3.8 Further Reading

Sandhu and Ganta [877] have explored the effects of allowing testing for the absence of rights in an access control matrix (as opposed to testing for the presence of rights, which all the models described in this chapter do). Biskup [119] presents some variants on the Take-Grant Protection Model, and Budd [154] analyzes safety properties of grammatical protection schemes, which he and Lipton defined earlier [640].

Sandhu has also presented interesting work on the representation of models, and has unified many of them with his transform model [873, 874, 878].