Discretionary-Access Control and the Access-Matrix Model

Conclusion

The HRU proof shows that the mapping of an arbitrary Turing machine to the protection system as described is well defined and results in the protection system exactly simulating the actions of the Turing machine. Deciding whether the protection system, as represented by the commands above, leaks a generic right r is equivalent to the following:

• Map right r onto a final state (say, q_f) in the corresponding Turing machine.

• Deciding whether the Turing machine enters final state q_f becomes equivalent to deciding that the protection system leaks right r.

Due to the fact that generic right r is arbitrary and hence yielding state q_f is also arbitrary and given that answering the question of whether a Turing machine enters an arbitrary final state is undecidable, the general safety problem of HRU protection systems is therefore undecidable. Because each state of the machine corresponds to a generic right in the protection system, entering a final state corresponds to the protection system leaking the right.