Formally modelling and describing access rights

Question

Is there a formal theory or framework described in text books that models access rights in a mathematical way. I would expect things similar to the following:

• We have data (objects).
• We have operations on these objects (CRUD, create, read, update delete)
• We have actors (users, principals)
• We might model access rights as triples like (user, operation, object) which describe which user can do what to which object.
• We have a potential hierarchy of objects: a folder has files, a file has meta data and rights may be inherited according to certain rules down the hierarchy.
• We have a hierarchy of actors too.
• Rights may be stored more efficiently by creating triples of (user set, operation set, object set) based on attributes of the objects and the users.

Apart from the pure theory I would expect to read about efficient implementation strategies, data structures etc.

EDIT on: Once access rights are modelled, I would like to read about how these are enforced in real code. Where and when must an operation of some data make the decision whether this is allowed in the given context or not. EDIT off

Further I would expect to see how this maps to real world access control systems in file shares, databases, web applications. Maybe I am just missing the right keywords for a search.

The one paper I found, http://www.sciencedirect.com/science/article/pii/S1877050916301764, is not exactly convincing.

Answer 1

The Harrison-Ruzzo-Ullman model has this form. It has principals (e.g., users) and objects (e.g., files), and a matrix that indicates which types of access each principal has for each object. It also models how the sets of access rights can evolve over time. It has no notion of hierarchy for principals or objects built into the model, but you could of course regard the set of principals and objects as hierarchical in the way you want -- that's compatible with the HRU model.

The HRU model concerns itself only with semantics: with who has access to what. It is not concerned with efficiency.

You might also enjoy digging up a textbook that covers this. The catchphrase you want is the foundations of computer security". For instance, you might find Matt Bishop's book Computer Security: Art and Science very relevant.