Home › Security Architecture & Engineering

Harrison-Ruzzo-Ullman (HRU) Model Explained — Security Models (Part 7)

Security Architecture & EngineeringCISSP

Harrison-Ruzzo-Ullman formalizes how access rights stay consistent as commands run — and answers one of the most famous theoretical questions in access control: can a right ever leak? In Part 7, we cover the model's formal structure, how commands are built from primitive operations, and the safety-problem result that made this model famous.

What you will learn

• What the Harrison-Ruzzo-Ullman (HRU) model is, and how it extends Graham-Denning
• The formal structure: subjects, objects, and the access matrix
• Primitive operations, and how commands combine them with a precondition
• A worked command example: grant_read
• Why commands are all-or-nothing
• The Safety Problem — can a right ever leak into the system?
• The headline result: undecidable in general, decidable for mono-operational commands

Part of the series: Security Models Explained — Overview (Part 1)

1. Security Models Explained — Overview (Part 1)
2. Bell-LaPadula Model Explained — Security Models (Part 2)
3. Biba Model Explained — Security Models (Part 3)
4. Clark-Wilson Model Explained — Security Models (Part 4)
5. Brewer-Nash Model Explained — Security Models (Part 5)
6. Graham-Denning Model Explained — Security Models (Part 6)
7. Harrison-Ruzzo-Ullman (HRU) Model Explained — Security Models (Part 7)
8. Take-Grant Model Explained — Security Models (Part 8)
9. Noninterference Model Explained — Security Models (Part 9)

More in Security Architecture & Engineering

• Cryptography Explained — Overview (Part 1)
• Secure Access Service Edge (SASE) Explained