# HEAD Access Control Metamodel: Distinct Design, Advanced Features, and New Opportunities
## 2 Access Control Challenges within Dynamic and Heterogeneous Environments  
Providing security and privacy, using AC mechanisms, is a very crucial metric within current ubiquitous computing and pervasive systems. Herein is a set of existing challenges in this domain [2, 3, 11, 12, 13, 14]:  
* [noitemsep]
* Access control serves as a protective shield for the existing resources in organizations, industries, homes, etc., against security risks that accompany transparency, shareability, and interoperability while answering users' access requests within distributed and heterogeneous computing environments (e.g., IoT environments) where data is generated dynamically and on a real-time basis.
* Access control is highly essential to ensure secure communications in open, dynamic, and heterogeneous environments, especially with the existence of several contexts (network type, time, location, machine characteristics, etc.). For example, to provide an access decision, several or multi-level contexts must be considered. The context itself is a challenge since it could be defined, expressed, and interpreted in different ways according to the application domain, the needed objectives, and the existing techniques.  
* Access control mechanism should be flexible and controllable enough to deal with various situations that confront users while requesting access to different types of resources, for example, rapid progressions, unexpected events, system failures, highly dynamic environments that need very quick and controlled response, various hierarchical organizational structures, the different contexts, dynamism of IoT devices, huge number of devices, etc.
* With the large adoption of telework, especially with the COVID-19 pandemic, employees can work anytime, anywhere, and sometimes using their own personal devices. With this fact, security and AC issues have been raised, especially that AC mechanisms should be adapted to users' context, their profiles, their devices, the existing conditions, and many other parameters to improve system usability. With this fact, AC needs to be dynamically managed to minimize human intervention. Besides, the following are the key AC enforcement challenges:
* The heterogeneity of implemented AC models in heterogeneous structures.
* Deciding upon the most relevant AC model(s) to implement in an organization that conform to its AC rules based on the type and sensitivity of resources they have.
* The necessity to enforce persistent AC policies with the current generation of dynamic and heterogeneous structures where information flows from the clouds and/or servers to everywhere (companies, hotels, homes, cars, etc.) without traditional borders.
* The possible need for several AC solutions within the same organization (or industry sector) where various technologies (e.g., local network, IoT, and cloud) may need to work in concert to fulfill the needed requirements of AC.
* The importance of upgrading AC policies and enforcing them in accordance with technology upgrades and due to dynamically changing conditions.  
Due to the above challenges, and the limitations of common models, hybrid models, extended AC models, and abstract AC models in answering the needed AC requirements of the current computing environments, and since they are unable to follow up the continuous technology progressions [5; 6; 12], the research interest for developing AC metamodels has gained attention in the last decade [9].