| (I) An access control service that enforces a security policy
based on comparing (a) security labels (which indicate how
sensitive or critical system resources are) with (b) security
clearances (which indicate system entities are eligible to access
certain resources). (See: discretionary access control, rule-based
security policy.)
(C) This kind of access control is called "mandatory" because an
entity that has clearance to access a resource may not, just by
its own volition, enable another entity to access that resource.
(O) "A means of restricting access to objects based on the
sensitivity (as represented by a label) of the information
contained in the objects and the formal authorization (i.e.,
clearance) of subjects to access information of such sensitivity."
[DOD1]
|
