HEAD Metamodel: Hierarchical, Extensible, Advanced, and Dynamic Access Control Metamodel for Dynamic and Heterogeneous Structures

Abstract

The substantial advancements in information technologies have brought unprecedented concepts and challenges to provide solutions and integrate advanced and self-ruling systems in critical and heterogeneous structures. The new generation of networking environments (e.g., the Internet of Things (IoT), cloud computing, etc.) are dynamic and ever-evolving environments. They are composed of various private and public networks, where all resources are distributed and accessed from everywhere. Protecting resources by controlling access to them is a complicated task, especially with the presence of cybercriminals and cyberattacks. What makes this reality also challenging is the diversity and the heterogeneity of access control (AC) models, which are implemented and integrated with a countless number of information systems. The evolution of ubiquitous computing, especially the concept of Industry 4.0 and IoT applications, imposes the need to enhance AC methods since the traditional methods are not able to answer the increasing demand for privacy and security standards. To address this issue, we propose a Hierarchical, Extensible, Advanced, and Dynamic (HEAD) AC metamodel for dynamic and heterogeneous structures that is able to encompass the heterogeneity of the existing AC models. Various AC models can be derived, and different static and dynamic AC policies can be generated using its components. We use Eclipse (xtext) to define the grammar of our AC metamodel. We illustrate our approach with several successful instantiations for various models and hybrid models. Additionally, we provide some examples to show how some of the derived models can be implemented to generate AC policies.

Instantiation and Implementation of HEAD Metamodel in an Industrial Environment: Non-IoT and IoT Case Studies

“…); (5) collaboration and interoperability between AC models are not addressed; and (6) they do not consider the concept of migrating AC policies from one model to another. To address these limitations, we have designed and developed the HEAD metamodel [15] where its advanced features allow deriving different models (existing and even non-existent models). In this paper, we use the HEAD metamodel to derive the needed AC models for two case studies inspired by ITMI's environment in order to show how it can be adapted to various industrial and organizational computing environments.…”

“…Consequently, the evolution of AC policy languages should follow the development of computing environments and information systems (IS) [13,14]. Developing an effective policy language is increasingly challenging due to the highly dynamic and heterogeneous structures of the current networking generation [5,15,16]. AC policy language should respond to the increasing demand for authorizing and controlling access to resources.…”

“…They usually describe generic concepts and serve as unifying frameworks. AC models are instances of AC metamodels that are used to specify, define, and explain what, how, and when particular objects (resources) can be accessed by given individuals (subjects) [15,18,20]. Due to the ubiquitous nature of current computing environments, particularly industry 4.0, it is essential that advanced AC metamodels be developed to meet the increasing demand for AC requirements.…”

“…Due to the ubiquitous nature of current computing environments, particularly industry 4.0, it is essential that advanced AC metamodels be developed to meet the increasing demand for AC requirements. In light of the limitations of the existing AC metamodels [6,18], we propose a Hierarchical, Extensible, Advanced and Dynamic (HEAD) AC metamodel [15]. Compared to the other proposed works in this domain, e.g., [21][22][23], HEAD metamodel considers the challenging requirements which accompany the various technology progressions, for example, the need (1) to create hierarchical AC components that fit the diverse hierarchical organizational structures, (2) to define and upgrade a larger set of AC policies, (3) to have several AC solutions within the same organization (e.g., local network, IoT, and cloud), and many other challenges [20].…”

“…The first case study deals with ITMI's local computing environment (in this paper, we refer to it as a non-IoT environment), while the second case study deals with their IoT environment. Hence, we use the DSL of HEAD metamodel presented and explained in [15] to derive the AC models required for each case study. The derived models of each case are encoded using Eclipse Xtend notation (an expressive dialect of Java) to represent the concrete instance of AC policies and generate the needed Java code to express the AC rules as Cypher queries.…”