An Overview of Risk Estimation Techniques in Risk-based Access Control for the Internet of Things <s> RISK-BASED ACCESS CONTROL MODEL <s> This paper presents a new model for, or rather a new way of thinking about adaptive, risk–based access control. Our basic premise is that there is always inherent uncertainty and risk in access control decisions that is best addressed in an explicit way. We illustrate this concept by showing how the rationale of the well–known, Bell–Lapadula model based, Multi–Level Security (MLS) access control model could be used to develop a risk-adaptive access control model. This new model is more like a Fuzzy Logic control system [9] than a traditional access control system and hence the name “Fuzzy MLS”. The long version of this paper is published as an IBM Research Report [3]. <s> BIB001 </s> An Overview of Risk Estimation Techniques in Risk-based Access Control for the Internet of Things <s> RISK-BASED ACCESS CONTROL MODEL <s> Context-based access control is an emerging approach for modeling adaptive solution, making access control management more flexible and powerful. But in the ubiquitous environment, this approach is not enough for many emerging security vulnerabilities. Thus, improving current access control mechanisms is still necessary. Risk is an effective tool used for decision-making in economics. In this paper, we design a new model for risk assessment in ubiquitous environment and use risk as a key component in decision-making process in our access control model. This solution makes access control management more dynamic and precise <s> BIB002 </s> An Overview of Risk Estimation Techniques in Risk-based Access Control for the Internet of Things <s> RISK-BASED ACCESS CONTROL MODEL <s> Cloud computing is a distributed computing model that still faces problems. New ideas emerge to take advantage of its features and among the research challenges found in the cloud, we can highlight Identity and Access Management. The main problems of the application of access control in the cloud are the necessary flexibility and scalability to support a large number of users and resources in a dynamic and heterogeneous environment, with collaboration and information sharing needs. This paper proposes the use of risk-based dynamic access control for cloud computing. The proposal is presented as an access control model based on an extension of the XACML standard with three new components: the Risk Engine, the Risk Quantification Web Services and the Risk Policies. The risk policies present a method to describe risk metrics and their quantification, using local or remote functions. The risk policies allow users and cloud service providers to define how to handle risk-based access control for their resources, using different quantification and aggregation methods. The model reaches the access decision based on a combination of XACML decisions and risk analysis. A prototype of the model is implemented, showing it has enough expressivity to describe the models of related work. In the experimental results, the prototype takes between 2 and 6 milliseconds to reach access decisions using a risk policy. A discussion on the security aspects of the model is also presented. <s> BIB003 </s> An Overview of Risk Estimation Techniques in Risk-based Access Control for the Internet of Things <s> RISK-BASED ACCESS CONTROL MODEL <s> Cloud computing is a new computing paradigm in which an application can run on connected Cloud Server instead of local server. Cloud computing provides efficient data storage, resource sharing and services in a distributed manner with great ease. However Cloud computing is having issues like security and privacy of data when sensitive data is stored under third party cloud service providers. Various access control models have been proposed to resolve the security issue in cloud computing. So in this paper we have discussed various access control models starting from the traditionally DAC (Discretionary Access Control), MAC (Mandatory Access Control), RBAC (Role Based Access Control) and ABAC (Attribute Based Access Control) to the latest ABE (Attribute Based Encryption) models like CP-ABE (Ciphertext Policy Attribute Based Encryption), KP-ABE (Key Policy Attribute Based Encryption), HABE (Hierarchical Attribute Based Encryption) and HASBE (Hierarchical Attribute Set Base Encryption). <s> BIB004
The risk can be defined as the possibility of loss or injury. Generally, the risk is about some event that may occur in the future and cause losses. One such risk is the leakage of sensitive information by users. An access control is one of the approaches used to mitigate against the security risk BIB004 . Risk-based access control model permits or denies access requests dynamically based on the estimated risk of each access request BIB001 . This model performs a risk analysis on each user access request to make the access decision (Dos BIB003 . Mathematically, the most common formula to represent the risk in quantitative terms is: Quantified Risk= Likelihood × Impact (1) Where likelihood represents the probability of an incident to happen while impact represents the estimation of the value of the damage regarding that incident BIB001 . There are several approaches for creating riskbased access control models. These approaches share some general characteristics from diverse models. An overview of the risk-based access control model is shown in Figure 2 . There are three modules. The access control manager is the main module. It receives requests from users, analyses them, collects other context parameters and sends the data to risk estimation module. The risk estimation module is the key part of the model. It estimates risk values based on the input data collected by the context retrieval module. After that, the access decision is made for each access request based on the estimated risk value BIB002 . 