## 2 Fundamental Patterns for Access Control  
Access control models generally represent a few types of security policies and provide a formalization of these policies using some ad hoc notation. Four basic access control models are commonly used and they may be extended to include content and context-based access control, delegation of rights, hierarchical structurings of subjects (including roles), objects, or access types [10], temporal constraints, _etc._ Access control models can be defined for different architectural levels, including application, database systems, operating systems, and firewalls [11]. Access control models fall into two basic categories: mandatory models, where users' rights are defined by administrators and data may be labeled to indicate its sensitivity, and discretionary, where users administer the data items they create and own. Within this classification, there are several models for access control to information that embody general (application independent) policies. The most common are:  
* The _Multilevel model_ organizes the data using security levels. This model is usually implemented as a mandatory model where its entities are labeled indicating their levels. There are separate models for confidentiality and integrity and accesses are decided by enforcing two principles or generic rules. This model is able to reach a high degree of security, although it can be too rigid for some applications. Usually, it is not possible to structure the variety of entities involved in complex applications into strictly hierarchical structures. However, they can be useful for structuring the architecture of systems. * The _Access Matrix_ describes access by subjects (actors, entities) to protected objects in specific ways (access types) [10]. It is more flexible than the multilevel model and it can be made even more flexible and precise using predicates and other extensions. However, it is intrinsically a discretionary model in which users own the data objects and may grant access to other subjects. It is not clear who owns the medical or financial information and the discretionary property reduces security because it may not be possible to decide who will acquire a specific right. This model is usually implemented using Access Control Lists (lists of the subjects that can access a given object) or Capabilities (tickets that allow a process to access some objects), described in two patterns:* **Access Control List [12]**: controls access to objects by indicating which subjects can access an object and in what way. There is usually an ACL associated with each object. * **Capability [12]**: controls access to objects by providing a credential or ticket to be given to a subject for accessing an object in a specific way. * _Role-Based Access Control_ (RBAC), collects users into roles based on their tasks or functions and assigns rights to each role. Some of these models have their roles structured as hierarchies, which may simplify administration. * _Attribute-Based Access Control_ (ABAC). This model controls access based on properties of subjects or objects. It is used in environments where some or all subjects may not be pre-registered and where the effect of the context is important to decide access. These models have different ways of expressing their access constraints but they use a similar abstract concept of _Reference Monitor_ to enforce them. The Reference Monitor intercepts every access request and decides access based on the specific rules that apply to the request. We have presented patterns for all these models [2,3,13] and for the Reference Monitor [2,3]. We can generalize them into a model that includes a set of policies enforced by a common Reference Monitor:  
* **Policy-Based Access Control [12]**: models how to decide if a subject is authorized to access an object according to policies defined in a policy repository. Figure 2: Pattern diagram for access control.