I have trouble understanding the differences between these models.

My understanding:

HRU and Graham-Denning are both computer security models that define the interaction between subjects, objects and actions.

They are similar in that they all define a set of subjects, a set of objects and a an access control matrix.

They are different in regards to how to modify, and who can modify these rights.

It is said that the HRU model is an extension of Graham-Denning model.

Harrison-Ruzzo-Ullman extended this model by defining a system of protection based on commands made of primitive operations and conditions.

And HRU model is more flexible, and is able to describe several access control approaches.

While Graham-Denning model is said to be more limited, with a few problems.

HRU model has six primitive operations:

  • grant right to subject and object pair
  • delete right from subject and object pair
  • create subject
  • create object
  • delete subject
  • delete object Which are then form transitions: sequences of basic operations.

While Graham-Denning defines eight basic rules:

  • create an object.
  • create a subject.
  • delete an object.
  • delete a subject.
  • grant right.
  • delete right.
  • transfer right.
  • read right.

First Question: What does this difference provide? Does it give more flexibility? (For example, transfer right in G-D can be a transision of deleting and then granting of a right in HRU)

I also know that in G-D each subject has an owner, which can be itself.

Second question: Does the same hold true in HRU?

And when a subject is the owner of itself, then it can delete other subjects access to itself, which is considered undesirable.

Third question: Does HRU solve this problem? (Is it a problem?)

Am I wrong and what can be added?

  • Have you read en.wikipedia.org/wiki/HRU_(security) ?
    – Tom K.
    Jul 11, 2018 at 10:43
  • @tom-k Yes, of course.
    – Adam
    Jul 11, 2018 at 10:51
  • Then you should be able to add more than the sentence you copied from wikipedia. :) You should narrow your question down to a specific problem you have. There can be added a lot more.
    – Tom K.
    Jul 11, 2018 at 11:00
  • @TomK. You are right. Edited the question to more specific details. Thank you.
    – Adam
    Jul 11, 2018 at 11:42


You must log in to answer this question.

Browse other questions tagged .