## 2 Literature Review  
In the cloud environment, the dynamic changes of the user environment add difficulties to resource access control. Risk assessment has been proposed in recent years as an effective solution for dealing with uncertain and difficult-to-control user behaviors in complex environments [2]. This method can evaluate the possibility of users participating in the system behavior and the risks in the user environment to control uncertain user behavior effectively. Therefore, it is very important to study risk assessment for access control. [PERSON] et al. [3] proposed a dynamic risk-based access control model and introduced three new modules: Risk Engine, Risk Quantification Service, and Risk Policy. Although the research does not disclose precise risk quantification techniques, this approach enables users and cloud service providers to specify how to manage risky access requests. [PERSON] et al. [4] proposed a similar model, with risk measurement serving as a secondary decision indicator. Additionally, a risk threshold is created dynamically from historical data, and the policy, risk assessment, and dynamic threshold all impact the final, holistic choice. To increase its performance, a data stream-based sliding window calculating approach is used. [PERSON] et al. [5] analyzed the differences between traditional constraint-based risk control and risk quantification methods, proposed an adaptive risk-aware RBAC model, introduced risk in the role-based access control model, and gave a quantitative Risk Analysis Methods. To solve the problem of manual intervention in traditional multi-level security systems, trust and risk values, [PERSON] et al. [6] proposed a risk calculation method that can dynamically adapt to historical values, and a dynamic risk access control model is given, and comprehensive decision-making is made through two aspects of trust and risk. [PERSON] et al. [7] provided a comprehensive analysis of cloud computing's access control requirements, identified significant holes that are not addressed by traditional access control approaches, and proposed an access control model to satisfy the defined cloud access control criteria. [PERSON] and [PERSON] [8] proposed an innovative access control mechanism for effective data access. The suggested approach retains a popularity score for each large data piece to reduce the number of security issues. The experimental results showed that the suggested strategy resists numerous types of attacks. Recently, ref. [9; 10] proposed Blockchain-based access control approaches in cloud computing. [PERSON] et al. [11] suggests a mutual trust-based access control model that integrates with trust management. This model considers both the trustworthiness of the cloud service provider and user activity. Mutual trust mechanisms are used to build trust between usersand the cloud to resolve access control security issues. [PERSON] et al. [12] suggests that the concept of trust in role-based access control can help to identify malicious users and ensure the security of the cloud and data. [PERSON] and [PERSON] [13] studied many conventional access control techniques and suggests a hybrid access control technique based on trust in the role-based access control technique. The experiments provided some evidence that the proposed approach can raise the system's trustworthiness, lessen the likelihood that tasks will fail to complete and be spoofed, and stop unauthorized individuals from accessing resources. [PERSON] [14] proposed a context-aware access control model by integrating role/subject-based models. Only the main concept of the framework and its prototype implementation are presented in this work. Most of the above studies are aimed at the access control model. In terms of risk quantification, [PERSON] et al. [15] proposed an access control model based on fuzzy reasoning.