April 20, 2026 Outline

Reading: text, §8.2–8.4, [WB04]
Assignments: Homework #2, due April 24; Project progress report, due May 11

1. Clinical Information System Security model
   1. Intended for medical records; goals are confidentiality, authentication of annotators, and integrity
   2. Patients, personal health information, clinician
   3. Assumptions and origin of principles
   4. Access principles
   5. Creation, deletion principles
   6. Confinement, aggregation principles
   7. Enforcement
   8. Comparison with Bell-LaPadula, Clark-Wilson

2. ORCON
   1. Originator controls distribution
   2. DAC, MAC inadequate
   3. Solution is combination

3. Role-based Access Control (RBAC)
   1. Definition of role
   2. Partitioning as job function
   3. Axioms
   4. Containment and other uses
   5. RBAC₀, RBAC₁, RBAC₂, RBAC₃

4. Traducement
   1. Problem of recordation
   2. Requirements of solution
   3. Ideas, entities, and rules
   4. Proposition and theorems

Matt Bishop Office: 2209 Watershed Sciences Phone: +1 (530) 752-8060 Email: mabishop@ucdavis.edu

ECS 153A, Computer & Information Security & Privacy I Version of April 20, 2026 at 1:34PM

You can also obtain a PDF version of this.