# HEAD Access Control Metamodel: Distinct Design, Advanced Features, and New Opportunities
## 1 Introduction  
Security and privacy in general and the protection of logical and physical resources from unauthorized access, in particular, are critical and essential issues for today's organizations. Their resources are accessed via various types of private and public networks; this depends on the type of service(s) their information systems (IS) provide. The new generation of networking environments with digital transformation such as the internetof things (IoT), fog computing, cloud computing, etc., is emerging and has various applications related to several, critical domains. This networking generation has several interconnections by means of multiple layers of public and private networks constituting critical cyber-physical infrastructures where an unlimited number of resources are distributed and accessed from everywhere, anytime, and anyhow. With this fact, controlling access is a critical objective, especially with the presence of cyber-criminals and cyber-attacks [1], and a big challenge for deploying secure information ISs. For this purpose, several AC models have been implemented to control what resources can be accessed by users, when, and how after checking a predefined set of AC rules. What makes this process even more challenging is the orientation of the world toward the concept of telework due to the COVID-19 pandemic and the urgent need to access sensitive and vital resources related to various domains [2]. With the evolution of technology trends, it is realized that controlling users' access and the operations they perform on information cannot be overlooked when developing approaches related to information security. Moreover, the existing AC models have reached their limits and are insufficient to answer the increasing demand for security and privacy standards [3, 4]. Common AC models that are implemented to control users' access to resources are discretionary access control (DAC), mandatory access control (MAC), role-based access control (RBAC), and attribute-based access control (ABAC) models [4, 5, 6, 7]. Unfortunately, two main issues prevent an IS from following up the evolution of security threats. First, the focus is on defining the functional IS requirements, while the non-functional requirements such as authentication and authorization are almost barely handled at the termination of the development process. Second, the exisiting AC metamodels, which are proposed to serve as unifying frameworks to include the heterogeneous AC models, only provide support of defining some AC components for some models which prevent defining a larger set of organizational AC policies or upgrading the defined ones [4, 6, 8]. Hence, one of the main steps to solve the first issue is to tackle the second one, in other words, while developing an IS it is important to set up trusted security policies and provide the essential tools to define all the needed AC components. This, in turn, would allow system administrators to set up and manage the defined AC policies in an organization. Security solutions must be manageable and adaptable to track the evolution of security threats which accompany technology upgrades. Along with technology progressions, various research works have been conducted in this domain (in Section 2, we summarize their development stages). Unfortunately, common AC models have various limitations; the hybrid models (Section 3.2.1), the extended models (Section 3.2.2), and the abstracted models (Section 3.2.3) cannot answer all the needed AC requirements; moreover, the existing AC metamodels have several shortcomings (explained in Section 4) and are not able to follow technology progressions [5, 6, 9]. To address this issue, we have developed a Hierarchical, Extensible, Advanced, and Dynamic (HEAD) AC metamodel with substantial and advanced features [3] compared to the existing AC metamodels [5, 9].