## 4 Authorization and Access Control in the Smart Grid (SG) Network  
Authentication and authorization (AA) are two completely independent concepts that are essential for secure design of the system. Authentication mechanism verifies the identity of the entity (user, device, _etc._). By enabling mutual authentication, the involved entities can verify whether they are connected to the legitimate entity at the other end or not. On the other end, authorization mechanism verifies whether the entity has required permissions or rights to access the desired entity/resource or perform desired operation. Authorization is close to access control, but they are exactly the same. Authorization generally refers to the decision policy of whether a user is allowed/denied, while the access control refers to the enforcement mechanism for the required security with base access controls on physical attributes, sets of rules, lists of individuals' identities, _etc._ A fine-grained authorization refers to an expansion of access controls. It is a mechanism to protect the privacy of various entities by authorizing each entity with different capabilities of accessing resources. It clearly differentiates between a legitimate and an invalid user. Hence, it is an important property for maintaining privacy protection in the SG network. Authentication, authorization, and control policy together are also referred as an access control mechanism. It is strongly required in the SG system as various users with different roles access billions of devices in the network. Generally, there are three types of access control mechanisms: user-based access control (UBAC), role-based access control (RBAC), and attribute-based access control (ABAC). Access control mechanism can be centralized or decentralized with static or dynamic attributes/functional policy in nature. In a centralized access control, all data are stored and managed in a central location in different modules, such as control panels and reader control modules. It is simple and easy to manage. However, a single point of failure can affect the system massively or even stops the service. On the other hand, decentralized access control enables more flexibility to individuals and usually follows a rule-based policy. Adding and/or deleting a control module using a decentralized access control policy does not affect the whole system, rather it reduces the cost and long distance connections. Furthermore, unlike general or static access control, dynamic access control uses place, time, and purpose according to the context information as conditions for access permissions [88]. In this direction, [PERSON] _et al._[89] proposed a policy-based access control scheme, which is based on the centralized key distribution center (KDC). Unfortunately, the online requirement and having a single central body of the system (the single-point-of-failure will shut down the complete system), KDC rather becomes the drawback. [PERSON] and [PERSON] [90] discussed the relation distribution over a control system and approach to identify the access privileges in the HAN network. They proposed a RBAC scheme, which authenticates the privileges using a message hash code. However, the security of this system is not justified. The highly demanded access control among SG entities results in security threats and vulnerabilities. In order to control these issues, [PERSON] _et al._[91] proposed an access control mechanism that supports scalability, interoperability and flexibility of multi-domain smart grid system. They proposed a domain-of-domain (DoD) approach based on role attributes based-access control (RABAC) to fulfil the scalability and interoperability in the SG network. However, the security of the proposed approach is not verified. After that, [PERSON] and [PERSON] [92] suggested a decentralized security framework for the SG network that carries out access control as well as data aggregation.