Enforcing complex security policies for commercial applications

Commercial applications often require complex access control policies which are hardly enforced by mechanisms based on a multilevel security model due to the properties of a lattice. Nor can they be enforced by discretionary access control like the access control matrix described by Harrison, Ruzzo, and Ullman without extra constraints since their enforcement still demands some degree of mandatory control. Frequently-desired multilevel exceptions are systematically categorized and it is shown that many security policies required by commercial sectors are actually examples of these multilevel exceptions. A new access control model based on Boolean expressions of classified categories is developed to enforce these policies in a uniform and elegant way