User Authentication & Access Control

de

User Authentication and Access Control

Imagine your school has a building with classrooms, lockers, and a principal's office. Not everyone can go everywhere. The school needs to know who you are, where you're allowed to go, and what you did. That's what user authentication and access control do for computer networks.

AAA

AAA stands for Authentication, Authorization, and Accounting. Think of it as the three security guards that protect a building.

What is Authentication?

Authentication = "Who are you?"

This is how a computer checks that you really are who you say you are.

Example:
You tell the school, "I'm Alex."
The school asks to see your student ID. If it matches, you're allowed in.

Computer example:

  • Typing a username and password

  • Using your fingerprint

  • Using Face ID

Easy way to remember: Authentication = Prove your identity.

What is Authorization?

Authorization = "What are you allowed to do?"

After the computer knows who you are, it decides what you're allowed to access.

Example:

  • Students can enter classrooms.

  • Teachers can enter classrooms and the teacher's lounge.

  • The principal can enter every room.

Everyone is authenticated, but they have different permissions.

Easy way to remember: Authorization = What you can do.

What is Accounting?

Accounting = "What did you do?"

The computer keeps a record of what happened.

Example:
The school writes down:

  • When you arrived

  • Which rooms you entered

  • When you left

A computer keeps logs like:

  • Login time

  • Logout time

  • Files opened

  • Changes made

Easy way to remember: Accounting = Keeping a record.

What is Multifactor Authentication (MFA)?

Multifactor Authentication (MFA) means using two or more ways to prove who you are.

Instead of just using a password, you also need something else.

Examples:

  • Password + code sent to your phone

  • Password + fingerprint

  • Password + Face ID

Think of it like opening a treasure chest:

  • You need the key

  • AND the secret code

Even if someone steals your password, they still can't get in without the second factor.

Easy way to remember: Two locks are harder to break than one.

Local Authentication vs. Centralized Server Authentication

Local Authentication

The computer checks your username and password by itself.

Example:
Your bedroom has its own lock and key.
Only that room knows your key.

If you have five rooms, you need five different keys.

Computer example:
A username and password are stored on one computer.

Pros

  • Simple

  • Doesn't need another server

Cons

  • Every computer has its own accounts.

  • Hard to manage many computers.

Centralized Server Authentication

A special server checks everyone's login information.

Example:
Instead of every classroom having its own key, everyone uses one student ID checked by the front office.

The front office tells every classroom:
"Yes, Alex is allowed in."

Computer example:
One server manages usernames and passwords for the entire company.

Pros

  • One login for many computers

  • Easier to manage

  • More secure

Cons

  • If the central server is unavailable, users may not be able to log in.

Access Control Models

Access control models decide who gets access to what.

DAC (Discretionary Access Control)

The owner decides who can use something.

Example:
You own a notebook.
You decide:

  • Your friend can borrow it.

  • Your brother cannot.

Computer example:
You create a file and choose who can read or edit it.

Easy way to remember: DAC = Owner decides.

RBAC (Role-Based Access Control)

Access is based on your job or role.

Example:
At school:

  • Students can enter classrooms.

  • Teachers can enter classrooms and the teacher's lounge.

  • Principals can go everywhere.

Computer example:

  • Employee

  • Manager

  • IT Administrator

Each role automatically gets certain permissions.

Easy way to remember: RBAC = Your job decides.

RuBAC (Rule-Based Access Control)

Access is based on rules set by the system.

Example:
The school has a rule:
"No one may enter the building after 10:00 PM."

Even the principal follows the rule unless another rule allows otherwise.

Computer examples:

  • Only allow logins during business hours.

  • Block access from certain countries.

  • Allow only company computers to connect.

Easy way to remember: RuBAC = Rules decide.

ABAC (Attribute-Based Access Control)

Access is based on many characteristics (attributes).

Instead of just your job, the computer looks at several things.

Example:
The computer checks:

  • Are you a teacher?

  • Are you in the school building?

  • Is it between 8 AM and 5 PM?

  • Are you using a school laptop?

Only if all the required conditions are true do you get access.

Easy way to remember: ABAC = Many facts decide.

Quick Memory Table

Topic

Easy Way to Remember

Authentication

Who are you?

Authorization

What can you do?

Accounting

What did you do?

Multifactor Authentication

Two or more ways to prove who you are

Local Authentication

Each computer checks its own users

Centralized Authentication

One server checks everyone

DAC

Owner decides access

RBAC

Your role/job decides access

RuBAC

Rules decide access

ABAC

Multiple characteristics decide access

Super Simple Way to Remember Everything

Think about entering your school:

  1. Authentication: "Show me your student ID." (Who are you?)

  2. Authorization: "Students can only go to classrooms." (What can you do?)

  3. Accounting: "Write down when you came and left." (What did you do?)

Then remember the four access control models:

  • DAC: The owner decides.

  • RBAC: Your role decides.

  • RuBAC: Rules decide.

  • ABAC: Your attributes (role, location, time, device, etc.) decide.