Specification of content-dependent security policies

The protection of information from unauthorized disclosure is an important consideration for the designers of any large multiuser computer system. A general purpose database management system often requires the enforcement of content-dependent security policies in which a decision to allow access must be based on the value of the data itself. Several authors ([Har76], [Sto76], [Gri76], [Sum77], [Min78], [Spo83], and others) have proposed mechanisms for implementing content-dependent security policies. Few authors, however, have investigated the properties of models for the specification of such policies. This paper identifies several problems created by inadequate models for the specification of content-dependent security policies. If a specification model is too liberal in the types of policies it can express, it may provide an increased opportunity for compromise of data. If the specification model is too conservative, it cannot express many desirable policies. Thus a flexible model which will allow a compromise between these two extremes is needed for specifying content-dependent policies. Such a model is proposed here.