The hierarchical model of distributed system security

A description is given of the hierarchical model (HM), an access matrix-based model used to define nondisclosure in distributed multilevel secure applications such as secure file systems, secure switches, and secure upgrade downgrade facilities. The HM explicitly encodes access rights, synchronization primitives, and indirection in its state matrix. Serializability of concurrent commands is formally defined in terms of the HM syntactic model of computation. HM serializability conditions are independent of the semantic security predicate. Finally, an example that illustrates the HM is presented.<
>