Access Matrix in Operating System

An Access Matrix is a digital model utilized to control and manage permissions. This model defines the rights each user has for different resources. In simple terms, it’s a table that shows what actions an individual or a group of users can perform on specific objects within a system.

It represents the access control mechanism that specifies which actions (e.g., read, write, execute) are allowed or denied for each subject on each object.

Different Types of Rights

There are different types of rights the files can have. The most common ones are:

1. Read- This is a right given to a process in a domain that allows it to read the file.
2. Write- Process in the domain can be written into the file. 
3. Execute- The process in the domain can execute the file. 
4. Print- Process in the domain only has access to a printer.

Sometimes, domains can have more than one right, i.e. combination of rights mentioned above. 

Let us now understand how an access matrix works from the example given below. 

Observations of Above Matrix

• There are four domains and four objects– three files(F1, F2, F3) and one printer. 
• A process executing in D1 can read files F1 and F3. 
• A process executing in domain D4 has same rights as D1 but it can also write on files. 
• Printer can be accessed by only one process executing in domain D2.
• A process executing in domain D3 has the right to read file F2 and execute file F3.

Mechanism of Access Matrix

The mechanism of access matrix consists of many policies and semantic properties. Specifically, we must ensure that a process executing in domain Di can access only those objects that are specified in row i. Policies of access matrix concerning protection involve which rights should be included in the (i, j)th entry. We must also decide the domain in which each process executes. This policy is usually decided by the operating system. The users decide the contents of the access-matrix entries. Association between the domain and processes can be either static or dynamic. Access matrix provides a mechanism for defining the control for this association between domain and processes.

Switch operation: When we switch a process from one domain to another, we execute a switch operation on an object(the domain). We can control domain switching by including domains among the objects of the access matrix. Processes should be able to switch from one domain (Di) to another domain (Dj) if and only if a switch right is given to access(i, j). This is explained using an example below: 

According to the above matrix, a process executing in domain D2 can switch to domain D3 and D4. A process executing in domain D4 can switch to domain D1 and process executing in domain D1 can switch to domain D2.

Implementations

There are various methods of implementing the access matrix in the operating system such as.

1. Global Table
2. Access Lists for Objects
3. Capability Lists for Domains

Global Table:

A single table with rows and columns, where rows represents subjects and columns represents objects. Each cell of the global table contains the access for the subject-object pair.

Example

class AccessMatrix:
    def __init__(self, subjects, objects):
        self.subjects = subjects
        self.objects = objects
        self.matrix = {subject: {obj: set() for obj in objects} for subject in subjects}
    
    def set_permission(self, subject, obj, right):
        if subject in self.matrix and obj in self.matrix[subject]:
            self.matrix[subject][obj].add(right)
    
    def check_permission(self, subject, obj, right):
        return right in self.matrix.get(subject, {}).get(obj, set())

# Example usage
subjects = ['user1', 'user2']
objects = ['file1', 'file2']
am = AccessMatrix(subjects, objects)
am.set_permission('user1', 'file1', 'read')
print(am.check_permission('user1', 'file1', 'read'))  # Output: True
print(am.check_permission('user2', 'file1', 'read'))  # Output: False

Access Lists for Objects:

This is a column wise representation of access matrix and allows subjects to access specific objects according to the access list.

Example

class ACL:
    def __init__(self):
        self.acl = {}

    def add_object(self, obj):
        if obj not in self.acl:
            self.acl[obj] = {}

    def set_permission(self, obj, subject, right):
        if obj in self.acl:
            if subject not in self.acl[obj]:
                self.acl[obj][subject] = set()
            self.acl[obj][subject].add(right)

    def check_permission(self, obj, subject, right):
        return right in self.acl.get(obj, {}).get(subject, set())

# Example usage
acl = ACL()
acl.add_object('file1')
acl.set_permission('file1', 'user1', 'read')
print(acl.check_permission('file1', 'user1', 'read'))  # Output: True
print(acl.check_permission('file1', 'user2', 'read'))  # Output: False

Capability Lists for Domains:

This is a row wise representation of access matrix. Each subject has a capability list, where each capability specifies an object and the rights the subject has to that object.

Example

class Capability:
    def __init__(self):
        self.capabilities = {}

    def add_subject(self, subject):
        if subject not in self.capabilities:
            self.capabilities[subject] = {}

    def add_capability(self, subject, obj, right):
        if subject in self.capabilities:
            if obj not in self.capabilities[subject]:
                self.capabilities[subject][obj] = set()
            self.capabilities[subject][obj].add(right)

    def check_capability(self, subject, obj, right):
        return right in self.capabilities.get(subject, {}).get(obj, set())

# Example usage
cap = Capability()
cap.add_subject('user1')
cap.add_capability('user1', 'file1', 'read')
print(cap.check_capability('user1', 'file1', 'read'))  # Output: True
print(cap.check_capability('user2', 'file1', 'read'))  # Output: False

Conclusion

The Access Matrix is a foundational model for managing access control in operating systems, providing a clear framework for defining and enforcing security policies. Access Matrix ensures that only authorized users can perform specific actions on protected objects. Its flexibility allows for various implementation strategies, such as Access Control Lists (ACLs) and capabilities, to suit different system needs. While the model offers fine-grained control, it also presents challenges in scalability and complexity. Nevertheless, the Access Matrix remains a crucial tool in maintaining robust and secure operating systems.