April 1, 2026 Outline

Reading: text, §3.1–3.3; [1,2,3]
Assignments: Homework #1, due April 10; Project selection, due April 17

Attribute-Based Access Control Matrix
1. Attributes
2. Predicates
3. Modified primitive operations
4. Commands
What is the safety question?
1. An unauthorized state is one in which a generic right r could be leaked into an entry in the ACM that did not previously contain r. An initial state is safe for r if it cannot lead to a state in which r could be leaked.
2. Question: in a given arbitrary protection system, is safety decidable?
Mono-operational case: there is an algorithm that decides whether a given mono-operational system and initial state is safe for a given generic right.
General case: It is undecidable whether a given state of a given protection system is safe for a given generic right.
1. Approach: represent Turing machine tape as access control matrix, transitions as commands
2. Reduce halting problem to it
Related results
1. The set of unsafe systems is recursively enumerable
2. Monotonicity: no delete or destroy primitive operations
3. The safety question for biconditional monotonic protection systems is undecidable.
4. The safety question for monoconditional monotonic protection systems is decidable.
5. The safety question for monoconditional protection systems without the destroy primitive operation is decidable.
Take-Grant Protection Model
1. Counterpoint to HRU result
2. Symmetry of take and grant rights
3. Islands (maximal subject-only tg-connected subgraphs)
4. Bridges (as a combination of terminal and initial spans)
Sharing
1. Definition: can•share(α, x, y, G₀) true iff there exists a sequence of protection graphs G₀, …, G_n such that G₀ ⊢^* G_n using only take, grant, create, remove rules and in G_n, there is an edge from x to y labeled α
2. Theorem: can•share(α, x, y, G₀) iff there is an edge from x to y labeled α in G₀, or all of the following hold:
  1. there is a vertex y′ with an edge from y′ to y labeled α;
  2. there is a subject y′′ which terminally spans to y′, or y′′ = y′;
  3. there is a subject x′ which initially spans to x, or x′ = x; and
  4. there is a sequence of islands I₁, …, I_n connected by bridges for which x′ ∈ I₁ and y′ ∈ I_n.
Model Interpretation
1. ACM very general, broadly applicable; Take-Grant more specific, can model fewer situations
2. Example: shared buffer managed by trusted third party
can•steal(α, x, y, G₀) definition and theorem
1. Definition: can•steal(α, x, y, G₀) true iff there is no edge labeled α from x to y in G₀ and there exists a sequence of protection graphs G₀, …, G_n such that the following hold simultaneously:
  1. there is an edge from x to y labeled r in G_n;
  2. there is a sequence of rule applications ρ₁, …, ρ_n such that G_i-1 ⊢_* G_i using ρ_i; and
  3. for all vertices v and w in G_i-1, 1 ≤ i < n, if there is an edge from v to y in G₀ labeled α, then ρ_i is not of the form “v grants (α to y) to w”.
2. Theorem: can•steal(α, x, y, G₀) iff all of the following hold:
  1. there is an edge from x to y labeled r in G_n;
  2. there is a subject vertex x′ such that x′ = x or x′ initially spans to x; and
  3. there is a vertex s with an edge labeled α to y in G₀ and for which can•share(t, x, s, G₀) holds.

References

X. Zhang, Y. Li, and D. Nalla, “An Attribute-Based Access Control Matrix Model,” Proceedings of the 2005 ACM Symposium on Applied Computing pp. 359–363 (Mar. 2005); DOI: 10.1145/1066677.1066760.
M. Tripunitara and N. Li, “The Foundational Work of Harrison-Ruzzo-Ullman Revisited,” IEEE Transactions on Dependable and Secure Computing 10(1) pp. 280–309 (Jan. 2013); DOI: 10.1109/TDSC.2012.77.
M. Bishop, “Conspiracy and Information Flow in the Take-Grant Protection Model,” Journal of Computer Security 4(4) pp. 331–359 (1996); DOI: 10.3233/JCS-1996-4404

Matt Bishop
Office: 2209 Watershed Sciences
Phone: +1 (530) 752-8060
Email: mabishop@ucdavis.edu

ECS 235B, Foundations of Computer and Information Security
Version of March 5, 2026 at 1:04PM

You can also obtain a PDF version of this.