The Community for Technology Leaders
Green Image
Issue No. 01 - Jan.-Feb. (2013 vol. 10)
ISSN: 1545-5971
pp: 28-39
Ninghui Li , Purdue University, West Lafayette
Mahesh V. Tripunitara , University of Waterloo, Waterloo
ABSTRACT
The work by Harrison, Ruzzo, and Ullman (the HRU paper) on safety in the context of the access matrix model is widely considered to be foundational work in access control. In this paper, we address two errors we have discovered in the HRU paper. To our knowledge, these errors have not been previously reported in the literature. The first error regards a proof that shows that safety analysis for mono-operational HRU systems is in {\bf NP}. The error stems from a faulty assumption that such systems are monotonic for the purpose of safety analysis. We present a corrected proof in this paper. The second error regards a mapping from one version of the safety problem to another that is presented in the HRU paper. We demonstrate that the mapping is not a reduction, and present a reduction that enables us to infer that the second version of safety introduced in the HRU paper is also undecidable for the HRU scheme. These errors lead us to ask whether the notion of safety as defined in the HRU paper is meaningful. We introduce other notions of safety that we argue have more intuitive appeal, and present the corresponding safety analysis results for the HRU scheme.
INDEX TERMS
Safety, Access control, Context, Computer security, Educational institutions, Computational modeling, computational complexity, Access control, reducibility and completeness
CITATION
Ninghui Li, Mahesh V. Tripunitara, "The Foundational Work of Harrison-Ruzzo-Ullman Revisited", IEEE Transactions on Dependable and Secure Computing, vol. 10, no. , pp. 28-39, Jan.-Feb. 2013, doi:10.1109/TDSC.2012.77
90 ms
(Ver )