# Enhancing Healthcare Security: A Unified RBAC and ABAC Risk-Aware Access Control Approach
## 4 Implementation of Proposed Model in Healthcare Scenario
### Risk-Based Access Control Implementation  
The risk-based model serves as a bridge between the precise ABAC model and the changing risk-awareness demands of healthcare systems. It is integrated into the proposed model as a supporting element, thereby empowering the system to collect contextual and risk factors in real time to enable access control decisions to be generated dynamically [36]. By assessing and responding to risks in such a way, the healthcare system becomes more resilient against potential threats. The real-time collection and analysis of contextual information empower the healthcare system to make well-informed access decisions to adapt swiftly to changing circumstances. The development of the risk engine to quantify the security risk associated with each access request will significantly enhance the proposed approach's overall adaptability and responsiveness. This heightened flexibility allows the healthcare system to adjust access permissions based on the evolving risk landscape, ensuring the secure handling of sensitive data in various scenarios.  
The proposed risk engine collects contextual and risk information according to four risk categories to generate quantitative risk values, which include the following.  
1. **Resource Sensitivity Risk**: This risk is determined by comparing user role and resource sensitivity to detect suspicious behavior; for example, it is unusual for a nurse to be granted access to restricted resources.
2. **Contextual Risk**: This risk is determined based on whether the user is on duty, accessing resources in their registered office, or accessing resources elsewhere with a similar office type (e.g., office, reception).
3. **User History Risk**: This risk is determined based on the user's past behavior; for example, it is uncommon to grant access to a user who has performed high-risk operations a few times.
4. **Operational Risk**: This risk is determined based on the user's operation type.  
To quantify the relevant risk attributes from the above categories, a sub-risk score is calculated for each category. Using predefined weights for each category, the following  
\begin{table}
\begin{tabular}{l l} \hline \hline
**User Roles** & **Operational Permissions** \\ \hline Nurse & Read, Write \\ \hline Doctor & Read, Write \\ \hline Admin & Read, Write, and Delete \\ \hline Social Worker & Read \\ \hline Police Officer & Read \\ \hline \hline \end{tabular}
\end{table}
Table 2: User roles and their operational permissions in the scenario.  
formula is employed to obtain the final risk result:  
\[\text{Final Risk = (Resource Sensitivity Risk * 0.4 [Proportion]) + (Contextual Risk * 0.4 [Proportion]) + (Operational Risk * 0.2[Proportion]) + (UserHistoryRisk)}\]  
The determination of proportions within the formula is predicated upon a comprehensive understanding of each category's systemic contribution. The user history risk explains that a user's engagement with data under secure conditions and a bad history will still lead to caution and not full trust in that user while accessing systems resources. The next section presents risk values assigned to each risk category based on this formula.