# Enhancing Healthcare Security: A Unified RBAC and ABAC Risk-Aware Access Control Approach
## 2 Related Work
The RAdAC engine provides the functionality that compares the calculated risk from the designed risk level module with the acceptable risk level defined by the access control policy for each access request. The proposed estimation technique uses a scoring system to quantify the likelihood and impact of a particular threat and calculates an overall risk score for each asset. This risk score is then used as input to a genetic algorithm to generate a set of countermeasures. Investigating further into the Risk-Based Access Control models, [PERSON] et al. [15] suggested integrating attribute-based and risk-based models. Their approach defines the use of ABAC to enforce policies based on user attributes. At the same time, the risk-based layer evaluates contextual factors such as user behaviors and locations to adjust the decision generated by ABAC. Similarly, [PERSON] and [PERSON] [16] proposed another access control model that integrates the ABAC and RiBAC models. The proposed structure dynamically adjusts ABAC policies based on risk assessments, ensuring flexible access control decisions. More Risk-Based Access Control models were presented. [PERSON] et al. [17] and [PERSON] et al. [18] introduced a dynamic Risk-Based Access Control model wherein the user's past behaviors and risk history were utilized to estimate the security risk associated with each access request. Furthermore, this method involved assigning reward and penalty points to subjects/users upon transaction completion, dependent upon the assessed risk value associated with the transaction. Building upon the groundwork presented in [17], the research outlined in [18] expanded upon the implementation process of risk estimation to differentiate between users exhibiting good and malicious behavior patterns based on their past behavior. In the same way, [PERSON] et al. [19] integrated the Risk-Based Access Control model into the federated identity management framework within cloud computing. This integration leveraged security risk assessments to guide access decisions and mitigate vulnerabilities and risks inherent in collaborative endeavors. Additionally, their study introduced a hierarchical risk aggregation system tailored for cloud federation scenarios. [PERSON] et al. [20] proposed RASA, a risk-aware access control model that leverages unsupervised machine learning to automatically infer context-sensitive authorization decisions. RASA addresses the challenges of managing authorization contexts in dynamic environments by analyzing historical access logs and identifying patterns of access. The model utilizes coupling mechanisms to track the coexistence of objects within a context, clustering these couplings based on frequency and the duration of coexistence. By associating risk levels with these clusters, RASA dynamically defines authorization boundaries to ensure that access is granted only when appropriate. The study evaluates RASA in a simulated healthcare environment to demonstrate its effectiveness in protecting sensitive patient information. [PERSON] et al. [21] proposed a risk-aware access control model for healthcare information sharing, extending the Work-Based Access Control (WBAC) model by incorporating risk assessment. The model calculates the risk associated with each access request based on the user's trust level and the object's security level to weight it against the organization's risk threshold. Access is granted if the risk threshold outweighs the risk of granting access; otherwise, it is denied. The model dynamically calculates user trust based on their past behavior to assign different weights to recent and older events. Researchers have proposed integrating the RBAC with the risk model (RiBAC) to provide a more fine-grained and flexible access control model. For example, [PERSON] and [PERSON] [22] integrated security risk into RBAC, forming a risk-aware RBAC model. Their work investigated the challenges surrounding the devised risk-aware model and outlined the steps involved in its implementation. Similarly, [PERSON] et al.