By Topic

Unidirectional Transport of Rights and Take–Grant Control

Sign In

Cookies must be enabled to login.After enabling cookies , please use refresh or reload or ctrl+f5 on the browser for the login options.

Formats Non-Member Member
$33 $13
Learn how you can qualify for the best price for this item!
Become an IEEE Member or Subscribe to
IEEE Xplore for exclusive pricing!
close button

puzzle piece

IEEE membership options for an individual and IEEE Xplore subscriptions for an organization offer the most affordable access to essential journal articles, conference papers, standards, eBooks, and eLearning courses.

Learn more about:

IEEE membership

IEEE Xplore subscriptions

2 Author(s)
A. Lockman ; Department of Computer Science, Rutgers University ; N. Minsky

One of the most critical and least understood aspects of protection is the exercise of control over the movement of rights between the subjects of a system. The conventional Take-Grant mechanism for exercising such control suffers from a puzzling and unfortunate limitation: it cannot enforce strictly unidirectional channels for the flow of rights. That is, if rights can be moved directly or indirectly from some subject p to another subject q, then one cannot prevent rights from flowing in the opposite direction, from q to p. This property limits the applicability of this mechanism and therefore that of any protection scheme utilizing it. We analyze the nature and ramifications of this limitation and demonstrate that its root cause is the fact that (under this mechanism) a right possessed by a sender suffices to authorize a movement of rights. We propose an alternative, "Take-Receive," model in which this limitation is eliminated, thus enabling the implementation of more useful protection disciplines. We prove this result by analyzing tl-e dynamic behavior of the proposed model.

Published in:

IEEE Transactions on Software Engineering  (Volume:SE-8 ,  Issue: 6 )