# Enhancing Healthcare Security: A Unified RBAC and ABAC Risk-Aware Access Control Approach
## 2 Related Work
[23] introduced a model that merges RBAC with RiBAC to determine access decisions. Their work introduced the concept of RBAC-based risk-awareness and provided a formal depiction of an adaptive risk-aware RBAC model. Also, [PERSON] et al. [24] introduced the utilization of classification for evaluating the risk associated with each access request. Their study explained two distinct approaches: firstly, employing an access control matrix to gauge the risk associated with access grants based on user-permission assignments; secondly, identifying the optimal contextual role that minimizes risk while maximizing accessibility by integrating security risk considerations with RBAC. In the same way, [PERSON] and [PERSON] [25] introduced a model that extends the traditional RBAC model by integrating trust alongside risk to inform access decisions. They argued that their model offers adaptability to variations in user behavior by employing a threshold value derived from a risk assessment procedure. On the other hand, an approach that integrates ABAC and RBAC to address the limitations of implementing these models independently was proposed by [PERSON] et al. [7]. This approach offers the benefits of both approaches and emphasizes automatic permission creation and role assignment based on object attributes. The authors argue that the dynamic nature of their model eliminates the need for manual updates. They then explain the process of automatically assigning permissions to user roles using object properties. Such a process eliminates the need to assign permissions in traditional RBAC manually and simplifies the authorization assignment process by assigning permissions to roles by matching attribute expressions. [PERSON] et al. [26] also solved the challenges associated with implementing two access control models independently by integrating ABAC's policy evaluation component based on RBAC. It merges the straightforward structure of the RBAC model with the awareness offered by the contextual attributes from ABAC. Unlike traditional access control approaches, this framework automatically assigns roles based on attributes of objects rather than setting permissions individually by specific root users. The authors highlight the potential capability of their proposed model in dynamic environments, particularly within critical domains like industrial control systems. Furthermore, [PERSON] et al. [27] developed a context-aware RBAC model that integrates traditional Chinese and Western medicine practices. They enhance the system's access control decisions by incorporating contextual awareness into the traditional RBAC basis. While highlighting the advantages of the proposed model in managing the combination of traditional Chinese and Western medicine in the medical system, the authors also mention potential challenges, including implementation complexity and the absence of comprehensive guidelines for similar system implementations. Also, [PERSON] et al. [28] proposed an ABAC model for healthcare systems to replace the traditional RBAC approach. The authors argued that their proposed ABAC model delivers enhanced flexibility and finer granularity in access control of the healthcare system. [PERSON] and [PERSON] [29] proposed a constraint and risk-aware approach to ABAC. Their model is composed of a Cyber-0 Physical Access Control (CPAC) model and a Generalized Action Generation Model (GAGM) to enhance traditional ABAC by incorporating cyber-physical components and interactions. The CPAC model integrates Separation of Duty (SoD) constraints to support security, while the GAGM helps in enforcing access policies. Also, [PERSON] and [PERSON] [30] proposed an adaptive risk-aware access control model for the IoT to address security and privacy concerns in data sharing. The authors argue that traditional access control models like ACL, RBAC, and ABAC are insufficient for IoT scenarios due to their inability to dynamically assess risk based on user profiles and behavior.