The paper considers an access control model and proposes extensions to it to deal with authentication and revocation. The model is then applied to represent access control policy in a mental health system. In the first part of the paper, extensions to the schematic protection model (SPM) are presented. The authentication and revocation extensions are independent of one another in the sense that each one affects a different part of the decision algorithm. The extensions comprise a modification of the syntax to be able to represent the new concepts and, more importantly, a modification of the decision algorithm for the safety problem to take these changes into account. We introduce the concept of conditional tickets and use it to provide authentication. Apart from this, we have found this concept to be useful in modeling systems. Hence we have separated this (syntactical) issue from the definition of the new algorithm. The second part considers the access policy for a mental health application. We have used the extensions of SPM to model part of this access policy. Even with our extensions, SPM still remains a monotonic model, where rights can be removed only in very special cases, and this makes it impossible to represent all the aspects of the problem. Other than to serve as an example for the extensions we propose, the paper also helps to separate aspects of this access control policy which are inherently monotonic from parts which are defined in a non-monotonic way, but can still be represented in a monotonic model.

The Schematic Protection Model, SPM, allows us to specify the protection structure of a system and gives an algorithm to reason about the transmission of privileges in the system. This paper extends the SPM model to include for conditional tickets and to provide authentication. We also extend the decision algorithm of the safety problem to take into account these modifications.>

The access policy to patients' records in a mental health hospital has only a verbal specification, and many formal systems fail to represent all the aspects of this problem. This paper uses an extension of SPM, which can represent revocation and conditional tickets, to model part of this access policy. Even with our extension, SPM still remains a monotonic model, where rights can be removed only in very special cases, and this makes it impossible to represent all the aspects of the problem. Other than to serve as an example for the extensions previously proposed by the authors (1993), this paper also helps to separate aspects of this access control policy which are inherently monotonic from parts which are defined in a non-monotonic way, but can still be represented in a monotonic model.>

This papers gives a precise analysis of some of the delegation protocols described by V. Varadharajan et. al. (1991). They analysed the problem of delegation in distributed systems and proposed three delegation protocols-chained, nested and linked-based on different inter-object trust assumptions in the system. They also considered some delegation protocols for the Kerberos authentication system. The authors give an analysis of the chained, nested, and linked delegation protocols using the calculus for access control by M. Abadi et. al. (1991), and analyse the delegation protocols for Kerberos using the belief logic of R. Kaislar and V.D. Gligor (1991).>