Effective and Efficient Bitmaps for Access Control

We investigate the application of bitmaps to represent users' permissions in discretionary access control systems. In principle any user can have one or more permissions on any object, but in reality permissions exhibit significant clustering with respect to both users and objects. This paper presents a novel compression scheme tailored specifically for compressing large, sparse bitmaps having many clusters that are not merely contiguous sequences of ones. Our new scheme not only achieves a good compression ratio, but it also supports fast bitwise operations (e.g., union to determine permissions inherited from a user's groups) without requiring decompression. Most importantly, however, testing, setting or clearing a bit on a compressed bitmap (reflecting the checking, granting or revocation of a permission) is much faster than with alternative schemes.