An abstract authorization system for the Internet

Most of the work on Internet security focuses on cryptographic approaches. While valuable, this is not a feasible way to control access to documents. Cryptography can only control secrecy and authentication aspects, but cannot handle different types of access by different users, access to portions of documents, and other content restrictions. A higher-level approach is needed. We present here an authorization model for hypertext documents based on the access matrix. We classify different types of documents, we model these using object-oriented approaches, and we define access policies that specify access to those types of documents. Authorization restrictions can be superimposed on the document class model and on its dynamic model. These authorizations are based on a mandatory version of the access matrix, implementing role-based access control. We consider possible implementation architectures, involving servers and databases