Permission model DAC ACL RBAC ABAC

Access control mode

Access control	Introduce
Autonomous access control (DAC,Discretionary Access Control)
Enforce access control (MAC,Mandatory Access Control)
Access control list （ACL,Access Control List）	What kind of behavior does the subject use to access object resources
Role based access control (RBAC,Role-based Access Control)	user 、 role 、 jurisdiction （ resources 、 operation ）
Attribute based access control (ABAC,Attribute-based Access Control)	According to the entity properties 、 Environmental properties 、 Operation attribute for permission control

ACL

What kind of behavior does the subject use to access object resources
Access entity (Subject), Access resources (Object) And access methods (Action)
The main body 、 object 、 Behavior

• The main body ： user , role
• object ： resources
• Behavior ： Read write execute

RBAC

RBAC There are several versions

• RBAC0： user , role , jurisdiction （ resources , operation ）
• RBAC1：RBAC0+ Role inheritable （ The role of father and son ）
• RBAC2：RBAC0+ Role restrictions （ Static limit , Dynamic limits ）
• RBAC3： A combination of RBAC0,RBAC1,RBAC2

user 、 role 、 jurisdiction （ resources 、 operation ）

RBAC0

RBAC1

RBAC2

SSD( Static separation of duties )

• Role mutual exclusion constraint ： Avoid stealing
• The number of roles is constrained ： Users have a limited number of roles , Roles have limited permissions
• Role level constraints ： You must first lower level roles , To have high-level roles

DSD( Dynamic separation of duties )

• In a conversation , The user owns 3 A character , Can only activate 1 A character

RBAC3

ABAC

According to the entity properties 、 Environmental properties 、 Operation attribute for permission control
Suitable for complex permission requirements , All permission requirements can be met

contrast RBAC-ABAC

Model	characteristic
RBAC	The larger the quantities are , The greater the role and authorization relationship that needs to be maintained
ABAC	Suitable for complex scenarios , Finer particle size , More policies