13 — Access Control
Access Control Models
Who can do what to which resource — and on what basis is that decision made?
| Model | Decision Basis | Strength | Weakness |
|---|---|---|---|
| DAC Discretionary | Owner decides; ACLs per resource | Flexible; intuitive ownership | Leaks via Trojans; malware inherits rights; hard global audit |
| MAC Mandatory | System labels (Top Secret/Secret/...) on subjects + objects. Bell–LaPadula. | Strong central policy; Trojan-resistant | Rigid; admin-heavy; poor commercial fit |
| RBAC Role-Based | Users → roles → permissions | Scales with org; matches jobs; easy audit | Role explosion; static context |
| ABAC Attribute-Based | Subject/object/action/environment attributes | Most expressive; dynamic | Policy complexity; harder "who has what" audit |
Theory — the classic policies behind MAC
Bell–LaPadula (confidentiality, military)
no-read-up: subject s may read object o iff clearance(s) ≥ classification(o)
no-write-down: s may write o iff classification(o) ≥ clearance(s)
# Info flows UP only — Secret can't leak to Unclassified.
Biba (integrity — the mirror) + Clark-Wilson
Biba no-write-up / no-read-down: low-integrity data can't taint high-integrity objects.
Clark-Wilson: commercial integrity via well-formed transactions + separation of duties.
Lattice: labels form a partial order (Unclassified < Secret < Top Secret); compartments add sets (e.g. {NATO, Crypto}) compared by ⊆.Evolution
DAC → MAC → RBAC → ABAC
↑ ↑ ↑ ↑
owner state role attributes
based labels based + environment
Decision logic
# DAC
if (owner_of(resource).grants(user, action)) PERMIT
# MAC
if (clearance(user) ≥ classification(resource)) PERMIT
# RBAC (with hierarchy: senior roles inherit junior perms)
if (role(user) ∈ permitted_roles(resource, action)) PERMIT
# ABAC (next page in full)
if (policy(subject_attrs, object_attrs, env_attrs, action)) PERMIT
Order of evolution
Each model adds expressiveness. RBAC is a special case of ABAC where the only attribute is "role".Exam one-liner: DAC=owner says, MAC=labels say (BLP up-only), RBAC=role says, ABAC=attributes say.