# Enhancing Healthcare Security: A Unified RBAC and ABAC Risk-Aware Access Control Approach
## 7 Conclusions  
This paper addresses the critical challenge of enhancing healthcare security in the face of evolving threats and vulnerabilities. Traditional access control models struggle to adapt to the dynamic and complex nature of modern healthcare environments. To overcome these limitations, this paper proposes a novel risk-aware access control model that integrates the RBAC, ABAC, and RiBAC models. This integrated approach leverages the strengths of each model, providing a more comprehensive and flexible solution for managing access to sensitive healthcare data. The proposed model dynamically adjusts access permissions based on real-time risk assessments, ensuring accurate and adaptable \begin{table}
\begin{tabular}{p{142.3 pt} p{284.5 pt}} \hline \hline
**Criteria** & **Contribution of the Proposed Model** \\ \hline Layered security & The proposed model integrates RBAC, ABAC, and risk assessment providing a layered security approach, making it more difficult for attackers to bypass security measures. RBAC acts as the foundational layer, authenticating user identities and filtering unauthorized requests. Risk Engine collects contextual and risk factors in real-time, dynamically adjusting access decisions based on the assessed risk, while ABAC serves as the core, evaluating policies based on attributes and risk scores to determine authorization. \\ \hline Contextual awareness & ABAC and the risk engine of the proposed model enable the system to consider context-sensitive information, such as user location, device type, and time of access, to make more informed access control decisions. The risk engine is responsible for collecting contextual information, such as user location, time of access, and user history. This information is used to dynamically adjust access decisions, making the proposed model context-aware. \\ \hline Dynamic risk assessment & The risk engine continuously evaluates the risk associated with each access request, adapting access control policies based on real-time threat intelligence and user behavior. This dynamic risk assessment allows for real-time adjustments to access permissions. \\ \hline Simplified administration & The proposed model utilizes AOP for RBAC implementation, allowing for modularizing access control logic, separating it from the core application code, leading to improved maintainability and extensibility. \\ \hline Standardization & The proposed model leverages XACML for policy definition and evaluation, a widely adopted standard for access control, promoting interoperability and standardization, and allowing for easier integration with existing systems. \\ \hline Usability & The proposed model leverages RBAC for user role management, making it easier for administrators to assign permissions. The model can be implemented with a user-friendly interface, simplifying the process of configuring policies and managing access control. \\ \hline Scalability & The proposed model’s layered structure and use of AOP for RBAC implementation contribute to its scalability. The modular design allows for easy expansion and adaptation to accommodate growing user bases and complex healthcare environments. \\ \hline Integration of RBAC, ABAC and RiBAC & The proposed model integrates RBAC for role-based categorization, ABAC for fine-grained control based on user attributes and environmental factors, and RiBAC for dynamic risk assessment. The model dynamically adjusts access permissions based on risk values, ensuring accurate and adaptable access control decisions. \\ \hline \hline \end{tabular}
\end{table} 
Table 11: _Cont._control decisions. Through a series of 43 experiments simulating various access control scenarios in a healthcare context, the experimental results demonstrate that the proposed model effectively grants access to authorized users while denying access to unauthorized ones, achieving high recall and precision metrics 86.96% and 90.90%, respectively.