Reference Monitors
A reference monitor is the mechanism used to control access by a set of subjects to a set of objects as depicted in Figure 2.2. The monitor is the subsystem that is charged with checking the legitimacy of a subject’s attempts to access objects, and represents the abstraction for the control over the relationships between subjects and objects. It should have the properties of being tamper-proof, always invoked, and simple enough to be open to a security analysis [14]. A reference monitor implements the “mechanism” part of the “separation of policy and mechanism” requirement.