Model of access control policy for civil agencies

摘要

Proposes a general model for access control policy for civil agencies. Different types of sensitive, but unclassified information and the special operational requirements for civil agencies are described. A wide number of systems were reviewed and hundreds of access control requirements were identified. Nevertheless, it was found that the access control rules fell into six general categories of 16 rules. A model for an access control policy is defined that is comprised of entities such as subjects and objects and a set of rules. Then, the model is applied to a sample of IRS security requirements in order to show how the model could be used to express requirements for a real application.