Scribd
Upload
223 views

Access Matrix: Implementation and Comparison

The document discusses different methods for implementing an access matrix for controlling access permissions. It compares four main methods: global table, access lists for objects, capability lists for domains, and lock-key mechanism. A global table stores all access permissions but can be large and inefficient. Access lists correspond directly to user needs but are time-consuming to search. Capability lists localize access control but revoking access is inefficient. The lock-key mechanism balances access lists and capabilities by using keys that can be freely passed between domains but revoked by changing locks. Most systems use a hybrid approach of access lists and capabilities.

Uploaded by

Hamzah Hamizan
Copyright
© © All Rights Reserved
Available Formats
Download as PPTX, PDF, TXT or read online on Scribd
223 views

Access Matrix: Implementation and Comparison

The document discusses different methods for implementing an access matrix for controlling access permissions. It compares four main methods: global table, access lists for objects, capability lists for domains, and lock-key mechanism. A global table stores all access permissions but can be large and inefficient. Access lists correspond directly to user needs but are time-consuming to search. Capability lists localize access control but revoking access is inefficient. The lock-key mechanism balances access lists and capabilities by using keys that can be freely passed between domains but revoked by changing locks. Most systems use a hybrid approach of access lists and capabilities.

Uploaded by

Hamzah Hamizan
Copyright
© © All Rights Reserved
Available Formats
Download as PPTX, PDF, TXT or read online on Scribd
You are on page 1/ 19

ACCESS MATRIX

IMPLEMENTATION AND COMPARISON

By: Rushabh Dharwadkar


Roll no: 411108
TE COMP
ACCESS MATRIX

• In an Access matrix, there are columns which represent different


system resources and rows representing different protection
domains. Entries within the matrix indicate what access that
domain has to that resource.

2
ACCESS MATRIX

3
IMPLEMENTATION OF ACCESS MATRIX
There four ways listed below in which Access Matrix can be implemented
effectively.

Global Table
Access Lists for Objects
Capability Lists for Domains
Lock-Key Mechanism

4
GLOBAL TABLE

This is the simplest implementation of the access matrix.


Contains a set of ordered triples <domain,object,rights-set>
Whenever an operation M is executed on an object Oj within domain Di
the global table is searched for a triple <Di,Oj,Rk > where M Є Rk
If this triple is found, the operation is allowed to continue or else an exception
is raised.

5
GLOBAL TABLE
 Drawbacks
• Table size is quite large so it cannot be kept in main memory so additional I/O is
needed
• Virtual Memory techniques are used for managing this table
• Difficult to take advantage of special groupings
I.e. If at all everyone can read a particular object, this object must have a separate entry in
every domain.

6
ACCESS LISTS FOR OBJECTS

When an operation M on an object Oj is attempted in domain Di we search the


access list for object Oj , looking for an entry < Di ,Rk > where M Є Rk lookin
if the entry is found, we allow the operation ,if it is not we check the default set,
we allow the access. Otherwise the access is denied, and an exception condition
occurs

7
CAPABILITY LISTS FOR DOMAINS

• Capability can be secure pointer to object


• OS controls who can acquire references
• requires that pointers be opaque
• natural model for type-safe languages

8
CAPABILITY LISTS FOR DOMAINS

• Here we associate each row with each domain


• They are a kind of secure pointers
• An object is often represented by its physical name or address, called a
Capability
• To execute an operation an operation M on object Oj the process executes
the operation M, specifying the capability (or pointer) for Oj as a parameter
• Simple possession of the capability means that the access is allowed
9
CAPABILITY LISTS FOR DOMAINS

Capabilities are usually distinguished from each other in two ways..


Each object has a tag to denote whether it’s a capability or accessible data
• Tags not directly accessible by application programs
• Hardware/firmware support used to enforce this restriction
• More than 1 bits used as a distinguishing attribute
• Hardware can distinguish integers , characters and so on and other values

10
CAPABILITY LISTS FOR DOMAINS

Address space associated with a program can b split into 2 parts


Part 1
• Is accessible to the program and contains its normal instructions
Part 2
• Contains the capability list and is accessible only by the OS …….

Segmented memory space is useful in this approach

11
LOCK-KEY MECHANISM
• Compromise between access lists and capability lists

• Each object has a list of unique bit patterns called locks

• Each domain has a list of unique bit patterns called keys

• List of keys for domain must b managed by the OS

• Users are not allowed to examine or modify keys


12
COMPARISON

1. Global table

• Simple, but the table can b large and often cannot take advantage of special
groupings of objects or domains
• Access lists correspond directly to the needs of users
• Determining set access rights for each domain is difficult
• Every access to the object must be checked, requiring a search of access list
in large systems with long access lists, this is time consuming
13
COMPARISON
2. Capability Lists

• Do not correspond directly to the needs of users


• Useful for localizing information for a given process
• Process attempting access must present a capability for that access
• Protection system needs to verify if the capability is valid
• Revocation of capabilities inefficient

14
COMPARISON

3. Lock-key mechanism
• Compromise between access lists and capability lists
• Effective and flexible depending on the length of keys
• Keys passed freely from domain to domain
• Access privileges effectively revoked by changing some of the locks
associated with the objects

15
COMPARISON

Most systems use a combination of access lists and capabilities

• When a process tries to access an object, the access list is searched


• If access is denied an exception occurs
• Or else a capability is created and attached to the process
• Capability is used to demonstrate swiftly that access is allowed
• After last access capability is destroyed
16
Questions…

1. Explain access matrix as model of protection


2. How can a access matrix be implemented?
3. List and explain drawbacks of lock-key mechanism?
4. What are the disadvantages of capability lists?

17
Reference…

• Operating Systems Concepts 8 th


edition (Galvin)
• Page no 603-605

18
Thank u 

19

You might also like