# Enhancing Healthcare Security: A Unified RBAC and ABAC Risk-Aware Access Control Approach
## 2 Related Work  
Building a context-aware access control model that can dynamically adjust access permissions based on the changing context to ensure that users only have the necessary privileges at any given time has become crucial due to the dynamic nature of different systems. [PERSON] et al. [4] proposed a context-aware access control model utilizing fuzzy logic for cloud-based data resources. Their approach incorporates both fuzzy and contextual conditions into access control policies to address the vague nature of some contextual information. Another context-aware model was proposed by [PERSON] et al. [5] to address the challenge of context-aware access control in distributed cloud environments by proposing a Fog-Based Context-Aware Access Control (FB-CAAC) model. This model leverages fog computing to reduce latency and processing overheads to move application logic execution closer to the network edge. The authors enhance the access control mechanism by incorporating both fuzzy and precise contextual conditions to facilitate granular and dynamic access decisions. Risk-based models have attracted significant attention from researchers across diverse disciplines due to their robust applications and potential to improve decision-making processes. These models are designed to identify, assess, and mitigate risks, thereby enhancing effectiveness in access decision operations. [PERSON] et al. [10] explored the concept of risk management in access control systems. The authors provide a comprehensive overview of existing research and classify various approaches into two main categories: access-based and policy-based. They mainly focused on the policy-based approach and analyzed various articles that address risk assessment in access control policy expressions. The authors proposed a system that incorporates risk from correlated anomalies to add a new perspective to risk assessment. [PERSON] [11] also investigated the integration of risk analysis into access control mechanisms to address the limitations of traditional static access control models in dynamic environments. The author presented a taxonomy of risk analysis approaches and categorized them into score-based, rule-based, and hybrid methods. The author analyzed various techniques, including user behavior, fuzzy inference, and context/object-based risk assessment. Other researchers proposed practical solutions to implement risk-based models in various applications. [PERSON] et al. [6] introduced a risk-based model for the Internet of Things (IoT). This model considers four risk factors: user/agent context, resource sensitivity, action severity, and risk history. It evaluates the security risk associated with each access request and sets a risk policy using XACML (eXtensible Access Control Markup Language). Additionally, [PERSON] et al. [12] proposed another Risk-Based Access Control model for the IoT that uses real-time and contextual features to generate dynamic access decisions. The critical aspect of this model involves analyzing the risk associated with each access request to determine whether to permit or deny access, which is performed dynamically according to the estimated risk. The authors considered several risk factors that could affect access decisions, including the time and location of the access request, the identity of the user, and the sensitivity of the requested resource [13]. The authors argued that the traditional access control models do not consider these contextual factors, which may result in over- or under-privilege, leading to security breaches. By incorporating these contextual factors into the risk assessment process, the new model offers more robust and dynamic access control decisions for the evolving IoT environment. [PERSON] et al. [14] focused on defining an approach that generates customized countermeasures by proposing a new paradigm in access control environments named Risk-Adaptable Access Control (RAdAC). The model consists of three core modules: risk level, operational requirements, and access control policy.