## 4 The Proposed Development Model: Holistic Security and Accessibility Layered Architecture (HSALA)
### The Accessibility Enhancement Layer and Accessibility Security Layer
The Accessibility Enhancement Layer is secured by the Accessibility Security Layer, which ensures that accessibility features do not introduce security vulnerabilities and do not compromise the application's security. The Accessibility Security Layer embeds techniques and practices addressing the accessibility challenges posed by various authentication methods [44], like implementing multi-factor authentication methods that are inclusive, and providing secure login options for all users, including individuals with disabilities. Presented below is a list of challenges and mitigation strategies for several authentication methods:  
* Knowledge-Based Authentication (Passwords, PINs):
* Challenges: Users with cognitive impairments or memory difficulties may struggle to remember complex passwords or PINs. The requirement for frequent password changes can exacerbate this issue. * Mitigation Strategies: implement user-friendly password policies, allow the use of passphrases, and provide options for password managers that are accessible. * Possession-Based Authentication (Hardware Tokens, One-Time Passwords):
* Challenges: individuals with motor impairments or limited dexterity may find it difficult to handle physical tokens or input codes from devices. * Mitigation Strategies: offer virtual tokens, mobile app-based authenticators with accessible interfaces, or alternative methods that do not require physical manipulation. * Biometric Authentication (Fingerprint, Facial Recognition):
* Challenges: Users with certain physical disabilities may be unable to provide biometric data. For example, amputees cannot use fingerprint scanners, and facial recognition may not work accurately for users with facial differences. * Mitigation Strategies: provide multiple biometric options, such as voice recognition or iris scanning, and ensure that systems are calibrated to meet the needs of a diverse user base. * Challenge-Response Mechanisms (CAPTCHAs):
* Challenges: traditional visual CAPTCHAs are inaccessible to users with visual impairments, while audio CAPTCHAs may not be suitable for those with hearing impairments or non-native language speakers. * Mitigation Strategies: implement accessible CAPTCHAs, such as text-based challenges, logic puzzles, or interactive tasks that are compatible with assistive technologies. User choice and flexibility is recommended; users can select from multiple authentication options based on their abilities and preferences, ensuring that security does not become a barrier to access. The instructions for setting up and using multi-factor authentication are provided in accessible formats, including large text, audio descriptions, and simplified language. Additionally, support channels need to be equipped to assist users with disabilities. By integrating these strategies, HSALA ensures that authentication mechanisms are inclusive and do not inadvertently exclude users with disabilities. This approach upholds the principles of both security and accessibility, reinforcing the model's commitment to creating a universally usable web application architecture. The layer is also responsible for integrating accessibility scanning (e.g., WAVE), and ensures that ARIA _roles_, _properties_ and _attributes_ are implemented without introducing security risks, providing a secure and inclusive experience for all users, meeting both accessibility and security standards. Figure 6 presents the relation, technologies, and roles of the Accessibility Enhancement Layer and Accessibility Security Layer. These two interconnected layers, along with the Content Presentation Layer and Content Presentation Security Layer, form the User Interaction Layer Group (as shown in Figure 1). This group represents the interface between the web application and users through devices such as smartphones, tablets, or PCs.