DAC,MAC,RBAC
1. Introduction to Access Control
Access control is a fundamental security mechanism used in computer systems to regulate
how users interact with system resources such as files, databases, applications, and network
services. It defines rules and policies that determine who is allowed to access specific
resources and what actions they are permitted to perform. Without proper access control,
sensitive information can be exposed to unauthorized users, leading to data misuse, security
breaches, and loss of confidentiality.
The primary purpose of access control is to protect information by ensuring that only
authorized users can view, modify, or manage resources. Access control helps enforce
security principles such as confidentiality, integrity, and availability by preventing
unauthorized access while allowing legitimate users to perform their assigned tasks. It also
supports accountability by tracking user activities and ensuring compliance with
organizational security policies.
To meet different security and operational requirements, various access control models have
been developed. Each model follows a specific method for granting and managing
permissions based on factors such as user identity, system policies, or organizational roles.
Among these models, Discretionary Access Control (DAC), Mandatory Access Control
(MAC), and Role-Based Access Control (RBAC) are the most commonly used and studied in
information security systems.
Access control is a critical concept in computer systems that determines how users are
allowed to access resources such as files, databases, applications, and system services. As
systems grow in size and complexity, managing access to sensitive information becomes
increasingly important. Unauthorized access can lead to data leakage, misuse of resources,
and serious security breaches. To prevent such issues, access control models are used to
define clear rules and policies governing user permissions.
Fig 1. Access Control Models
Government Polytechnic, Achalpur Page 1
DAC,MAC,RBAC
Over time, several access control models have been developed to address different security
and administrative needs. Among them, Discretionary Access Control (DAC), Mandatory
Access Control (MAC), and Role-Based Access Control (RBAC) are the most commonly
studied and implemented models. Each of these models follows a distinct philosophy for
assigning and managing access rights, and each is suitable for different types of
environments.
Discretionary Access Control focuses on user ownership and provides flexibility by allowing
resource owners to decide who can access their resources. Mandatory Access Control
enforces strict security rules defined by a central authority and is designed for highly secure
environments. Role-Based Access Control organizes permissions around roles rather than
individuals, making it efficient for large organizations with structured job responsibilities.
Understanding DAC, MAC, and RBAC is essential for designing secure systems and
implementing effective access control policies. This assignment presents a detailed study of
these three access control models, explaining their concepts, working mechanisms,
advantages, limitations, and differences. A comparative analysis is also provided to clearly
highlight how these models differ from one another in terms of security, flexibility, and
usage.
In modern computing environments, access control plays a vital role in protecting
organizational assets from both external threats and internal misuse. As users often have
different responsibilities and levels of authority, it is necessary to implement mechanisms that
ensure users access only the information required to perform their tasks. Effective access
control helps reduce human errors, limits damage caused by compromised accounts, and
supports secure system operation.
Different access control models offer varying levels of security, flexibility, and administrative
control. Selecting an appropriate model depends on factors such as the sensitivity of data,
organizational size, regulatory requirements, and system architecture. While some
environments prioritize flexibility and ease of collaboration, others require strict enforcement
of security policies to prevent any unauthorized information flow. Understanding these
differences allows system designers and administrators to make informed decisions when
implementing access control strategies.
Furthermore, access control models form the foundation of many security standards and
compliance frameworks used across industries such as healthcare, finance, education, and
government. Proper implementation of DAC, MAC, and RBAC not only enhances system
security but also ensures accountability and transparency in user activities. By studying these
models in detail, one can gain a deeper understanding of how access control contributes to
overall system security and effective information management.
Government Polytechnic, Achalpur Page 2
DAC,MAC,RBAC
2. Discretionary Access Control (DAC)
Discretionary Access Control (DAC) is one of the oldest and most commonly used access
control models in computer systems. In this model, access to resources is controlled by the
owner of the resource, who has the authority to grant, modify, or revoke permissions for other
users. The word “discretionary” indicates that access decisions are made at the discretion of
individual users rather than being enforced strictly by a central authority. DAC is primarily
based on user identity and ownership.
In a DAC-based system, every object such as a file, directory, printer, or database entry has
an associated owner. The owner can specify which users or groups are allowed to access the
object and define the type of access permitted, such as read, write, execute, or delete. These
permissions are typically maintained in the form of Access Control Lists (ACLs). When a
user attempts to access a resource, the system checks the ACL to determine whether the
requested operation is permitted.
Fig 2. DAC Model
One of the key characteristics of DAC is its high level of flexibility. Users can easily share
information by changing access permissions without requiring approval from system
administrators. This makes DAC suitable for environments that emphasize collaboration,
such as educational institutions, small offices, and personal computing systems. The ability to
quickly modify permissions helps improve productivity and ease of use.
DAC is widely implemented in popular operating systems. In UNIX and Linux systems,
DAC is implemented using file permission bits and ownership attributes. Commands such as
chmod, chown, and chgrp allow users to manage access permissions for files and directories.
Similarly, Microsoft Windows uses discretionary access control mechanisms that allow file
Government Polytechnic, Achalpur Page 3
DAC,MAC,RBAC
owners and administrators to set permissions for users and groups through graphical
interfaces.
Despite its simplicity, DAC has several security limitations. Since users have control over
permissions, sensitive information may be shared unintentionally. A significant weakness of
DAC is its vulnerability to Trojan horse and malware attacks. If a malicious program runs
under the credentials of a legitimate user, it can access all the resources that the user is
authorized to access, potentially leading to data leakage or system compromise.
Another major challenge in DAC is permission management in large systems. As the number
of users and resources increases, tracking and maintaining permissions becomes difficult.
Over time, systems may accumulate excessive or outdated permissions, a problem commonly
known as permission creep. This increases the risk of unauthorized access and makes security
audits more complex.
From an administrative perspective, DAC lacks centralized policy enforcement. Security
depends heavily on users making correct decisions when granting access, which is not always
reliable. This makes DAC less suitable for environments that require strict compliance with
security policies or regulatory standards.
In summary, Discretionary Access Control provides a simple and flexible approach to
managing access in small-scale or low-security environments. While it is easy to implement
and widely used, its limitations make it inappropriate for systems that require strong security
controls. As organizations grow and security requirements become more stringent, DAC is
often replaced or supplemented by more structured access control models such as MAC or
RBAC.
Fig 3. Process of DAC Model
Government Polytechnic, Achalpur Page 4
DAC,MAC,RBAC
3. Mandatory Access Control (MAC)
Mandatory Access Control (MAC) is a highly secure access control model in which access
decisions are made by a central authority based on predefined security policies. Unlike
Discretionary Access Control, users do not have the freedom to decide who can access
resources. Instead, the system strictly enforces access rules, and users are required to follow
them without exception. This makes MAC suitable for environments where data
confidentiality and system security are critical.
In MAC, both users (subjects) and resources (objects) are assigned security labels. These
labels represent the sensitivity level of information and the clearance level of users. Common
examples of security labels include classifications such as Confidential, Secret, and Top
Secret. Access to a resource is granted only if the user’s security clearance meets or exceeds
the classification level of the resource. The system automatically enforces these rules, and
users cannot modify permissions even if they own the resource.
Fig 4. MAC Model
One of the most important characteristics of MAC is its ability to control information flow.
MAC prevents information from flowing from higher security levels to lower ones, thereby
protecting sensitive data from being exposed to unauthorized users. This concept is widely
used in military and government systems, where data leakage can have serious consequences.
Models such as the Bell-LaPadula model are commonly associated with MAC to enforce
confidentiality requirements.
MAC provides a very high level of security because access policies are centrally managed
and strictly enforced. Since users cannot change permissions, the risk of accidental or
intentional data sharing is significantly reduced. This centralized control also makes MAC
Government Polytechnic, Achalpur Page 5
DAC,MAC,RBAC
resistant to malware and Trojan horse attacks, as malicious programs cannot bypass security
policies by exploiting user permissions.
Despite its strong security benefits, MAC has several limitations. The strict enforcement of
policies makes it less flexible compared to other access control models. Implementing MAC
requires careful planning, as security labels and policies must be clearly defined in advance.
Any change in access rules typically requires administrative intervention, which can slow
down system operations and reduce productivity.
Another challenge of MAC is its complexity. Designing and maintaining security policies in
large systems can be difficult and time-consuming. Users may find MAC restrictive, as they
are unable to share information freely even when collaboration is necessary. As a result,
MAC is rarely used in commercial or general-purpose computing environments.
MAC is primarily implemented in high-security environments such as military systems,
government agencies, and critical infrastructure applications. Some operating systems,
including certain Linux distributions with Security-Enhanced Linux (SELinux), support
MAC to provide enhanced security controls.
In conclusion, Mandatory Access Control offers the strongest level of security among access
control models. While it effectively prevents unauthorized access and data leakage, its
rigidity and complexity limit its use to environments where security is more important than
flexibility. MAC remains an essential model for systems that require strict enforcement of
security policies and protection of classified information.
Fig 5. Process of MAC Model
Government Polytechnic, Achalpur Page 6
DAC,MAC,RBAC
4. Role-Based Access Control (RBAC)
Role-Based Access Control (RBAC) is a widely used and modern access control model in
which permissions are assigned based on roles within an organization rather than individual
users. A role represents a set of responsibilities or job functions, such as Administrator,
Manager, Employee, or Student. Users are assigned roles according to their duties, and they
automatically inherit the permissions associated with those roles. This approach simplifies
access management and improves security, especially in large and complex systems.
In RBAC, permissions are not directly assigned to users. Instead, permissions are associated
with roles, and users are linked to these roles. When a user attempts to access a resource, the
system checks the role assigned to the user and determines whether the role has the required
permission. This separation between users and permissions makes RBAC easier to manage
and reduces administrative overhead.
Fig 6. RBAC Model
One of the key advantages of RBAC is its support for the principle of least privilege. By
assigning users only the roles necessary to perform their job functions, RBAC ensures that
users do not have unnecessary access to sensitive resources. This minimizes the risk of
unauthorized access, accidental data modification, and insider threats. RBAC also helps
enforce separation of duties, where critical tasks are divided among multiple roles to prevent
misuse of power.
RBAC is highly scalable and suitable for organizations with a large number of users and
resources. When an employee joins an organization, changes roles, or leaves, administrators
Government Polytechnic, Achalpur Page 7
DAC,MAC,RBAC
only need to assign or remove roles rather than modifying multiple individual permissions.
This makes RBAC efficient and reduces the likelihood of configuration errors.
RBAC is commonly used in enterprise systems, including banking applications, hospital
management systems, educational institutions, and corporate networks. For example, in a
hospital system, doctors, nurses, and administrative staff have different roles, each with
specific access permissions. Similarly, in a banking system, roles ensure that sensitive
financial data is accessible only to authorized personnel.
Despite its advantages, RBAC also has certain challenges. Designing roles requires careful
analysis of organizational workflows and responsibilities. Poorly defined roles can lead to
role explosion, where too many roles are created, or role overlap, where users gain excessive
permissions. Initial implementation of RBAC may require significant planning and effort.
In conclusion, Role-Based Access Control provides an effective balance between security and
usability. It simplifies access management, enhances security through structured permission
assignment, and supports organizational growth. Due to its flexibility, scalability, and strong
security features, RBAC is one of the most preferred access control models in modern
information systems.
Fig 7. Process of RBAC
Government Polytechnic, Achalpur Page 8
DAC,MAC,RBAC
5. Comparison between DAC, MAC, and RBAC
Basis of Comparison DAC (Discretionary MAC (Mandatory RBAC (Role-Based
Access Control) Access Control) Access Control)
Control Authority Resource owner Central system Organization or
controls access authority controls administrator controls
permissions access roles
Permission Basis Based on user identity Based on security Based on roles
and ownership labels and policies assigned to users
Flexibility Highly flexible Very rigid and Moderately flexible
inflexible
Security Level Low security Very high security High security
User Permission Users can grant or Users cannot change Users cannot change
Modification revoke permissions permissions permissions directly
Ease of Easy to implement Complex to Moderately complex
Implementation implement
Scalability Not suitable for large Limited scalability Highly scalable
systems
Administrative Low initially Very high Moderate
Overhead
Information Flow Weak control Strictly controlled Controlled through
Control roles
Risk of Data Leakage High Very low Low
Typical Usage Personal and small Military and Corporate and
Environment office systems government systems enterprise systems
Example Systems Windows, Linux file Military systems, Banks, hospitals,
permissions SELinux enterprises
Government Polytechnic, Achalpur Page 9