Sign in Subscribe

Explain the concept of access control models, such as DAC, MAC, and RBAC.

Last updated on 


Access control models are security mechanisms that determine who or what can access specific resources in a computing environment. Three prominent access control models are Discretionary Access Control (DAC), Mandatory Access Control (MAC), and Role-Based Access Control (RBAC). Let's delve into each of these models in technical detail:

  1. Discretionary Access Control (DAC):
    • Overview:
      • DAC is a decentralized access control model where the owner of a resource has the discretion to control access to that resource.
      • Access decisions are based on the identity of the requesting entity and the permissions assigned by the resource owner.
    • Technical Details:
      • Each resource has an associated Access Control List (ACL) that enumerates the entities allowed to access it and their corresponding permissions (read, write, execute).
      • The ACL typically contains entries for users and groups, with specific permissions associated with each entity.
      • Access decisions are made by comparing the identity of the requesting entity with the ACL entries.
    • Example:
      • In a Unix file system, each file has an owner, a group associated with it, and permissions for the owner, group, and others.
  2. Mandatory Access Control (MAC):
    • Overview:
      • MAC is a centralized access control model that enforces access policies based on system-wide security labels and rules.
      • Access decisions are made by the operating system or a security kernel, not the resource owner.
    • Technical Details:
      • Each entity (subject or object) in the system is assigned a security label based on attributes such as sensitivity, classification, or clearance.
      • Access decisions are made by comparing the security labels of subjects with the security labels of objects, according to predefined security policies.
    • Example:
      • SELinux (Security-Enhanced Linux) is an example of a MAC system where each process and file is assigned a security context, and access decisions are based on security policies.
  3. Role-Based Access Control (RBAC):
    • Overview:
      • RBAC is an access control model that assigns permissions to roles, and users are assigned to one or more roles.
      • Access decisions are based on the roles a user holds rather than the user's identity directly.
    • Technical Details:
      • Entities in the system include users, roles, and permissions.
      • Users are assigned to roles, and roles are assigned specific permissions.
      • Access decisions are based on the roles a user possesses rather than individual user permissions.
    • Example:
      • In a banking application, there might be roles such as teller, manager, and administrator. Users are assigned to these roles, and each role has specific permissions related to their responsibilities.

DAC gives discretion to resource owners, MAC enforces system-wide policies based on labels, and RBAC simplifies access control by organizing permissions into roles assigned to users. The choice of access control model depends on the security requirements and structure of the environment.