files
      2. read, write, execute on directories
    2. Example 2: Boolean expression evaluation
      1. Verbs and rules
      2. Access Restriction Facility
    3. Example 3: History and limiting rights
  3. Primitive operations
    1. enter r into A[s, o]
    2. delete r from A[s, o]
    3. create subject s (note that ∀ x [ A[s′, x] = A[x, s′] = ∅ ])
    4. create object o (note that ∀ x [ A[x, o′] = ∅ ])
    5. destroy subject s
    6. destroy object o
  4. Commands and examples
    1. Regular command: create•file
    2. Mono-operational command: make•owner
    3. Conditional command: grant•rights
    4. Biconditional command: grant•read•if•r•and•c
    5. Doing “or” of 2 conditions: grant•read•if•r•or•c
    6. General form
  5. Miscellaneous points
    1. Copy flag and right
    2. Own as a distinguished right
    3. Principle of attenuation of privilege
  6. What is the safety question?
    1. An unauthorized state is one in which a generic right r could be leaked into an entry in the ACM that did not previously contain r. An initial state is safe for r if it cannot lead to a state in which r could be leaked.
    2. Question: in a given arbitrary protection system, is safety decidable?
  7. Mono-operational case: there is an algorithm that decides whether a given mono-operational system and initial state is safe for a given generic right.

You can also obtain a PDF version of this. Version of January 12, 2014 at 4:23PM