Lattice-based access control: Difference between revisions

Revision as of 14:14, 14 June 2007

Latest revision as of 12:40, 9 July 2024

(40 intermediate revisions by 27 users not shown)

Line 1:

{{Inline citations|date=July 2024}}

In [[computer security]], '''lattice-based access control''' ('''LBAC''') is a complex [[access control|method for limiting information access]] based on any combination of objects (such as resources, computers, and applications) and subjects (such as individuals, groups or organizations).

In [[computer security]], '''lattice-based access control''' ('''LBAC''') is a complex [[access control|method for limiting information access]] model based on the interaction between any combination of '''objects''' (such as resources, computers, and applications) and '''subjects''' (such as individuals, groups or organizations).

In this type of control model, a [[lattice (order)|lattice]] is used to define the levels of security that an object may have, and that a subject may have access to. That is, we define a [[partial order]] on the security levels, in such a way that any two security levels always have a greatest lower bound (meet) and least upper bound (join). If two objects ''A'' and ''B'' are combined to form another object ''C'', that object is assigned a security level formed by the join of the levels of ''A'' and ''B'', and if two subjects need to jointly access some secure data, their access level is defined to be the meet of the subjects' levels. A subject is allowed to access an object only if the security level of the subject is greater than or equal to that of the object, in the partial order defining the lattice.

In this type of label-based [[mandatory access control]] model, a [[lattice (order)|lattice]] is used to define the levels of security that an object may have and that a subject may have access to. The subject is only allowed to access an object if the security level of the subject is greater than or equal to that of the object.

LBAC is known as a more specific set of access control restrictions and is more general than [[role-based access control]] (RBAC).

Mathematically, the security level access may also be expressed in terms of the lattice (a [[partial order]] set) where each object and subject have a greatest lower bound (meet) and least upper bound (join) of access rights. For example, if two subjects ''A'' and ''B'' need access to an object, the security level is defined as the meet of the levels of ''A'' and ''B''. In another example, if two objects ''X'' and ''Y'' are combined, they form another object ''Z'', which is assigned the security level formed by the join of the levels of ''X'' and ''Y''.

LBAC is also known as a morelabel-based specificaccess setcontrol of(or ''rule-based access control'') restrictionsrestriction and is moreas generalopposed thanto [[role-based access control]] (RBAC).

Lattice based access control models were first formally defined by [[Dorothy E. Denning|Denning]] (1976); see also Sandhu (1993).

== ReferencesSee also ==

{{columns-list|colwidth=30em|

* [[Access control list]]

* [[Attribute-based access control]] (ABAC)

* [[Computer securityBell–LaPadula model]]

* [[Biba Model]]

* [[Capability-based security]]

* [[Computer security model]]

* [[Context-based access control]] (CBAC)

* [[Discretionary access control]] (DAC)

* [[Graph-based access control]] (GBAC)

* [[Mandatory access control]] (MAC)

* [[Organisation-based access control]] (OrBAC)

* [[Risk-based authentication]]

* [[Role-based access control]] (RBAC)

* [[RSBAC|Rule-set-based access control (RSBAC)]]

}}

== References ==

{{reflist}}

*{{cite journal

| author = Denning, Dorothy E.

Line 18 ⟶ 40:

| year = 1976

| pages = 236–243

| doi = 10.1145/360051.360056}}

| url=http://faculty.nps.edu/dedennin/publications/lattice76.pdf}}

*{{cite journal

| author = Sandhu, Ravi S.

Line 29 ⟶ 51:

| pages = 9–19

| doi = 10.1109/2.241422

| url = http://itewww.gmuwinlab.rutgers.edu/list~trappe/journalsCourses/computerAdvSec05/i93lbacmaccess_control_lattice.pspdf}}

== See also ==

* [[Computer security model]]

[[Category:Computer security models]]

[[Category:Lattice theory]]

[[Category:CISSP Access control]]

{{CompuComputer-langsecurity-stub}}