Protection and Security

An access matrix is a security model that defines what subjects (users, processes) can perform what operations on objects (files, resources). Rows represent subjects, columns represent objects, and each cell contains access rights. This model forms the basis for implementing access control policies.

Asymmetric cryptography, also called public-key cryptography, uses a pair of keys: a public key for encryption and a private key for decryption. This solves the key distribution problem inherent in symmetric systems. Symmetric systems use the same key for both operations, which requires secure key exchange.

Symmetric cryptography uses a single secret key for both encryption and decryption. This requires both sender and receiver to securely share the key beforehand. Asymmetric cryptography uses different keys for each operation.

In cryptography, plaintext is the original readable message, and ciphertext is the encrypted result. The encryption algorithm transforms plaintext into ciphertext using a key. Decryption reverses this process to recover the plaintext.

Plaintext refers to the original, unencrypted message that is readable by humans. Ciphertext is the encrypted version that appears scrambled. The encryption process converts plaintext to ciphertext.

In the Take-Grant protection model, 'take' and 'grant' are specific rights that can be exercised between subjects and objects. These operations allow the transfer of access rights in a graph-based protection system. The model defines rules for how rights can propagate.

The Take-Grant model is a formal graph-based protection system that models access rights between subjects and objects. It uses directed graphs to represent permissions and defines specific rules (take and grant) for how rights can be transferred. It helps analyze whether protection systems are safe from unauthorized access.

A capability is an unforgeable token that grants the holder specific access rights to an object. It's like a key - possession of the capability proves authorization. Capabilities are a fundamental concept in access control systems, contrasting with access control lists that store permissions with the object.

An Access Control List (ACL) is a list associated with an object that specifies which entities (users, processes) have what permissions on that object. Each entry typically identifies a subject and the access rights granted. ACLs are object-centric, storing permissions with the resource being protected.

Protection rings are a hierarchical protection mechanism that generalizes the supervisor/user mode concept. Inner rings have more privileges; outer rings have fewer. MULTICS introduced this model, later adopted in many systems including x86 architecture. Rings provide fine-grained access control beyond just supervisor vs user mode.

Encryption algorithms require a key as a parameter - it's the secret that determines the specific transformation. Without the key, the encryption or decryption cannot be performed correctly. The same plaintext encrypted with different keys produces different ciphertexts.

Common access control mechanisms include hierarchical approaches (like protection rings or multilevel security) and list-based approaches (like Access Control Lists). These represent two fundamental paradigms for managing permissions. Hierarchies organize by privilege levels, while lists enumerate explicit permissions.

Protection rings were first introduced in the MULTICS operating system, developed in the 1960s. MULTICS pioneered many security concepts including ring-based protection. This hierarchical privilege model was later adopted in other systems including the x86 architecture's ring levels (0-3).

False rejection ratio measures the rate at which a biometric or authentication system incorrectly rejects legitimate users who should be granted access. It represents the system's failure to recognize authorized users.

Protection domain refers to the collection of access rights that a subject (such as a process or user) has over objects (such as files or resources) in a system. It defines what operations can be performed.