A systematic literature review for authorization and access control: definitions, strategies and models

Abstract

Purpose Authorization and access control have been a topic of research for several decades. However, existing definitions are inconsistent and even contradicting each other. Furthermore, there are numerous access control models and even more have recently evolved to conform with the challenging requirements of resource protection. That makes it hard to classify the models and decide for an appropriate one satisfying security needs. Therefore, this study aims to guide through the plenty of access control models in the current state of the art besides this opaque accumulation of terms meaning and how they are related. Design/methodology/approach This study follows the systematic literature review approach to investigate current research regarding access control models and illustrate the findings of the conducted review. To provide a detailed understanding of the topic, this study identified the need for an additional study on the terms related to the domain of authorization and access control. Findings The authors’ research results in this paper are the distinction between authorization and access control with respect to definition, strategies, and models in addition to the classification schema. This study provides a comprehensive overview of existing models and an analysis according to the proposed five classes of access control models. Originality/value Based on the authors’ definitions of authorization and access control along with their related terms, i.e. authorization strategy, model and policy as well as access control model and mechanism, this study gives an overview of authorization strategies and propose a classification of access control models providing examples for each category. In contrast to other comparative studies, this study discusses more access control models, including the conventional state-of-the-art models and novel ones. This study also summarizes each of the literature works after selecting the relevant ones focusing on the database system domain or providing a survey, a classification or evaluation criteria of access control models. Additionally, the introduced categories of models are analyzed with respect to various criteria that are partly selected from the standard access control system evaluation metrics by the National Institute of Standards and Technology.

The Impact of Information Security Processes on Providing Secure Digital Systems

“…Authorization limits access to a secured component based on a user's access privileges, i.e., they are unable to access files or information that is prohibited by their position within the organization. According to [13], there are various methods for defining access rights, or the necessary elements and how they work together. Three main elements describe an authorization model: Object is the system entity that needs protection (such as a file, database table, or record), Subject is the active entity (such as a user, group, or organizational position) that requests access, and Action specifies what the Subject can do with the Object (e.g.…”

Development of software and hardware complex for control and access management based on face recognition algorithms and neural networks

“…A good PACS must meet certain requirements; in particular, it must have sufficient capacity, not create inconvenience to staff and visitors. The acceptable cost of installing and operating PACS is also important [4,5]. Depending on the level of security requirements, different PACS differ in specific technical solutions, configuration features, and the ability to accumulate or use information.…”