On the minimality of testing for rights in transformation models

In this paper we de ne and analyze a family of access control models, called transformation models, which are based on the concept of transformation of rights. In these models, propagation of access rights is authorized entirely by existing rights for the object in question. Transformation models are useful for expressing various kinds of consistency, con dentiality, and integrity controls. These models also generalize the monotonic transform model of Sandhu, and its non-monotonic extension (NMT) by Sandhu and Suri. We argue that NMT is inadequate for expressing the document release example discussed by Sandhu and Suri, because it can test only one access matrix cell in its state changing commands. We then analyze the relative expressive power of testing two access matrix cells in state changing commands versus testing more than two. Our conclusion is that it su ces to allow testing for two cells.