On Classifying Access Control Implementations for Distributed Systems - Kane, Kevin; Browne, James C. (Proceedings of the 11th ACM Symposium on Access Control Models and Technologies (SACMAT'06), 2006)
This paper presents a classification of implementations of access control systems based on a lattice taxonomy where the axes are properties of the implementation. The current taxonomy has six axes representing:partitioning of control over sharing of access control credentials, distribution of the state relevant to access control decisions,.delity of policy enforcement, the identity resolution mechanism, local versus centralized decisions,and static or adaptive trust management.Analysis of implemented systems in terms of these properties sheds insight on tradeo .s between performance, scalability and potential vulnerability to specified attacks. The taxonomy reveals that distributed systems for several points on the lattice with interesting access control characteristics have not yet been implemented. The relationship of this classification to conventional classifications by type (for instance,role-based access control or mandatory access control) and mechanism (for instance,access control list or capabilities)is briefly discussed. Several implementations of access control are classi .ed by their values for these properties.The roles of access control in formulation and operation of distributed systems are discussed.