An Optimized Role-Based Access Control Using Trust Mechanism in E-Health Cloud Environment

Abstract

In today's world, services are improved and advanced in every field of life. Especially in the health sector, information technology (IT) plays a vigorous role in electronic health (e-health). To achieve benefits from e-health, its cloud-based implementation is necessary. With this environment's multiple benefits, privacy and security loopholes exist. As the number of users grows, the Electronic Healthcare System's (EHS) response time becomes slower. This study presented a trust mechanism for access control (AC) known as role-based access control (RBAC) to address this issue. This method observes the user's behavior and assigns roles based on it. The AC module has been implemented using SQL Server, and an administrator develops controls for users with roles and access to multiple EHS modules. To validate the user's trust value, A .net-based framework has been introduced. The framework of e-health proposed in this research ensures that users can protect their data from intruders and other security threats.

From Theory to Practice: Implementing Effective Role-Based Access Control Strategies to Mitigate Insider Risks in Diverse Organizational Contexts

“…The negative impact of implementation challenges on RBAC's effectiveness (H2) underscores the nuanced barriers organizations face, especially the administrative and technical hurdles that can diminish the system's efficacy. This complexity resonates with the challenges highlighted by existing studies on RBAC implementation [59] [26] [33].…”

“…Although scholars laud RBAC for its effectiveness in mitigating insider threats [26][32] [33], it is not devoid of challenges, as studies argue that the complexity of defining and managing roles can be a significant barrier, especially in large and dynamic organizations. There is also an ongoing debate about the potential for RBAC to become too restrictive, hindering operational efficiency.…”

“…While Role-Based Access Control (RBAC) is acclaimed for its strategic approach to minimizing insider threats, its implementation and operationalization present challenges and limitations [32]. These obstacles affect the efficiency and effectiveness of RBAC systems and highlight the nuanced complexity of mitigating insider threats within diverse organizational landscapes [33]. For instance, a significantly pressing challenge in implementing RBAC is the phenomenon of role explosion, where the granularity of roles becomes so detailed that managing them becomes impractical [39].…”

Cloud access

“…For instance, with a cloud-based healthcare system, the role of 'Doctor' might have scoped access corresponding to its specialization, the 'Nurse' might have access rights that suit their duties, and the 'Administrator' might have admin access for managing the healthcare system. Its architecture matches the compliance requirements because it can put up with the development of distinct requirements, which are usually dependent on information security standards such as HIPAA or GDPR [2]. RBAC categorizes permissions according to roles and, as a result, offers a practical, scalable, and safe hierarchical structure for user authorizations in the cloud.…”

“…RBAC's identified risk mitigation method is the effective way of accessing unintended data among multiple entities storing data in the cloud [1]. An essential aspect of the RBAC model is a structure adopting an approach based on the user roles, which rotates around the permit issuing and auditing [2]. The different phenomena in the case of traits-based access control (ABAC) are more of a dynamic and sophisticated model of authorization that confers access rights upon the features of the users and the environmental attributes [3].…”