# Risk-Based Access Control Model: A Systematic Literature Review
## 2 An Overview of Access Control  
The key objective of the access control is to limit operations performed by authorized users. In addition, it prohibits any action that could trigger a security violation [1]. An effective access control model should fulfill the security demands of confidentiality, integrity, and availability [3]. It is essential to make a reasonable distinction between authentication, authorization, and access control. Authentication is the process of verifying the identity of a user [7], while allowing or denying access to an authenticated user to carry out particular tasks on particular resources is called authorization. Access control is the process of enforcing authorization policies. Once a user is authenticated and the authorization level is identified, access control is used to enforce user permissions to prevent the user/subject from accessing anything that he/she should not be able to [3].  
The history of the phrase \"Access Control\" has started in transportation in the first half of the 20 th century. The concept of the limited-access road was suggested in 1907 to control fast-growing motor traffic. Although early cars were not as fast as today's standard, car drivers were enforced to control their speed on highways. They were enforced to enter and exit via one-way ramps to control the access to highways, which led to a reduction in the probability of cross-traffic accidents and increases the speed of traffic flows [8].  
Currently, access control is applied at diverse levels in several domains such as database management systems and operating systems to control resources and allow only legal users/subjects to use system resources in an authorized way. An access control model comprises of five core elements: subjects, actions, objects, privileges, and access policies [9].  
* **Subjects**: represents various entities that can be user, agents, or processes that make an access request to access system resources (objects).
* **Objects**: describes system resources encompassing data or information that needed to be accessed by subjects/users.
* **Actions**: represents various types of actions or activities that subjects can perform on a particular object such as read, write, execute, etc.
* **Privileges**: These are the permissions that are granted to subjects to be able to carry out a particular action on a particular object.
* **Access policies**: These are a group of rules or procedures that specify the criteria needed to determine the access decision whether granting or denying access for each access request.  
The flow of an access control process can be shown in Figure 1. The flow begins when a subject/user sends an access request to the access control manager to access a particular object. Then, the access control manager compares the subject's credentials against access policies to decide whether granting or denying access. If the access is granted, the access control manager will allow the user to access the object. While if the access is denied, the access control manager will send a warning message due to insufficient credentials and ask the subject to use sufficient credentials to be able to access the requested object [9].  
Figure 1: Flow of an access control operation.  
There are many access control approaches, which can be categorized into two main groups: traditional and dynamic access control approaches.