Enhanced security for computer system resources with a resource access authorization control facility that creates files and provides increased granularity of resource permission

Provided is a scheme for implementing flexible control of subject authorizations (i.e. the authorizations which users or processes have) to perform operations in relation to computer resources. The methods, computer systems and authorization facilities which are provided by the invention enhance the security provisions of operating systems which have only very limited authorization facilities, by mapping the available operating system permissions to specified resource authorities for each of a set of aspects or characteristics of a computer system resource. Thus, the standard operating system permissions (e.g. read, write, execute) can have different meanings for different resource aspects, and an individual subject can have separate authorization levels set for the different resource aspects. The mappings between authorities and the available permissions may be different for different types of resources. The invention provides great flexibility in setting the authorizations that a subject may have in relation to particular resources.

FIELD OF THE INVENTION
 The present invention relates to security for computer system resources,
 and more particularly to computer systems having flexible
 subject-authorization control and to methods and computer system
 components providing such subject-authorization flexibility in resource
 security controls.
 BACKGROUND AND PRIOR ART
 Since many data processing applications involve highly confidential and
 business critical information (for example national security applications,
 financial applications), computer resource security is of utmost
 importance. In addition to physical controls (such as building security
 locks) and procedural controls (such as changing passwords), logical
 controls such as access authorization control, authentication (checking
 that a user is who they say they are) and cryptographic techniques are
 important. Where large numbers of user terminals are interconnected in a
 distributed processing network, with storage devices and data files stored
 throughout the network commonly being accessible from a plurality of
 terminals, the provision of effective security is a significant technical
 problem.
 Modern computers are sold with operating system software installed therein
 for controlling the execution of programs and providing basic services
 such as resource allocation, scheduling, input and output control, and
 data management. A "resource" may be any facility or element of a
 computing system or operating system required by a task (for example
 storage, input/output devices, processing units, printers, data sets,
 files, or programs). Many operating systems, such as IBM's MVS/ESA and
 OS/400 operating systems, additionally provide comprehensive facilities
 for defining and managing system security (e.g. MVS/ESA has the RACF
 facility). (IBM, MVS/ESA, OS/400 and RACF are trademarks of International
 Business Machines Corporation). In particular, such operating systems
 provide facilities for defining the access authorizations which particular
 subjects have in relation to specific system resources. Subjects are the
 active components in a network, such as processes, users or groups of
 users. The subjects are said to be authorised to perform certain
 operations, or to have particular "capabilities" or "permissions" with
 respect to a resource. As an example, a subject may be authorised to
 update a specific file.
 However, not all operating systems provide security facilities of such
 sophistication, or even any security. In particular, the technical problem
 of providing effective and comprehensive security is compounded in open
 distributed systems since the "open" operating systems themselves
 generally have only limited security facilities built into them, and
 because of complexities which are not encountered with centralised
 networks. For example, a security system for a distributed network must
 have the ability for a user to authorize a computer to operate on the
 user's behalf and only to do so while authorised.
 An open distributed processing environment is described in "Security
 Architecture for Open Distributed Systems", S. Muftic et al, Wiley, 1993,
 as one in which computer systems with diverse applications, resources,
 users, and locations exchange and process various types of data and
 interact without any previous strict arrangements. An open systems
 platform is the term given to systems developed for such an environment
 comprising computer system hardware and the associated operating system
 software which it runs. The UNIX operating system developed by Unix System
 Laboratories and IBM's AIX operating system are examples of open operating
 systems (AIX is a trademark of International Business Machines Corporation
 and UNIX is a trademark licensed through X/Open Company Limited). Computer
 networks constructed within such an open environment generally have less
 sophisticated security provision than networks of computers running
 operating systems such as the OS/400 operating system. Typically,
 application programs which are run on open systems platforms are
 restricted to very basic authorization mechanisms if they are used at all.
 The increasing importance of open systems solutions for commercial data
 processing and inter-enterprise computer networking has increased the need
 for improved protection of users, resources and assets in open computer
 networks.
 For example, the file system authorization facilities provided by the UNIX
 operating system comprise only the following three basic permissions per
 file:
 READ Subject can view the contents of a file;
 WRITE Subject can modify the contents of a file;
 EXECUTE Subject can execute the file (the file being a program or script).
 Each permission is represented by a one bit field. The permissions are
 defined to enable three categories of subject or user to be distinguished,
 one set of bits being defined in each case. The first category is the
 owner of the file, the second is any user in the group of users associated
 with the file, and the final category is every other user. A file may be
 set up, for example, as readable and writable by its owner, readable by
 the group, and inaccessible to any other user.
 The permissions on directories are similarly simple, differing slightly
 from the permissions on files, as follows:
 READ User can list the directory;
 WRITE User can create or delete files in this directory;
 EXECUTE User can search the contents of the directory and make it the
 current directory.
 This level of granularity of authorization clearly has very little
 flexibility and is not sufficient for many purposes--the authorization
 access controls are not expressive enough to specify a comprehensive
 security policy and the fact that the security facilities only apply to
 files and directories is a severe limitation. For example, a company may
 wish to transfer an existing commercial application program which deals
 with sensitive information and which was written for one computer system
 onto an open system platform (referred to as "porting" the application to
 the open system) and yet to maintain the sophisticated security control
 which was available on the first system. The authorization permissions of
 the UNIX system are too coarse to permit this without additional
 authorization control services.
 The fact that the UNIX operating system does not provide an effective
 mechanism for establishing a secure computer system has already been noted
 in the prior art, for example in EP-A-0325777 which describes a mechanism
 for an open distributed system for auditing information which must be
 securely protected so that actions affecting security may be traced to the
 responsible user. EP-A-0325777 thus relates mainly to detection and
 indication of security problems, rather than to mechanisms for prevention
 of computer resource misuse.
 One solution for systems with limited security provision is to rely on
 security mechanisms being implemented by the applications which run on the
 system, appropriate security measures being built into the applications on
 an individual basis. However, there remain the problems that such security
 measures tend to be of limited scope and applicability and are usually
 incompatible in larger distributed systems. The drawbacks of providing
 security in each application on an individual basis are identified by
 Muftic et al in "Security Architecture for Open Distributed Systems",
 Wiley, 1993, as follows:
 1. The integration and functional completeness of the overall security
 system in a broader operational environment may not be feasible;
 2. It is difficult to analyze and evaluate the overall strength of such a
 global security system;
 3. Implementation, and therefore usage, of individual security algorithms,
 mechanisms, and services may be duplicated, or interfere with one another;
 4. It is not easy to define a formal description of the global security
 system, suitable for its rigorous analysis; and
 5. It is very inconvenient to establish a common security architecture and
 policy for integration and optimisation of individual security services.
 The above-mentioned book goes on to describe the authors' views on the
 desirable features, protocols, services and mechanisms of a comprehensive
 security system architecture--i.e. setting out proposals for an
 architecture rather than methods of implementing flexible resource
 security using the existing security facilities of open distributed
 systems.
 Other prior art systems have sought to provide additional preventative
 security mechanisms on top of the basic facilities of the operating
 system. EP-A-0561569 discloses restricting user access to a protected
 resource by requiring a call to a user monitor command, specifying the
 protected resource as a parameter, the user monitor command then checking
 that predetermined conditions are satisfied before permitting access to
 the protected resource.
 U.S. Pat. No. 5,173,939 describes a basic access control model in which a
 reference monitor examines requests for access to particular system
 resources and decides whether to grant that access based on the resource,
 who the request is from, the resource operation specified in the request,
 and definitions of which users are listed as being authorised to perform
 the requested operation. U.S. Pat. No. 5,173,939 discloses attaching to
 particular objects or resources an access control list (ACL) which is a
 list specifying which users are authorised to perform a specific
 operation, seeking to minimize the information which must be retained in
 the ACL by defining a hierarchy of levels of authorization (i.e. if one
 entity is authorised to perform an operation then all entities having a
 higher authorization level are also authorised and so need not be listed
 in the ACL). Despite the reduction of information stored in the ACL's,
 such a system of storing authorization lists in association with system
 resources has an undesirable maintenance overhead. The problem of the
 inflexibility of security provision in open distributed systems is not
 addressed.
 U.S. Pat. No. 5,220,604 discloses an authorization level hierarchy and a
 method for excluding certain groups from resource access. U.S. Pat. No.
 5,220,604 describes the resources of the distributed computer system
 implementing their own security policy, the resource itself determining
 the access rights of a user when the user requests resource access and
 then the resource deciding whether to allow or reject the request. This is
 distinguished from the centrally managed resource access determinations
 which are typical in non-distributed systems. Systems such as described in
 U.S. Pat. No. 5,220,604 often rely on users being assigned user names,
 with access to resources being on the basis of the access rights known to
 be associated with a particular user name. This may be implemented by each
 system resource including a listing of all users and their access rights
 and user names, but the overhead of maintaining and updating all of the
 access control lists is considerable if numerous system resources exist
 and so this solution is often impractical. Alternatively, there may be a
 central list accessible to all resources of the network, with a global
 naming service providing user name resolution. In the invention of U.S.
 Pat. No. 5,220,604, an access control list provided for each system
 resource lists all possible access privileges and the users that have
 these privileges. When a user requests access to a resource, the user's
 name is compared to the resource's access control list; if the name is on
 the list then access will be granted. U.S. Pat. No. 5,220,604 provides no
 solution to the specific problem of the inflexibility or non-granularity
 of the authorization facilities which are available on open distributed
 systems.
 SUMMARY OF INVENTION
 The present invention makes use of the fact that a number of distinct
 "aspects" or characteristics are typically associated with any resource. A
 resource may be thought of as one instance of a particular resource class,
 with the class of resource to which the instance belongs being one
 "aspect". Configuration information associated with the particular
 resource instance may be a second aspect, and security attributes
 concerned with the ability to grant and revoke authorization for the
 resource instance may be a third aspect. Such different aspects or
 characteristics of a resource will be exemplified and described further
 below as part of the detailed description of an example embodiment of the
 invention. The significant point to note is that there are generally a
 number of separately identifiable aspects or characteristics associated
 with a typical system resource.
 The present invention provides a method of implementing resource access
 authorization control in a computer system, the method comprising: for
 computer resources which are to be protected, identifying a set of
 resource aspects (e.g. resource class and resource data), particular
 instances of which are characteristic of a particular computer resource;
 defining resource authorities which subjects may have for each of said
 resource aspects, and storing said authorities in association with said
 resources; and defining subject authorizations for resource access in
 accordance with said defined resource authorities for said resource
 aspects, such that the subject authorizations are defined at the level of
 granularity of resource aspects.
 In this context, the word "subject" may refer to a user or group of users
 of the computer resources, to an application program, or to another active
 entity of a computer network by or from which a resource operation may be
 requested. Authorities are the access rights which subjects have. The
 combination of an authority which a subject has and the relevant resource
 aspect to which the authority applies may be referred to as a "capability"
 of the subject.
 The present invention preferably provides a flexible method of implementing
 resource access authorization control for computer resource security for
 operating systems in which a set of operating system permissions are
 defined for use in the authorization of subjects to perform operations in
 relation to specific resources, the method comprising: creating a set of
 files including a set of definitions of correspondence between the defined
 operating system permissions and specified resource authorities for each
 of a plurality of different aspects of a resource; storing said created
 files for association with a resource to be protected; setting subjects'
 authorizations in relation to said resource in terms of the defined
 operating system permissions, thereby defining the authorities which said
 subjects have in relation to the different resource aspects.
 When a subject attempts to perform an operation in relation to a protected
 resource, subject authorization testing in accordance with an embodiment
 of the present invention includes the step of comparing the operating
 system permissions of the subject with said set of definitions of
 correspondence within the created files to determine whether the subject
 is authorised to perform the operation in relation to the protected
 resource. Such testing may use the standard methods which are provided by
 many open systems operating systems to enable applications to test the
 access rights which users have against files (i.e. using the standard
 methods to confirm user permissions and then comparing those permissions
 with the definitions of correspondence within the authorization files).
 The files which are created according to the invention for use in setting
 and testing subject authorizations are preferably operating systems files
 and are referred to hereafter as authorization files or operating systems
 files.
 The steps of creating, storing and setting may be performed by an
 authorization control service software component of a computer system.
 This may be under the control of a systems programmer, but it is preferred
 for authorisation files to be built automatically when a resource is
 created. The authorities for a particular resource type and the rules for
 mapping authorities to operating system permissions are predefined for the
 system to enable automated building of authorisation files. It is also
 preferred to automatically assign default authorisations to users when
 they create a resource. The default settings for subjects' authorisations
 may be definitions stored in administration files of the authorisations
 for named subject groups.
 The present invention also provides a computer resource access
 authorization control facility for use with operating system software
 having security facilities including a set of definitions of operating
 system permissions for use in the authorization of subjects of system
 resources to perform operations in relation to said resources, the control
 facility including: means for creating a set of files including a set of
 definitions of correspondence between said operating system permissions
 and specified resource authorities for each of a plurality of different
 aspects of a resource; means for storing said created files in association
 with a resource to be protected; means for setting subjects'
 authorizations in relation to specific resources using said operating
 system permissions, thereby to set the authorities which said subjects
 have in relation to the different resource aspects; and means, responsive
 to a subject requirement for an operation to be performed, for comparing
 the subject's operating system permissions with the set of definitions of
 correspondence within the created files, thereby to determine whether the
 subject is authorised to perform the operation.
 The present invention thus recognises that each of a plurality of different
 resource aspects may, for a particular instance of a resource, be
 considered separately and may beneficially have independent access
 authorities defined for each of them--i.e. the different aspects of a
 resource may each justify a different set of authority definitions for the
 access-authorization-controlled performance of operations on resources.
 Also, the different aspects of a resource may justify protection at a
 different level of granularity (e.g. some aspects being controlled at the
 resource instance level and others at the resource class level). The
 provision of different levels of granularity of access control for the
 different aspects of a resource is made possible by the present invention.
 An important advantage of the invention is that it enables access
 authorizations to be set for computer resources other than files and
 directories. Computer systems and computer programs often require security
 to be provided for many objects or resources which they include or
 process, in addition to files and directories. Because the authorities for
 particular resource aspects can, according to this invention, be defined
 in accordance with actual security requirements for particular resources,
 a resource security system of great flexibility is made possible.
 The present invention preferably uses the available operating system
 permissions, but increases the granularity and flexibility of the
 available subject authorizations by relating operating system permissions
 to specified resource authorities for the different aspects of a resource.
 The use of the existing security facilities has the advantage that these
 facilities have already been designed to deal with large numbers of
 objects (e.g. files) and have proven good performance. The invention
 enables authorization control to be at the granularity level of individual
 resource aspects and thereby enables the provision of a much more flexible
 and comprehensive authorization scheme for open distributed systems than
 is possible in systems in which the resource is the smallest entity in
 relation to which authorization controls are made available. For example,
 the invention enables the provision of flexible access authorization
 control using the basic three file permissions READ, WRITE and EXECUTE of
 the UNIX operating system.
 The invention also enables the use of existing system interfaces, which
 reduces development cost and avoids system integration problems as
 compared with security mechanisms which necessitate the definition of new
 interfaces. Provision of a complex security manager component in each
 computer system of the network is not essential. A further advantage is
 that the invention does not require proliferation of security related
 data, which would itself need additional protection, as existing security
 data may be used.
 Each resource to be protected is thus preferably associated with a set of
 operating system files (known as authorization files) which preferably
 contain no executable files or data other than the definitions of
 correspondences between the operating system permissions which particular
 subjects may have and the resource authorities of different resource
 aspects. Operating system services are used against the authorization
 files to set and to test the authorizations of particular subjects. The
 basic permissions of the operating system may be limited to, for example,
 three independent permissions per file and yet a flexible authorization
 scheme can be implemented if each resource has a number of authorization
 files associated with it in accordance with the present invention. The
 invention recognises the desirability of enabling each aspect of a
 resource to have a level of protection which is independent of the other
 aspects, and by enabling independent levels of security for different
 aspects the invention provides a flexible scheme for implementing resource
 security.
 It is thus preferred that the present invention uses defined mappings
 between operating system permissions and resource authorities in the
 setting and testing of the operating system permissions that particular
 subjects have, providing a flexible scheme for defining authorizations and
 a method of authorization testing for use when subjects attempt to perform
 tasks in relation to protected resources, authorization flexibility being
 achieved even if the operating system permissions themselves are of very
 limited granularity and applicability. The mappings (i.e. the redefined
 "meanings" of the operating system permissions) can be varied to provide
 different styles of access control and to cater for different
 requirements.
 The authorization files which define the authorities and the correspondence
 with permissions for the aspects of a particular resource may be stored
 either with the resources to which they apply or may be stored centrally
 (i.e. separate from the resources), but in either case the authorisation
 files are preferably held by the computer system entity which is
 responsible for this aspect of resource security, organised within a
 directory tree to enable easy access using a naming convention such as is
 known in the art. A subject's permissions or "capabilities" are preferably
 held in system administration files which are accessed by test processes
 when resource access is requested.
 In a preferred embodiment of the invention, file permissions are used to
 represent resource authorities and directory permissions are used to
 protect the authorization files which store the mappings between
 authorities and operating system permissions. A preferred embodiment uses
 a single authorisation file to represent each aspect of a resource for
 security purposes.
 The invention also provides a computer system including computer resource
 access authorization control means defining, for computer resources for
 which access authorisation control is required, permissions which subjects
 may be given to perform operations in relation to said resources, said
 means for defining being adapted to define permissions for each of a
 plurality of different aspects of said resources, particular instances of
 said resource aspects being characteristic of a particular computer
 resource.
 The invention also provides a computer system having operating system
 software installed therein, which operating system software's security
 provision includes a set of definitions of operating system permissions
 for use in the authorization of subjects of system resources to perform
 operations in relation to said resources, the system including: means for
 creating a set of operating system files including a set of definitions of
 correspondence between said operating system permissions and specified
 resource authorities for each of a plurality of different aspects of a
 resource; means for storing said operating system files in association
 with a resource to be protected; means for setting subjects'
 authorizations in relation to specific resources using said operating
 system permissions, thereby to set the authorities which said subjects
 have in relation to the different resource aspects; and means, responsive
 to a subject requirement for an operation to be performed, for comparing
 the subject's operating system permissions with the set of definitions of
 correspondence within the operating system files, thereby to determine
 whether the subject is authorised to perform the operation.
 If the comparison shows the subject to be authorised, the operation is
 performed.
 The present invention is preferably implemented in application-supporting
 communications software (often referred to as "middleware"), which can be
 installed at each node of a distributed network, so as to provide
 flexibility of authorization on top of the basic operating system
 facilities without requiring application programs themselves to implement
 their own security control measures.

FIG. 1 is a simplified schematic representation of a computer system
 showing the layered structure of the major system components. A typical
 distributed data processing network comprises a plurality of disparate
 computer systems 10, which may range from desktop systems to mainframe
 systems, each of which has particular application programs 20 running on
 the system which applications are adapted to the particular operating
 system 30 of the system on which they run. To enable the applications to
 exchange information across the network links 50, the applications
 themselves often have facilities enabling them to work with applications
 which run on a different selected operating system and hardware platform.
 That is, code is written into an application program, which converts or
 interprets information exchanges sent to/from the application from a first
 format to a second format. A recent advance on this requirement to re-code
 individual applications to enable them to communicate with applications on
 different platforms is the development of application-enabling
 communications managers 60, which shield the applications from the
 complexities of the network and manage the work of providing secure
 inter-program communications. Such application support is provided by
 IBM's MQSeries commercial messaging software products.
 IBM's MQSeries commercial messaging products are described in the following
 publications which are available from IBM: MQSeries Message Queue
 Interface Technical Reference, (IBM document number SC33-0850-01) and "IBM
 Messaging and Queuing Series--An Introduction to Messaging and Queuing"
 (IBM document number GC33-0850-00), which are incorporated herein by
 reference. The MQSeries products provide facilities for the management of
 asynchronous communication using message queues, allowing application
 programs to communicate with each other simply by "putting" messages onto
 outgoing message queues to send them and "getting" messages from their
 incoming queues when they wish to receive them. The applications send and
 receive messages (having "connected" themselves to specific queue managers
 and "opened" a message channel) using commands defined as part of an
 application programming interface (API) 70 on the queue manager. All of
 the activity associated with reliable message communication other than the
 issuing of the relevant API commands to "put" and "get" a message is
 carried out by the MQSeries products--this activity includes maintaining
 message queues, maintaining the relationships between programs and queues,
 handling network restarts, and moving messages around the network. To
 provide this communication management, there is an MQSeries queue manager
 installed on each processor of the network.
 The benefits of the application support provided by these messaging and
 queuing products includes the removal of constraints on application
 structure and on program-to-program relationships, the avoidance of
 programmers having to write communication code, ease of code reuse, the
 enabling of efficient time-independent scheduling of resources, reduced
 vulnerability to network failures and assured message delivery.
 The resources that a queue manager owns and manages are protected from
 unauthorised access, to avoid loss or disclosure of the information
 transferred under the queue managers' control. The following must all be
 protected from unauthorised access or change by any unauthorised user or
 process:
 Connections to a queue manager;
 Access to MQSeries objects such as queues, channels, and processes;
 Commands for queue manager administration;
 Access to MQSeries messages; and
 Context information associated with messages.
 IBM's "middleware" application-enabling queue manager product for the AIX
 operating system platform (which product is known as IBM MQSeries for AIX,
 and is commercially available from IBM) controls access to queue manager
 resources through an authorization service installable component known as
 the Object Authority Manager (OAM) 80. This component and other security
 provision are described in "MQSeries for AIX--System Management Guide"
 (IBM document SC33-1373-01) and in "MQSeries Programmable System
 Management" (IBM document SC33-1482-01), which documents are incorporated
 herein by reference.
 The present invention is implementable as an alternative to the currently
 available OAM component of the product IBM MQSeries for AIX. The Object
 Authority Manager (OAM) manages users' authorisation to manipulate
 MQSeries objects, such as queues, process definitions, and channels. The
 OAM provides a command interface through which to grant or revoke access
 authority to an object for a specific group of users. The OAM makes the
 decision of whether to allow access to a particular resource.
 IBM's AIX operating system incorporates the common security features found
 in most open systems operating systems, including file security for read,
 write and execute authority at the user and group level, and limitations
 on certain system management functions to specific system group level
 authority.
 The OAM exploits the security features of the underlying AIX operating
 system, using AIX user and group ID's. Users can access queue manager
 objects only if they have the required authority. Managing access
 permissions to resources is based on user groups (i.e. groups of
 principals). A user can belong to one or more AIX groups. The OAM
 maintains authorizations at the level of groups rather than individual
 users. The mapping of users to group names is carried out within the OAM
 and operations are carried out at the group level. The authorizations that
 a user has are the combination of the authorizations of all the groups of
 which it is a member (i.e. its group set).
 The OAM allows control of the access to MQSeries objects through the
 Message Queue Interface (MQI), which is a high level application
 programming interface of the MQSeries products. When an application
 program attempts to access an object, the OAM checks if the user making
 the request has authorization for the operation being requested. In
 particular, this entails protecting queues and messages on the queues from
 unauthorised access. Permission to use queue manager administration
 commands (e.g. to create a queue), control commands (e.g. in creating a
 queue manager or starting a command server), or PCF commands is also
 controlled.
 Implementations of the methods and the authorisation service according to
 the present invention will now be described in detail.
 As noted above, computing resources may be considered as instances of
 specific resource classes. Also noted above is the fact that a number of
 different aspects or characteristics are generally associated with a
 resource, with the different aspects possibly requiring different levels
 of security protection. For example, the resource may be a communications
 link between two machines and the class to which the link belongs may
 depend on the particular communications protocol (SNA, TCP/IP, NetBIOS,
 etc). The class defines the attribute types associated with links of a
 particular type, but the instances of those attributes are associated with
 the objects themselves. In addition, there may be data associated with
 particular objects--which in the case of the communications link example
 may be data waiting to be transmitted over the link. Also, there is a
 security aspect which relates to the ability of subjects to grant or
 revoke authorization to the resource for other subjects (i.e. the
 authority to modify others' authorizations, or to read others,
 authorizations, rather than relating to access to the resource itself).
 Thus, a typical system resource has the following four different aspects:
 Resource Class--The class of resource to which the resource instance
 belongs;
 Resource Attributes--Data, typically configuration information, associated
 with the particular resource instance;
 Resource Security--Attributes concerned with the ability to grant and
 revoke authorization for the object instance;
 Resource Data--Data associated with the object instance.
 Although it will be understood by a person skilled in the art that various
 alternative or additional resource aspects may be defined or identified,
 the above described aspects are utilised in an embodiment of the present
 invention which provides flexible resource security as described below.
 Mapping Operating System Permissions to Resource Authorities
 Operating system permissions are mapped to resource authorities for
 individual aspects of a system resource. The possible permissions
 associated with each aspect of a resource are represented by a single
 operating system file. The following Table 1 defines the correspondence
 between operating system file permissions and resource authorities for the
 different resource aspects:
 TABLE 1
 RESOURCE AUTHORIZATION ASSOCIATED
 WITH OPERATING SYSTEM PERMISSIONS
 OPERATING RE-
 SYSTEM SOURCE RESOURCE RESOURCE RESOURCE
 PERMISSION DATA ATTRIBUTES SECURITY