Access Control Metamodels: Review, Critical Analysis, and Research Issues

Abstract

The new generation of networking environments such as the internet of things (IoT), cloud computing, etc. is emerging and releases new prospects to traditional information systems by merging new technologies and services for seamless access to information sources at anytime and anywhere. Concurrently, this emergence opens new threats to information security and new challenges to controlling access to resources. To ensure security, several techniques have been employed, and access control (AC) is one of the essential security requirements especially for recent networking environments. Various authentication and AC methods are proposed to enforce AC policy and to prevent any unauthorized access to logical/physical assets. The continuous technology upgrades and the diversity of AC models force the need to find AC metamodels with a higher level of abstraction that serves as a unifying framework for specifying any AC policy. AC metamodels are proposed to encompass AC features and are used to derive various instances of AC models and methods. In this paper we review the proposed AC metamodels and their implementation scenarios, we analyze them, their objectives, their limitations, and present current research issues and open questions that still need to be addressed.