A Comparison of Traditional Access Control Models and Digital Rights Management

Access control mechanisms currently employed in various applications lack the power to provide (express and enforce) complex, dynamic relationships between users and resources in a scalable and consistent way. The problem escalates when we consider dynamic ad-hoc environments where security associations between users and objects continuously change and are not known prior to a decision. This paper compares traditional Access Control (AC) models to Digital Rights Management (DRM) in order to provide some insight to these problems. These two are often thought to be independent mechanisms that both control access to and usage of tangible and intangible assets. It is demonstrated that they do exhibit many common characteristics and that some of the ideas behind DRM apply to a variety of AC problems, particularly when dealing with commercially driven dynamic relationships and context aware environments as is the case with many modern applications and services.