Last Updated on June 13, 2023 by Mayank Dham
The rights of each process for each object running in the domain are specified by an access matrix in the operating system. It aids in system security and outlines the rights and permissions for each process running within the domain. The two-dimensional matrix is used by OS to represent the access matrix.
What is Access Matrix in OS?
A security model of a computer system’s defensive state is called the "Access Matrix." An access matrix is used to provide the permissions for every process running in the domain for each object.
In OS, the access matrix is displayed as a two-dimensional matrix with rows denoting domains and columns denoting objects. Each matrix cell corresponds to a particular set of access rights given to domain processes. this shows that each entry access (i, j) defines the group of operations that a process running in domain Di may perform on object Oj. The access matrix carries out policy judgments, including those regarding whether rights, such as reading, writing, and execution, should be included in the (i, j)th entry. (This policy is usually decided by the operating system).
Implementation of Access Matrix in OS
As already mentioned, the operating system’s access matrix probably takes up a lot of memory and is extremely sparse. Therefore, implementing an access matrix for access control directly would be storage inefficient. To lessen the inefficiencies, the access matrix might be separated into rows or columns. By removing null values, the columns and rows can be compacted to improve efficiency. These decomposition techniques can be used to create four common access matrix implementations:
- Global Table
- Capability Lists for Domains
- Access Lists for Objects
- Lock and key Method
Various Methods Used to Implement the Access Matrix in OS
Some widely used methods for implementing the access matrix in os are as follows:
1. Global Table
The global table, which consists of a set of an ordered triple domain, object, right-set>, is the most fundamental and straightforward implementation of the access matrix in the operating system. The global table looks for a triple with the elements "Domain(Di), Object(Oj), right-set(Rk)> where M € Rk when an operation M is performed on an object Oj inside domain Di. If the triple is present, the operation can go forward or an exception is thrown if the condition is not met. This method has a number of limitations, but the primary one is that the global table sometimes requires additional input and output because it cannot be stored in the main memory due to the table’s size.
2. Access Lists
The access matrix in OS is decomposed into columns (column wise) when using the Access Lists approach. When a domain Di object Oj is the target of an operation M, We look for an entry with the notation "Domain(Di), right-set(Rk)" in the access list for object Oj.If the triple is present, the procedure can continue; otherwise, the starting set is checked. Access is granted if M is part of the default set; otherwise, access is prohibited and an exception is generated.
3. Capability Lists
Capability Lists are a group of objects and the operations that can be carried out on them in the operating system’s access matrix. Here, the object is identified by the physical name capability. Instead of using an access list to link the columns of the access matrix to the objects, we may use this way to associate each row with its domain.
A capability list is itself a protected object maintained by OS and accessed by the user indirectly.
4. Lock-Key Mechanism
It is a comparison of access lists and capability lists. Every object has a unique bit pattern called a lock, and each domain has a unique bit pattern called a key. A process can only access an object if the key for that domain matches one of the locks on that item.
In simple language, only an object can be accessed when the key of a process operating in a particular domain (Di) matches the lock of that domain’s object (Oj). The operating system ought to handle the locks and keys in a way that prevents any unauthorized access.
Examples
Consider the below example for a better understanding of implementing an access matrix in the operating system.
Now, let’s take an example when there are four files having the following access rights (files f1, f2, f3, and f4) and three domains (D1, D2, D3)
The access matrix, as seen in the figure above, here represents the set of access rights as:
- Any file can be read by a process running in the D1 domain and can only be written into f1.
- A process in the D2 domain has access to read f1, write to f2, and execute f4.
- D3 processes in the domain can write to f1 and 3 and can execute f4.
Typically, users choose the information that will be included in the access-matrix entries. When a user creates a brand-new object, Oj, with the appropriate initialization entries as supplied by the creator, the Oj column of the access matrix is added. Processes ought to be able to change between various domains.
Both static and dynamic access privileges can be specified and implemented using an access matrix. Similar to when we perform a (domain switch) action on an item (the domain), a process moves between various domains. The potential of domain transitions from the D1 domain to the D2, D2 to D3, and D2 to D1 is shown in the table below.
The capacity to duplicate an access right from one domain of the access matrix to another is indicated by an asterisk (*) applied to the access right. Only the column (i.e., for the object) for which it is defined by the copyright may the access right be duplicated.
Conclusion
Access matrices play a crucial role in access control mechanisms within operating systems, providing a structured approach to managing permissions and enforcing security policies. Throughout this article, we have explored the concept of access matrices, their construction, and their impact on system security.
Access matrices provide a concise representation of the permissions granted to subjects (users, processes, or entities) to access objects (files, resources, or data) within an operating system. By using rows to represent subjects and columns to represent objects, access matrices allow for fine-grained control over resource access.
FAQ Related to Access Matrix in OS
Q1: Can access matrices be modified dynamically?
A1: Yes, access matrices can be modified dynamically, allowing for the adjustment of access rights at runtime. Dynamic modifications to access matrices enable the allocation and revocation of permissions based on changing system requirements or user privileges.
Q2: What is the purpose of an access matrix?
A2: The primary purpose of an access matrix is to enforce access control policies and regulate the permissions granted to subjects for accessing objects. It enables system administrators to define and manage access rights efficiently, ensuring that subjects have appropriate access privileges and preventing unauthorized access to sensitive resources.
Q3: What are the components of an access matrix?
A3: An access matrix consists of rows representing subjects and columns representing objects. The cells in the matrix represent the permissions or access rights granted to each subject-object pair. Typically, the cells contain information such as read, write, execute, or no access permissions.
Q4: How is an access matrix constructed?
A4: An access matrix is constructed by identifying the subjects and objects in the system and defining the access rights or permissions for each subject-object pair. The matrix can be initialized with default permissions or customized based on specific requirements and security policies.
Q5: What are the different types of access control models that utilize access matrices?
A5: The two primary access control models that utilize access matrices are Access Control Lists (ACLs) and Capability Lists. ACLs associate a list of subjects with the corresponding permissions for each object, while Capability Lists associate a list of objects with the corresponding permissions for each subject.
Q6: What is the difference between an ACL and a Capability List?
A6: In an ACL-based model, permissions are associated with objects and inherited by subjects. In contrast, a Capability List-based model associates permissions with subjects and grants access to objects based on possession of capabilities. Both models utilize access matrices to define and enforce access rights.