HEAD Access Control Metamodel: Distinct Design, Advanced Features, and New Opportunities

Abstract

Access control (AC) policies are a set of rules administering decisions in systems and they are increasingly used for implementing flexible and adaptive systems to control access in today’s internet services, networks, security systems, and others. The emergence of the current generation of networking environments, with digital transformation, such as the internet of things (IoT), fog computing, cloud computing, etc., with their different applications, bring out new trends, concepts, and challenges to integrate more advanced and intelligent systems in critical and heterogeneous structures. This fact, in addition to the COVID-19 pandemic, has prompted a greater need than ever for AC due to widespread telework and the need to access resources and data related to critical domains such as government, healthcare, industry, and others, and any successful cyber or physical attack can disrupt operations or even decline critical services to society. Moreover, various declarations have announced that the world of AC is changing fast, and the pandemic made AC feel more essential than in the past. To minimize security risks of any unauthorized access to physical and logical systems, before and during the pandemic, several AC approaches are proposed to find a common specification for security policy where AC is implemented in various dynamic and heterogeneous computing environments. Unfortunately, the proposed AC models and metamodels have limited features and are insufficient to meet the current access control requirements. In this context, we have developed a Hierarchical, Extensible, Advanced, and Dynamic (HEAD) AC metamodel with substantial features that is able to encompass the heterogeneity of AC models, overcome the existing limitations of the proposed AC metamodels, and follow the various technology progressions. In this paper, we explain the distinct design of the HEAD metamodel, starting from the metamodel development phase and reaching to the policy enforcement phase. We describe the remaining steps and how they can be employed to develop more advanced features in order to open new opportunities and answer the various challenges of technology progressions and the impact of the pandemic in the domain. As a result, we present a novel approach in five main phases: metamodel development, deriving models, generating policies, policy analysis and assessment, and policy enforcement. This approach can be employed to assist security experts and system administrators to design secure systems that comply with the organizational security policies that are related to access control.

Instantiation and Implementation of HEAD Metamodel in an Industrial Environment: Non-IoT and IoT Case Studies

“…In this context, various AC models and metamodels are implemented in different computing environments to protect resources and information from unauthorized access. Unfortunately, they have limited features and are insufficient to meet the current AC requirements and follow the needed technology upgrades [17,20]. In this section, we review some of the proposed AC methods in this domain.…”

“…In this section, we review some of the proposed AC methods in this domain. We summarize the existing AC metamodels [17,18,20] proposed to instantiate different AC models.…”

“…This would allow for defining and enforcing a larger set of static and dynamic AC policies. In [20], we summarize the development stages of AC methods starting from common AC models, hybrid models, extending AC models, abstracting AC models, and reaching AC metamodels which is the recent research issue in this domain. As described in [17,18] some metamodels are proposed as generic by using AC features of some common models, some other metamodels are proposed as hybrid metamodels by combining features of some AC models, and some other metamodels are proposed as metamodel extensions for some existing metamodels.…”

“…They usually describe generic concepts and serve as unifying frameworks. AC models are instances of AC metamodels that are used to specify, define, and explain what, how, and when particular objects (resources) can be accessed by given individuals (subjects) [15,18,20]. Due to the ubiquitous nature of current computing environments, particularly industry 4.0, it is essential that advanced AC metamodels be developed to meet the increasing demand for AC requirements.…”

“…In light of the limitations of the existing AC metamodels [6,18], we propose a Hierarchical, Extensible, Advanced and Dynamic (HEAD) AC metamodel [15]. Compared to the other proposed works in this domain, e.g., [21][22][23], HEAD metamodel considers the challenging requirements which accompany the various technology progressions, for example, the need (1) to create hierarchical AC components that fit the diverse hierarchical organizational structures, (2) to define and upgrade a larger set of AC policies, (3) to have several AC solutions within the same organization (e.g., local network, IoT, and cloud), and many other challenges [20]. The domain-specific language (DSL) [24] of the HEAD metamodel-which is defined using Eclipse (xtext) [25,26]-is generic enough to include the heterogeneity of AC models, this allows defining larger sets of AC policies.…”