Core CS

Access Matrix Model of Protection

The Access Matrix Model is an abstract security framework used by operating systems to define and enforce protection policies. It visualizes the system’s permissions as a two-dimensional grid: the rows represent active entities or domains (users or processes), the columns represent system resources or objects (files, printers, devices), and each cell specifies the exact access rights (such as read, write, or execute) that a domain holds over an object.

<h3>Detailed Definition</h3><h2><p>An Access Matrix is a conceptual model that separates security <b>mechanism</b> (how the OS enforces access checks) from security <b>policy</b> (who is allowed to do what).</p><p>Whenever a process executing in a domain attempts an operation on an object, the operating system intercepts the request, looks up the corresponding cell <code data-path-to-node="5" data-index-in-node="154">Access(Domain_i, Object_j)</code>, and permits the action only if the requested right is explicitly present.</p></h2><h4>Conceptual Structure</h4><h2><table><thead><tr><td><strong>Domain / Subject</strong></td><td><strong>File 1</strong></td><td><strong>File 2</strong></td><td><strong>Printer</strong></td></tr></thead><tbody><tr><td><b>User A (Domain 1)</b></td><td>Read, Write</td><td>Read</td><td>Print</td></tr><tr><td><b>User B (Domain 2)</b></td><td>Read</td><td>—</td><td>Print</td></tr><tr><td><b>Process C (Domain 3)</b></td><td>—</td><td>Read, Write</td><td>—</td></tr></tbody></table></h2><h3>Key Points</h3><h2><ul><li><p><b>Domains (Rows):</b> The active subjects executing commands (e.g., users, roles, or running processes).</p></li><li><p><b>Objects (Columns):</b> The passive system resources requiring protection (e.g., files, directories, memory segments, network sockets).</p></li><li><p><b>Access Rights (Cell Entries):</b> The set of operations permitted (e.g., <code data-path-to-node="10,2,0" data-index-in-node="69">read</code>, <code data-path-to-node="10,2,0" data-index-in-node="75">write</code>, <code data-path-to-node="10,2,0" data-index-in-node="82">execute</code>, <code data-path-to-node="10,2,0" data-index-in-node="91">append</code>, <code data-path-to-node="10,2,0" data-index-in-node="99">delete</code>).</p></li><li><p><b>Dynamic Rights:</b> Access matrices can also contain control rights such as:</p><ul><li><p><code data-path-to-node="10,3,1,0,0" data-index-in-node="0">Owner</code>: Allows a domain to add or revoke rights of other domains for that object.</p></li><li><p><code data-path-to-node="10,3,1,1,0" data-index-in-node="0">Copy</code>: Allows a domain to transfer rights to another domain.</p></li><li><p><code data-path-to-node="10,3,1,2,0" data-index-in-node="0">Switch</code>: Allows a process to transition from one domain to another.</p></li></ul></li><li><p><b>Practical Implementation:</b> Because a direct 2D matrix in memory is mostly empty (sparse), real operating systems implement it either by columns as <b>Access Control Lists (ACLs)</b> attached to objects (used by Windows and Linux filesystems), or by rows as <b>Capability Lists (C-Lists)</b> held by processes.</p></li></ul></h2><h3>Significance</h3><h2><ul><li><p><b>Enforces Least Privilege:</b> Allows the OS to restrict processes to strictly the resources they need for their current task.</p></li><li><p><b>Separates Mechanism from Policy:</b> The operating system provides the generic table lookup mechanism, while the system administrator defines the actual access rights (policy).</p></li><li><p><b>Unified Security Framework:</b> Provides a single, formal mathematical foundation capable of modeling access to both hardware (devices, memory) and software (files, processes) uniformly.</p></li></ul></h2><h3>Advantages</h3><h2><ul><li><p><b>Simple & Intuitive:</b> Easy to understand, audit, and represent conceptually.</p></li><li><p><b>Fine-Grained Control:</b> Allows precise, per-user, per-resource permission mapping.</p></li><li><p><b>Flexible:</b> Easily supports policy updates, dynamic domain switching, and right transfers (<code data-path-to-node="16,2,0" data-index-in-node="89">copy</code>/<code data-path-to-node="16,2,0" data-index-in-node="94">owner</code> flags).</p></li><li><p><b>Universality:</b> Applicable across diverse resource types, from physical peripherals to abstract system services.</p></li></ul></h2><h3>Disadvantages</h3><h2><ul><li><p><b>Extremely Sparse Matrix:</b> In a real OS with thousands of files and dozens of users, most entries are empty, making direct table storage wasteful.</p></li><li><p><b>High Memory Overhead:</b> Direct table implementations scale poorly (O(Domains x Objects)), requiring decomposition into ACLs or Capabilities.</p></li><li><p><b>Slow Global Revocation:</b> In capability-based implementations (row-wise), revoking everyone's access to a single file requires scanning every user's capability list.</p></li><li><p><b>Complex Management:</b> As the number of objects and users scales dynamically, maintaining consistency without role-based grouping becomes cumbersome.</p></li></ul></h2><h3><br></h3>