Graham-Denning model

Graham-Denning answers a question the flow models skip: where do subjects, objects, and rights come from in the first place? Bell-LaPadula and the Biba model assume clearances and labels already exist. Graham-Denning defines the lifecycle underneath with eight primitive protection rules: create object, create subject, delete object, delete subject, read access right, grant access right, delete access right, and transfer access right.

The model works on an access control matrix of subjects against objects, with each cell holding rights, and it introduces ownership and control as the authorities for changing that matrix. That machinery is what a discretionary access control system implements when an owner grants or revokes permissions. Its successor, the Harrison-Ruzzo-Ullman model, extends the same matrix approach to reason about whether rights can leak. The Graham-Denning guide walks through all eight rules.

Exam relevance: Graham-Denning is a recognition question, not a scenario question. The tell is “eight rules” or any phrasing about securely creating and deleting subjects and objects. If the option list includes Harrison-Ruzzo-Ullman, remember HRU is the generalisation that analyses rights leakage; Graham-Denning defines the eight operations.