Security Models

Even if we limit ourselves to models of con dentiality, there are two related, but distinct, senses of the term security model in the computer security literature [McL90b]. In the more limited use of the term, a security model speci es a particular mechanism for enforcing con dentiality, called access control, which was brought over into computer security from the world of documents and safes. In the more general usage of the term, security models are speci cations of a system's con dentiality requirements and are not \models" at all in that they specify security requirements without describing any particular mechanism for implementing these requirements. These models specify restrictions on a system's interface (usually its input/output relation) that are su cient to ensure that any implementation that satis es these restrictions will enforce con dentiality. In this section, we consider access control models and interface models in turn.