# Enhancing Healthcare Security: A Unified RBAC and ABAC Risk-Aware Access Control Approach
## 2 Related Work
\begin{table}
\begin{tabular}{p{56.9 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Citation** & **Access Model** & **Contribution** & **Limitation** \\ \hline [PERSON] et al. [4] & RBAC & Proposed a fuzzy-based context-aware model enhancing flexibility. & Relies on accurate context info; lacks scalability and security evaluation. & Relies on accurate context info; lacks scalability and security evaluation. & Relies on accurate context info; lacks scalability and security evaluation. \\ [PERSON] et al. [5] & RBAC & Created a FB-CAAC model to reduce admin overhead. & Does not optimize performance in fog computing. & Does not optimize performance in fog computing. \\ [PERSON] et al. [10] & RiBAC & Proposed a risk-based model based on policy-based approach. & No practical implementation or algorithm design. \\ [PERSON] [11] & RiBAC & Developed a taxonomy to assess risk-based techniques. & Purely theoretical with no application validation. \\ [PERSON] et al. [6] & ABAC, RiBAC & Proposed a risk-based model that integrates XACML for IoT. & Conceptual only and lacks real-world tests. \\ [PERSON] et al. [12] & ABAC, RiBAC & Developed a Neuro-fuzzy risk model for IoT. & Single-dataset evaluation; generalizability unknown. \\ [PERSON] et al. [14] & RBAC, RiBAC & Proposed a RRAAC based on environmental and user risk. & No evaluation in real-world scenarios. \\ [PERSON] et al. [15] & ABAC, RiBAC & Integrates ABAC and RiBAC via heuristics. & Risk calculation method is unclear. \\ [PERSON] and [PERSON] [16] & ABAC, Developed a & Proposed a risk-based ABAC for privacy and trust in healthcare. & No implementation or trust quantification provided. \\ [PERSON] et al. [17,18] & RiBAC & Developed a Trust-based dynamic risk-aware access. & Obligation service remains unimplemented. \\ [PERSON] et al. [19] & RiBAC & Developed risk metrics taxonomy for federated identity. & Needs real-world validation of metrics. \\ [PERSON] et al. [20] & RiBAC & Proposed RASA to use machine learning for access decisions. & Relies on historical data availability. \\ [PERSON] et al. [21] & RiBAC & Proposed trust and object security risk evaluation. & Accuracy of trust/security values assumed. \\ [PERSON] and [PERSON] [22] & RBAC, RiBAC perceived appropriateness. & Unfeasible trust/competence measurement functions. & Unfeasible function. \\ [PERSON] et al. [23] & RBAC, RiBAC & Developed a quantified risk approach in RBAC constraint violation & Ignores role-user and permission-role constraints. \\ [PERSON] et al. [24] & RBAC, RiBAC & Proposed two models based on permission-role risk analysis. & Lacks detailed risk computation logic. \\ [PERSON] and [PERSON] [25] & RBAC, RiBAC & Proposed a risk-trust RBAC to prevent insider threats. & Tailored only for insider-specific threats. \\ [PERSON] et al. [7] & RBAC, ABAC & Proposed a hybrid RBAC-ABAC for automatic role assignment. & Central attribute DB is security bottleneck. \\ [PERSON] et al. [26] & RBAC, ABAC and ABAC layers. & Proposed a hybrid model with RBAC and ABAC layers. & Lacks real-world validation and scalability tests. \\ [PERSON] et al. [27] & RBAC, ABAC and & Developed a contextual RBAC in integrative medicine. & Needs evaluation of scalability/platform deployment. \\ [PERSON] et al. [28] & RBAC, ABAC & Developed dynamic permissions in hybrid RBAC-ABAC. & Rea-world ABAC challenges not addressed. \\ [PERSON] and [PERSON] [29] & ABAC, RiBAC & Proposed a CPS-aware risk model with granularity. & No real deployment; context limited to medical CPS. \\ [PERSON] and [PERSON] [30] & RiBAC & Proposed a dynamic risk thresholds for IoT access. & Depends on timely and accurate risk data. \\ [PERSON] and [PERSON] [31] & ABAC, RiBAC & Developed a DA-RAAC model for adaptive cloud access & Heavily reliant on tuned risk engine. \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Categorization and summary of access control models. In summary, the studies reviewed from the literature have explored various aspects of access control models with different compositions and emphasized the benefits of each model.