Access Control Mechanisms

Some common access control mechanisms like ACL, RBAC, PBAC that are widely used in software systems.

1. Access Control List (ACL)

• ACL is a list of permissions attached to an object. The list specifies who or what is allowed to access the object and what operations are allowed to be performed on the object.

• In this example, it is a matrix of objects and permissions, similar to how file permissions are managed on Linux with chmod, and it is suitable for applications with relatively few objects.

• As the system grows, this model becomes hard to manage because the matrix becomes too large and complex. As a result, this model is no longer very common today.

2. Role-Based Access Control (RBAC)

• RBAC is a method where permissions are associated with roles, and users are assigned to these roles. Therefore, users gain permissions through their roles.

• RBAC links Entities -> Role, and from Role -> Permissions.

• For example, the Administrator role can inherit all permissions from the Manager role, which reduces the complexity of the permission matrix. Instead of assigning all permissions directly to Administrator, you only need to let Administrator inherit the permissions of Manager.

• Drawback: It is not fully fine-grained and cannot assign more specific permissions.

3. Policy-Based Access Control (PBAC):

• PBAC is built on Attribute Based Access Control (ABAC), which defines policies to express whether a request is allowed or denied.

• ABAC uses Attributes to describe the object being evaluated. Each attribute is a key-value pair, for example Department = Marketing. This allows ABAC to provide finer-grained authorization that fits many different contexts and business requirements.

• Ví dụ PBAC:

{
    "subjects": ["user:john", "user:katy", "user:perry"],
    "effect": "allow",
    "actions": ["catalog:delete", "catalog:update", "catalog:publish"],
    "resources": ["product:john-leman", "product:john-doe"],
    "conditions": {
        "IpAddress": {
            "addresses": ["192.168.0.0/16"]
        }
    }
}

• Advantages:
  • Fine-grained access control based on attributes
  • Scalibility
• Disadvantages:
  • Complexity