Data Protection and Security

V

Access Control

V.I

Introduction

Typical subjects are users and processes and typical objects are files. Other computer resources like memory, printers, or nodes in a computer network are other object types. However this does not mean subjects and objects are strictly distinct. You can think of a situation where an entity can be a subject in one access request and an object in another. These two terms merely distinguish between the active party and passive party.

Access control can work in a number of different levels as shown below.

For instance, if you would like to read a file in your desktop computer, the access right is given by the operating system (more precisely the reference monitor of the operating system) whereas if you login to an e-banking application, the access control is done by the application running above the operating system of the server machine (e.g. using HTTP authorization).

NOTE: Authorization is a similar term that is sometimes used instead of access control. However access control is a more general term and it is better to use authorization specifically for the act of checking to see if a user has the proper permission for having an access.

Figure V.I-II

Access Control Levels. [click to enlarge]