Computer Security and Access Control

An access matrix is a security model that defines what subjects (users, processes) can perform what operations on objects (files, resources). Rows represent subjects, columns represent objects, and each cell contains access rights. This model forms the basis for implementing access control policies.

Mandatory Access Control (MAC) is a security model where access rights are regulated by a central authority based on multiple levels of security. Users cannot change access permissions, which are system-defined. This contrasts with Discretionary Access Control (DAC) where resource owners control access.

Discretionary Access Control (DAC) is a security model where resource owners determine who can access their resources. Users can set permissions on files and other objects they own, granting access to other users at their discretion. This contrasts with Mandatory Access Control where the system enforces policies.

An Access Control List (ACL) is a list associated with an object that specifies which entities (users, processes) have what permissions on that object. Each entry typically identifies a subject and the access rights granted. ACLs are object-centric, storing permissions with the resource being protected.

Protection rings are a hierarchical protection mechanism that generalizes the supervisor/user mode concept. Inner rings have more privileges; outer rings have fewer. MULTICS introduced this model, later adopted in many systems including x86 architecture. Rings provide fine-grained access control beyond just supervisor vs user mode.

Protection rings were first introduced in the MULTICS operating system, developed in the 1960s. MULTICS pioneered many security concepts including ring-based protection. This hierarchical privilege model was later adopted in other systems including the x86 architecture's ring levels (0-3).