A purpose-oriented access control model

In distributed applications, multiple objects cooperate to achieve some objectives. Each object is manipulated through an operation supported by the object and then the operation may further invoke operations of other objects, i.e. nested operations. Purpose-oriented access rules indicate what operation in each object can invoke operations of other objects. Information flow among the objects occurs if the requests and responses of the operations carry data. Only the purpose-oriented access rules which imply legal information flow are allowed. In this paper, we discuss how to specify the access rules so that the information flow occurring in the nested invocation of the operations is legal