Abstract
What may one expect from a theory of protection, and what framework does one have to build a satisfactory theory? These are the principal issues discussed in this paper. A generalized formal model of protection systems is proposed as a framework for a theory of protection. The paper discusses the relevance of the proposed model to the problems encountered in the design of protection systems. Also, the manner in which the model extends other existing models is pointed out. In the context of the model, some of the consistency, implementation and reliability problems that require further study than pointed out.