Confinement
Allowing a borrowed program to have access to data,
while ensuring that the program cannot release the
information.
Descriptor
A protected value which is (or leads to) the physical
address of some protected object.
Discretionary
(In contrast with nondiscretionary.) Controls on access
to an object that may be changed by the creator of the
object.
Domain
The set of objects that currently may be directly
accessed by a principal.
Encipherment
The (usually) reversible scrambling of data according
to a secret transformation key, so as to make it safe for
transmission or storage in a physically unprotected
environment.
Grant
To authorize (q. v.).
Hierarchical control
Referring to ability to change authorization, a scheme
in which the record of each authorization is controlled
by another authorization, resulting in a hierarchical
tree of authorizations.
List-oriented
Used to describe a protection system in which each
protected object has a list of authorized principals.
Password
A secret character string used to authenticate the
claimed identity of an individual.
Permission
A particular form of allowed access, e.g., permission to
READ as contrasted with permission to WRITE.
Prescript
A rule that must be followed before access to an object
is permitted, thereby introducing an opportunity for
human judgment about the need for access, so that
abuse of the access is discouraged.
Principal
The entity in a computer system to which authorizations
are granted; thus the unit of accountability in a
computer system.
Privacy
The ability of an individual (or organization) to decide
whether, when, and to whom personal (or
organizational) information is released.
Propagation