Theoretical Computer Science Stack Exchange is a question and answer site for theoretical computer scientists and researchers in related fields. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top


I am looking for theoretical sources about the different manners to implement user access control.

Long version

I have almost finished all the stand-alone tools needed in my CMS.

I am not at the moment where I need to bring all these pieces together. Now what I would like to is to create a CMS (and an API) that is completely user-centric. This means a very strong, yet easy to use, rights management framework at the base of everything. A bit like unix/linux filesystems work (not the actual implementation, but in the sense that they are at the very core of the system).

This framework would need to account for special cases ("user can access this data until date x"), and implement per-action, or per-item rights ("user can edit articles, but not article233"), be completely abstract (not tied to any particular database), and not tied to any authentication system. Also, since any request would go through it, it needs to be quite optimized. Lastly, I want to keep it open for modularity.

This is quite a large project, and before getting into it, I'd like to gather as much theory about used rights management. I know about ACL (and have already implemented a few custom systems myself), but I am looking for a more abstract, high-level document, ideally, not tied to a particular language. In the article/book I envision, code samples would be rare, a few lines only, and coded in pseudo-code just to illustrate a point.

I've been looking on the net but can only find tutorials about how to implement ACL, or discussions about role-based access control, but nothing about, say, research in the field, innovative/alternative solutions, etc.

Anyone can advise a good book/webpage/resource about that?

share|cite|improve this question
It seems like a Software Engineering and HCI question and doesn't seem to me that the question is related to theoretical computer science. Could you please clarify why this is in the scope of cstheory? (Please check the FAQ to understand the scope of cstheory.) – Kaveh Nov 4 '11 at 21:11
Maybe you are correct as this does not involve mathematics. However, I feel since I am really asking for research on the matter and not examples or tutorials, I figured the people browsing csTheory would be most apt to answer. If you think the question does not apply, then I am sorry for wrong posting, and feel free to close it. – Xananax Nov 4 '11 at 21:23
I think programmers.SE (whose scope includes Software Engineering questions) and proposed site for HCI would be more appropriate places for this question. To me this seems off-topic for cstheory. – Kaveh Nov 4 '11 at 23:01
up vote 5 down vote accepted

I can't help you with your CMS, but a very good place to read about the logic of access control is Deepak Garg's PhD thesis, Proof Theory for Authorization Logic and Its Application to a Practical File System.

share|cite|improve this answer
I just barely begun reading it, but it seems to fit my needs. At least it has already identified and "nomenclatured" a large part of concepts I use without having a name for them. Helps me get a clearer picture. Thanks! – Xananax Nov 9 '11 at 12:57

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.