Mechanism Sufficiency Validation by Assignment

This paper introduces a mathematical framework for evaluating the relationship between policies and mechanisms. An evaluation approach called the assigmnent technique is defined. This technique consists of establishing an assignment between the security classes of information established by policy constraints, and the protection domains, established by the properties of the mechanism. The assignment technique provides a theoretical foundation for assessing the sufficiency of an access control mechanism with respect to a well formed protection policy. Although this paper presents preliminary results of research, the propsed framework suggests a promising new approach for evaluating the protection mechanisms of existing and proposed systems.