Risk-based Access Control Research Articles

The Need for Adaptive Access Control System at the Network Edge

The emergence of edge computing, characterized by its distributed nature and real-time processing, necessitates a paradigm shift in access control mechanisms. Traditional, static methods struggle to adapt to the dynamic and heterogeneous environment of edge computing. This research addresses this gap by proposing an Adaptive Risk-Based Access Control (ARBAC) model specifically designed for edge environments. The objective of this research is to develop a robust access control system that dynamically responds to the changing security landscape of edge computing. The proposed ARBAC model integrates real-time data on user context, resource sensitivity, action severity, and risk history to dynamically assess the security risk associated with each access request. This approach ensures a balance between robust security and user experience by tailoring access controls based on the specific context. The research builds upon the growing recognition of the limitations of traditional access control methods in edge environments. Existing literature highlights the need for adaptive and risk-based access control models to address the dynamic nature of edge computing. This research contributes to this evolving field by proposing an ARBAC model that leverages real-time information for contextually relevant access decisions. The proposed ARBAC model offers several advantages. By dynamically adjusting access controls based on risk levels, the model enhances security and ensures compliance with regulatory requirements. Additionally, it improves network performance by reducing load and facilitating faster access to resources. Furthermore, the model's scalability makes it suitable for managing access in large-scale edge deployments. In conclusion, this research proposes an ARBAC model that aligns with the dynamic nature of edge computing environments. By leveraging real-time data and contextual information, the model offers a robust and adaptable approach to access control, promoting security, compliance, performance, and scalability in edge computing. This research paves the way for further exploration and implementation of ARBAC systems, empowering organizations to effectively manage access control in the evolving landscape of edge computing and IoT.

A medical big data access control model based on smart contracts and risk in the blockchain environment.

The rapid development of the Hospital Information System has significantly enhanced the convenience of medical research and the management of medical information. However, the internal misuse and privacy leakage of medical big data are critical issues that need to be addressed in the process of medical research and information management. Access control serves as a method to prevent data misuse and privacy leakage. Nevertheless, traditional access control methods, limited by their single usage scenario and susceptibility to single point failures, fail to adapt to the polymorphic, real-time, and sensitive characteristics of medical big data scenarios. This paper proposes a smart contracts and risk-based access control model (SCR-BAC). This model integrates smart contracts with traditional risk-based access control and deploys risk-based access control policies in the form of smart contracts into the blockchain, thereby ensuring the protection of medical data. The model categorizes risk into historical and current risk, quantifies the historical risk based on the time decay factor and the doctor's historical behavior, and updates the doctor's composite risk value in real time. The access control policy, based on the comprehensive risk, is deployed into the blockchain in the form of a smart contract. The distributed nature of the blockchain is utilized to automatically enforce access control, thereby resolving the issue of single point failures. Simulation experiments demonstrate that the access control model proposed in this paper effectively curbs the access behavior of malicious doctors to a certain extent and imposes a limiting effect on the internal abuse and privacy leakage of medical big data.

Retracted: Risk-Based Access Control Mechanism for Internet of Vehicles Using Artificial Intelligence

Retracted: Risk-Based Access Control Mechanism for Internet of Vehicles Using Artificial Intelligence

FRAMH: A Federated Learning Risk-Based Authorization Middleware for Healthcare

Modern healthcare systems operate in highly dynamic environments requiring adaptable access control mechanisms. Access to sensitive data and medical equipment should be granted or denied according to the current health situation of the patient. To handle the need for adaptable access control of healthcare scenarios, we propose a novel model that allows dynamic access control decisions based on the context characterizing the source, type of access request, patient, and estimated risk corresponding to the conditions of the patient. Estimating patient status risk requires analyzing vital physiological data whose availability is growing, thanks to the widespread diffusion of the Internet of Medical Things (IoMT) devices. Inferring the patient health status risk through machine learning (ML) techniques is possible, but to achieve better accuracy, the training phase requires the aggregation of vast amounts of data from different sources. This aggregation could be difficult or even impossible due to organization regulations and privacy laws. To address these issues, this article proposes a novel federated learning risk-based authorization middleware for healthcare (FRAMH) that supports risk-based access control to deal with changing and unforeseen medical situations. Our solution infers the risk of health status through a federated learning (FL) approach enriched with blockchain to avoid the weaknesses of centralized servers. The implemented prototype and a large set of experimental results demonstrate the advantages of FL in estimating the risk in healthcare scenarios. Through this approach, even a medical institution with a limited dataset can achieve a satisfying risk estimation and efficient access control enforcement.

An Access Control Model Based on System Security Risk for Dynamic Sensitive Data Storage in the Cloud

In cloud computing, dynamic storage of data generated by users, applications, tasks, workflows, etc. requires frequent access operations, so traditional encryption cannot be applied in this case. Considering the vulnerability of dynamic data, its protection needs to consider an efficient and dynamic security protection scheme. In data-oriented access control, the traditional approach is generally static policy matching, which cannot deal with emergencies and has the problem of privileged users. To solve this problem, this paper proposes a data-oriented risk-based access control model, which adds risk assessment to the traditional attribute-based access control and aims at the source of risk from three aspects: subject attribute, resource attribute, and environment attribute. A set of risk assessment indexes is proposed, and the calculation method of risk assessment is quantitatively analyzed by combining fuzzy consistency AHP analysis method, and finally, the realization of XACML is given. The validity of the proposed model is analyzed, and the carried out experimental analysis verifies its effectiveness. The proposed model benefits cloud data storage applications that require dynamic data storage, for example, medical/patient data storage.

Risk-based Access Control Model for Hospital Information Systems

With the advancement of healthcare reform in various countries, hospital information systems (HIS) and electronic medical records are developing rapidly and providing a source of power for the development of the healthcare industry. Due to the electronification of medical record information and excessive access rights of medical information systems, there is a risk of internal leakage of medical information. Therefore, based on medical information system, this paper proposes a risk-based access control model, which gets the risk value of doctors by quantifying their access behavior and divides the access interval according to the risk value for access behavior control. According to the simulation experiments, it can be seen that the model proposed in this paper is more suitable for medical scenarios than the traditional access control model.

A Privacy Risk Assessment Scheme for Fog Nodes in Access Control System

In the fog computing, it is difficult to satisfy the security and privacy requirement for traditional access control system, such as attribute-based access control system. Risk-based access control system can adapt to the dynamic fog environment. However, the existing risk schemes are modeled for users in majority, not for fog nodes, and the context and privacy sensitivity are rarely considered. In this article, we propose a risk assessment scheme for fog nodes in access control system. Firstly, to improve the accuracy of risk score, the risk assessment is modeled with the subject, object, and context for fog nodes; Secondly, we address the risk assessment computing module for every component. Moreover, we depict system model for risk assessment and implement its prototype system risk assessment model. In the end, the reasonability and correctness of computing model are analyzed by proving and simulation. According to the experiments, the accuracy of risk score is higher than that of the work-based access control and dynamic access control for IoT. Therefore, the feasibility and effectiveness of this scheme are proved through the experiments.

In-Depth Analysis and Systematic Literature Review on Risk Based Access Control in Cloud

Security in Cloud is one of the most foremost and critical feature, which can ensure the confidence of the Scientific community on Cloud environment. With the dynamic and ever changing nature of the Cloud computing environment, static access control models become obsolete. Hence, dynamic access control models are required, which is still an emergent and underdeveloped domain in Cloud security. These models utilize not only access policies but also contextual and real-time information to determine the access decision. Out of these dynamic models the Risk-based Access control model, estimates the security risk value related to the access request dynamically to determine the access decision. The exclusive working pattern of this access control model makes it an excellent choice for dynamically changing environment that rules the cloud’s environment. This paper provides a systematic literature appraisal and evaluation of risk-based access control models to provide a detailed understanding of the topic. The contributions of selected articles have been summarized. The security risks in cloud environment have been reviewed, taking in the account of both Cloud Service Provider and Cloud Customer perspectives. Additionally, risk factors used to build the risk-based access control model were extracted and analyzed. Finally, the risk estimation techniques used to evaluate the risks of access control operations have also been identified.

ANFIS for risk estimation in risk-based access control model for smart homes

The risk-based access control model is one of the dynamic models that use the security risk as a criterion to decide the access decision for each access request. This model permits or denies access requests dynamically based on the estimated risk value. The essential stage of implementing this model is the risk estimation process. This process is based on estimating the possibility of information leakage and the value of that information. Several researchers utilized different methods for risk estimation but most of these methods were based on qualitative measures, which cannot suit the access control context that needs numeric and precise risk values to decide either granting or denying access. Therefore, this paper presents a novel Adaptive Neuro-Fuzzy Inference System (ANFIS) model for risk estimation in the risk-based access control model for the Internet of Things (IoT). The proposed ANFIS model was implemented and evaluated against access control scenarios of smart homes. The results demonstrated that the proposed ANFIS model provides an efficient and accurate risk estimation technique that can adapt to the changing conditions of the IoT environment. To validate the applicability and effectiveness of the proposed ANFIS model in smart homes, ten IoT security experts were interviewed. The results of the interviews illustrated that all experts confirmed that the proposed ANFIS model provides accurate and realistic results with a 0.713 in Cronbach’s alpha coefficient which indicates that the results are consistent and reliable. Compared to existing work, the proposed ANFIS model provides an efficient processing time as it reduces the processing time from 57.385 to 10.875 Sec per 1000 access requests, which demonstrates that the proposed model provides effective and accurate risk evaluation in a timely manner.

Risk-Based Access Control Mechanism for Internet of Vehicles Using Artificial Intelligence

Internet of Vehicles (IoV) systems are vulnerable to a wide range of attacks because of the lack of security measures. IoV systems can be infiltrated by malicious and unauthorized nodes, which can cause the authenticity, accessibility, and privacy of shared information resources to be compromised. Indeed, the use of an access control system can help; as a result, it is unable to respond to such attacks on time. This paper introduces an artificial intelligence-enabled access control mechanism (AI-ACM) with vehicle nodes and roadside units (RSUs) to overcome these issues. Here, use vehicle nodes as lightweight nodes, while RSUs act as comprehensive and edge nodes to provide access control service. A generative adversarial network (GAN) is used in place of risk prediction (RP) due to the lack of training sets, resulting in a sequence generation rather than an accurate risk prediction. Afterward, the blockchain-based Internet of Vehicles (BIoV) approach is summarized for the security mechanisms of vehicles that are discussed from the aspects of access control and authentication to sustain the distributed processing architecture and solve security issues. The simulation results show that AI-ACM is more accurate than the previous GANs at predicting the future. In addition, the RP model’s access control accuracy can be improved as a result of this technique.

SoK: Context and Risk Aware Access Control for Zero Trust Systems

Evolving computing technologies such as cloud, edge computing, and the Internet of Things (IoT) are creating a more complex, dispersed, and dynamic enterprise operational environment. New security enterprise architectures such as those based on the concept of Zero Trust (ZT) are emerging to meet the challenges posed by these changes. ZT systems treat internal and external networks as untrusted and subject both to the same security checking and control to prevent data breaches and limit internal lateral movement. Context awareness is a notion from the field of ubiquitous computing that is used to capture and react to the situation of an entity, based on the dynamics of a particular application or system context. The idea has been incorporated into several access control models. However, the overlap between context-aware access control and zero-trust security has not been fully explored. In this SoK, we conduct a systematic examination of ZT, context awareness, and risk-based access control to explore the critical elements of each and to identify areas of overlap and synergy to enhance the operation and deployment of ZT systems.

Enhanced Multilevel Fuzzy Inference System for Risk Adaptive Hybrid RFID Access Control System

Risk-based access control systems are part of identity management systems used to accommodate environments with needs for dynamic access control decisions. The risk value is subjected to overestimation or underestimation since it is measured qualitatively, thus; causing uncertainty problems, which was apparent in a previously proposed hybrid risk adaptive (HRA) access control system. Conversely, Fuzzy Inference Systems can deal with the uncertainty of measures and control the outcomes more precisely; therefore, a multilevel fuzzy inference system (HRA-MFIS) was proposed to replace the risk assessment model in HRA. This paper continues to improve the previous model by introducing an enhanced multilevel fuzzy inference system (EHRA-MFIS), which utilizes user behaviour and time analysis to detect anomalous access behaviour. Moreover, it improves the hybrid adaptive risk calculation module by adding authentication, classification and the degree of user anomalous behaviour to the risk calculation algorithm. The results show that the proposed model has smoothed out the transition between the different risk levels and enhanced the system's overall security by considering the failed authorization attempts and failed authentication attempts, asset classification, and user behaviour when calculating the risk level.

Efficient NFS Model for Risk Estimation in a Risk-Based Access Control Model.

Providing a dynamic access control model that uses real-time features to make access decisions for IoT applications is one of the research gaps that many researchers are trying to tackle. This is because existing access control models are built using static and predefined policies that always give the same result in different situations and cannot adapt to changing and unpredicted situations. One of the dynamic models that utilize real-time and contextual features to make access decisions is the risk-based access control model. This model performs a risk analysis on each access request to permit or deny access dynamically based on the estimated risk value. However, the major issue associated with building this model is providing a dynamic, reliable, and accurate risk estimation technique, especially when there is no available dataset to describe risk likelihood and impact. Therefore, this paper proposes a Neuro-Fuzzy System (NFS) model to estimate the security risk value associated with each access request. The proposed NFS model was trained using three learning algorithms: Levenberg–Marquardt (LM), Conjugate Gradient with Fletcher–Reeves (CGF), and Scaled Conjugate Gradient (SCG). The results demonstrated that the LM algorithm is the optimal learning algorithm to implement the NFS model for risk estimation. The results also demonstrated that the proposed NFS model provides a short and efficient processing time, which can provide timeliness risk estimation technique for various IoT applications. The proposed NFS model was evaluated against access control scenarios of a children’s hospital, and the results demonstrated that the proposed model can be applied to provide dynamic and contextual-aware access decisions based on real-time features.

Adaptive Contextual Risk-Based Model to Tackle Confidentiality-Based Attacks in Fog-IoT Paradigm

The Internet of Things (IoT) allows billions of physical objects to be connected to gather and exchange information to offer numerous applications. It has unsupported features such as low latency, location awareness, and geographic distribution that are important for a few IoT applications. Fog computing is integrated into IoT to aid these features to increase computing, storage, and networking resources to the network edge. Unfortunately, it is faced with numerous security and privacy risks, raising severe concerns among users. Therefore, this research proposes a contextual risk-based access control model for Fog-IoT technology that considers real-time data information requests for IoT devices and gives dynamic feedback. The proposed model uses Fog-IoT environment features to estimate the security risk associated with each access request using device context, resource sensitivity, action severity, and risk history as inputs for the fuzzy risk model to compute the risk factor. Then, the proposed model uses a security agent in a fog node to provide adaptive features in which the device’s behaviour is monitored to detect any abnormal actions from authorised devices. The proposed model is then evaluated against the existing model to benchmark the results. The fuzzy-based risk assessment model with enhanced MQTT authentication protocol and adaptive security agent showed an accurate risk score for seven random scenarios tested compared to the simple risk score calculations.

Intrusion detection system for data warehouse with second level authentication

Data Warehouse (DW) security has always been a critical challenge for DW designers because of its global availability and accessibility. Over time, different researchers have suggested different DW security solutions, such as Role Based Access Controls (RBAC), Extended RBAC, Temporal RBAC (TRBAC), Risk-based access control, etc. Intrusion Detection System (IDS) and some other customized security solutions for DWs have also been proposed. Here, Risk-based access control provides additional security by utilizing risk value for each access decision. In RBAC systems, if an attacker obtains access to the system using some compromised credentials, the RBACs has no mechanism to secure DW elements which are accessible to the compromised user's role. The Intrusion Detection System (IDS) aims to solve this limitation; it monitors the user activities and alerts the system administrator whenever a user deviates from routine behavior. However, in the IDS solution for DWs, most of the real intrusions go undetected. In this work, we propose a second level authentication within the IDS, where a minute deviation from the user’s past behavior is detected. It brings more robustness to the user's historical profile and makes the system less susceptible to false negatives. The proposed solution has been implemented on standard TPC-H databases, and results indicate a significant decrease in undetected real intrusions, which is one of the main achievements of the proposed mechanism.

MicrothingsChain: Blockchain-based Controlled Data Sharing Platform in Multi-domain IoT

The vision of the Internet of Things (IoT) is creating an open and shared world connected to everything, making people’s lives more smart, convenient, and efficient. Currently, there are various isolated IoT applications developed by different IoT manufacturers for a single specific function. The IoT nodes are classified into different administrative domains according to their affiliation, resulting in a multi-domain IoT environment. In order to realize the true IoT vision with multi-domain data sharing, this paper introduces a multi-domain IoT data sharing architecture based on blockchain to address the current phenomenon of information isolation. A control approach including capability-based cross-domain access control and risk-based access control in a domain is proposed to ensure the security of full data sharing processes. With these properties, diverse isolated applications can constitute a whole system for secure data exchange.

Risk-Based Access Control Model: A Systematic Literature Review

Most current access control models are rigid, as they are designed using static policies that always give the same outcome in different circumstances. In addition, they cannot adapt to environmental changes and unpredicted situations. With dynamic systems such as the Internet of Things (IoT) with billions of things that are distributed everywhere, these access control models are obsolete. Hence, dynamic access control models are required. These models utilize not only access policies but also contextual and real-time information to determine the access decision. One of these dynamic models is the risk-based access control model. This model estimates the security risk value related to the access request dynamically to determine the access decision. Recently, the risk-based access control model has attracted the attention of several organizations and researchers to provide more flexibility in accessing system resources. Therefore, this paper provides a systematic review and examination of the state-of-the-art of the risk-based access control model to provide a detailed understanding of the topic. Based on the selected search strategy, 44 articles (of 1044 articles) were chosen for a closer examination. Out of these articles, the contributions of the selected articles were summarized. In addition, the risk factors used to build the risk-based access control model were extracted and analyzed. Besides, the risk estimation techniques used to evaluate the risks of access control operations were identified.

An efficient security risk estimation technique for Risk-based access control model for IoT

The need to increase information sharing in the Internet of Things (IoT) applications made the risk-based access control model to be the best candidate for both academic and commercial organizations. Risk-based access control model carries out a security risk analysis on the access request by using IoT contextual information to provide access decisions dynamically. Unlike current static access control approaches that are based on predefined policies and give the same result in different situations, this model provides the required flexibility to access system resources and works well in unexpected conditions and situations of the IoT system. One of the main issues to implement this model is to determine the appropriate risk estimation technique that is able to generate accurate and realistic risk values for each access request to determine the access decision. Therefore, this paper proposes a risk estimation technique which integrates the fuzzy inference system with expert judgment to assess security risks of access control operations in the IoT system. Twenty IoT security experts from inside and outside the UK were interviewed to validate the proposed risk estimation technique and build the fuzzy inference rules accurately. The proposed risk estimation approach was implemented and simulated using access control scenarios of the network router. In comparison with the existing fuzzy techniques, the proposed technique has demonstrated it produces precise and realistic values in evaluating security risks of access control operations in the IoT context.

Fuzzy Logic with Expert Judgment to Implement an Adaptive Risk-Based Access Control Model for IoT

The Internet of Things (IoT) is becoming the future of the Internet with a large number of connected devices that are predicted to reach about 50 billion by 2020. With proliferation of IoT devices and need to increase information sharing in IoT applications, risk-based access control model has become the best candidate for both academic and commercial organizations to address access control issues. This model carries out a security risk analysis on the access request by using IoT contextual information to provide access decisions dynamically. This model solves challenges related to flexibility and scalability of the IoT system. Therefore, we propose an adaptive risk-based access control model for the IoT. This model uses real-time contextual information associated with the requesting user to calculate the security risk regarding each access request. It uses user attributes while making the access request, action severity, resource sensitivity and user risk history as inputs to analyze and calculate the risk value to determine the access decision. To detect abnormal and malicious actions, smart contracts are used to track and monitor user activities during the access session to detect and prevent potential security violations. In addition, as the risk estimation process is the essential stage to build a risk-based model, this paper provides a discussion of common risk estimation methods and then proposes the fuzzy inference system with expert judgment as to be the optimal approach to handle risk estimation process of the proposed risk-based model in the IoT system.

Validation of an Adaptive Risk-based Access Control Model for the Internet of Things

The Internet of Things (IoT) has spread into multiple dimensions that incorporate different physical and virtual things. These things are connected together using different communication technologies to provide unlimited services. These services help not only to improve the quality of our daily lives, but also to provide a communication platform for increasing object collaboration and information sharing. Like all new technologies, the IoT has many security challenges that stand as a barrier to the successful implementation of IoT applications. These challenges are more complicated due to the dynamic and heterogeneous nature of IoT systems. However, authentication and access control models can be used to address the security issue in the IoT. To increase information sharing and availability, the IoT requires a dynamic access control model that takes not only access policies but also real-time contextual information into account when making access decisions. One of the dynamic features is the security risk. This paper proposes an Adaptive Risk-Based Access Control (AdRBAC) model for the IoT and discusses its validation using expert reviews. The proposed AdRBAC model conducts a risk analysis to estimate the security risk value associated with each access request when making an access decision. This model has four inputs/risk factors: user context, resource sensitivity, action severity and risk history. These risk factors are used to estimate a risk value associated with the access request to make the access decision. To provide the adaptive features, smart contracts will be used to monitor the user behaviour during access sessions to detect any malicious actions from the granted users. To validate and refine the proposed model, twenty IoT security experts from inside and outside the UK were interviewed. The experts have suggested valuable information that will help to specify the appropriate risk factors and risk estimation technique for implantation of the AdRBAC model.