Access Control and Authentication
Stub. Authentication (proving identity — passwords and their attacks/defenses, and stronger factors) and access control (deciding what an authenticated principal may do), covering the standard models: access control lists, capabilities, and role-based access control.
The two questions every system asks before granting a request: who are you (authentication), and are you allowed to do this (access control). Passwords remain the dominant authentication mechanism despite well-known weaknesses — covers password guessing/cracking, salting and hashing schemes, and the tradeoffs of stronger authentication factors — and access control is covered via its three standard implementations: access control lists (permissions attached to each object), capabilities (unforgeable tokens attached to each subject), and role-based access control (indirect through a role layer for manageability at scale). See security-in-operating-systems for how these models are realized concretely inside an OS, and multilevel-and-multilateral-security for richer models built on top of this basic vocabulary.
Outline (TODO — flesh out each)
- Password-based authentication — attacks (guessing, cracking) and defenses (salting, hashing)
- Stronger authentication factors
- Access control lists (ACLs)
- Capabilities
- Role-based access control (RBAC)