3.4. Further Reading
In that same year as the HRU result, Jones, Lipton, and Snyder [473] presented a specific model, called the Take-Grant Protection Model, in which security was not only decidable, but decidable in time linear with the size of the system. Several papers [112,576,848,849,850] have explored this system and its applications. Budd [141] analyzes safety properties of grammatical protection schemes, which he and Lipton defined earlier [575]. Minsky [639] suggested another model to examine what made the general, abstract case undecidable but at least one specific case decidable. Sandhu and others [777,778,779] extended this model, which he called the Schematic Protection Model or SPM, to examine the boundary even more closely. Sandhu has also presented interesting work on the representation of models, and has unified many of them with his transform model [781, 782, 786].
Some interesting work [18,19,20,780,783] has characterized the expressive power of these, and other, models.
Sandhu and Ganta [785] have explored the effects of allowing testing for the absence of rights in an access control matrix (as opposed to testing for the presence of rights, which all the models described in this chapter do).
 |
