## 3 Background and Related Work
### Identity Management
#### 3.1.3 Authorization  
After the user has been authenticated, authorization provides the answer to the final question during resource access: \"Is the user allowed to access the resources?\". Authorization describes the following: (1) the organizational process of granting access permissions to identities, and (2) the technical process performed by the ICT services whenever a user attempts to access protected resources. Organization-wide identity management controls which ICT services a user is allowed to access. The more fine-grained access permissions are specific to each ICT service and managed locally; for example, by using access control lists for file servers, the eXtensible Access Control Markup Language (XACML), or other proprietary management interfaces for services [30]. This step is also called policy specification.  
Access control policies are mostly logical statements, which result from an identity's attributes, roles, and the structure of the organization. According to the _principle of least privilege_ or _need-to-know_, each identity should only receive those permissions that are needed to fulfil its tasks. Modern access control policy languages support a higher degree of dynamics; for example, with risk-based authentication. As an example, sensitive data may only be accessed during office hours from a known device within the office. Other attempts are blocked, based on the current time, device certificate, and Internet protocol (IP) address. [PERSON] et al. [31] provided an overview of different factors. Though this gives more flexibility and might reduce the total amount of authentication factors,  
Figure 2: Authentication Lifecycle according to NIST [23].  
it also increases the complexity and can lead to user frustration [32; 33; 34]. RBA can be applied in different scenarios, such as border control [35], online accounts [36], and mobile devices [37]. [PERSON] described [38] Open Authorization (OAuth), a protocol focusing on web authorization. This could be used for identity federations, i.e., a circle of trust of several cooperating organizations sharing web-based services with their users. Nevertheless, in such an identity federation, the home organization typically sends more attributes to the service provider than required, as pointed out by [PERSON] and [PERSON] [39].  
As mentioned by [PERSON] and [PERSON] [40], trust is an important aspect during authorization. Access control can prevent illegal operations of users and protect security. In consequence, the system needs to estimate the trust in the applicant resp. the authentication and apply different roles and permissions (policy evaluation and enforcement). Zero trust architectures [41] continuously monitor the trust during regular authorizations and re-evaluate the trust related to the action. Depending on the evaluation and the requested resources, either one or up to multiple factors are required for authentication, or access is not granted at all. The UK's National Cyber Security Centre (NCSC) released a guideline on zero trust architecture design principles in 2021 [42]. Similarly, [PERSON] [43] provided an overview of ZTA. [PERSON] et al. [44] proposed such an approach for consumer IoT. In the context of identity federations, ZTA could be used [45]. [PERSON] and [PERSON] [46] evaluated the implementation of ZTA. The authors formulated four critical success factors: (1) alignment with risk management and existing frameworks; (2) board and business involvement and explicit sign-off; (3) ownership for asset risks and measures; (4) focus on the change and on the run. This shows alignment with business management is important.