Cited by 60Access Control and TrustInformation and Cyber SecurityAdvanced Authentication Protocols Security

An efficient security risk estimation technique for Risk-based access control model for IoT

Open access
Atlam, Hany F., Wills, Gary B.·2019·Internet of Things

Abstract

Abstract The need to increase information sharing in the Internet of Things (IoT) applications made the risk-based access control model to be the best candidate for both academic and commercial organizations. Risk-based access control model carries out a security risk analysis on the access request by using IoT contextual information to provide access decisions dynamically. Unlike current static access control approaches that are based on predefined policies and give the same result in different situations, this model provides the required flexibility to access system resources and works well in unexpected conditions and situations of the IoT system. One of the main issues to implement this model is to determine the appropriate risk estimation technique that is able to generate accurate and realistic risk values for each access request to determine the access decision. Therefore, this paper proposes a risk estimation technique which integrates the fuzzy inference system with expert judgment to assess security risks of access control operations in the IoT system. Twenty IoT security experts from inside and outside the UK were interviewed to validate the proposed risk estimation technique and build the fuzzy inference rules accurately. The proposed risk estimation approach was implemented and simulated using access control scenarios of the network router. In comparison with the existing fuzzy techniques, the proposed technique has demonstrated it produces precise and realistic values in evaluating security risks of access control operations in the IoT context.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.1016/j.iot.2019.100052

Cites

45 of 45 references verified0 citation errors · 0 not checkable

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • The approach in [76] used real-time contextual attributes of the subject making the access request to estimate risk and make the appropriate access decision.

    “This approach used real-time contextual attributes of the subject making the access request to estimate the risk and make the appropriate access decision.”

    From Zero Trust Architecture (ZTA): A Comprehensive Survey (2022) · cites this paper as [76]

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

Flagged first, then by citations

3 of the 48 references couldn’t be matched to a known paper.

Research works printed but not linked: 7

  1. [13]13. R. McGraw, "Risk-Adaptable Access Control ( RAdAC )," inPrivilege Manag. Work. NIST-National Inst. Stand. Technol. Technol. Lab., 2009.
  2. [24]24. J. Yin, C. Tang, X. Zhang, and M. McIntosh, "On estimating the security risks of composite software services," in In First Program Analysis for Security and Safety Workshop Discussion (PASSWORD 2006), 2006.
  3. [27]27. D. Kahneman, P. Slovic, and A. Tversky, "Judgment under uncertainty: heuristics and biases," Science (80-. )., vol. 185, no. 4157, pp. 1124-1131, 1974.
  4. [28]28. D. Pluess, A. Groso, and T. Meyer, "Expert Judegement in Risk Analysis: A Strategy to Overcome Uncertainities," Chem. Eng. Trans., vol. 31, pp. 307-312, 2013.
  5. [29]29. Da Ruan, Fuzzy Sets And Fuzzy Information Granulation Theory. Bejing: Bejing Normal Univeristy Press, 2000.
  6. [30]30. K. Boc, "Fuzzy approach to risk analysis and its advantages against the qualitative approach," in Proceedings of the 12th International Conference "Reliability and Statistics in Transportation and Communication, 2012, no. 12, pp. 234-239.
  7. [43]43. U. Kose, "Fundamentals of Fuzzy Logic with an Easy-to-use , Interactive Fuzzy Control Application," Int. J. Mod. Eng. Res., vol. 2, no. 3, pp. 1198-1203, 2012.

Cited by

Sorted by citations

Authors
Atlam, H. F., & Wills, G. B.
Affiliations
University of Southampton (GB)
Corresponding author
Atlam, Hany F.
Venue
Internet of Things
Publisher
Elsevier BV
Published
2019-06
Volume
6
Pages
100052
ISSN
2542-6605 (ISSN-L)
OpenAlex
W2936201262
Cited by
60
References
48
Citations by year
2025: 12 · 2024: 6 · 2023: 12 · 2022: 15 · 2021: 9 · 2020: 4 · 2019: 2
FWCI
15.11
Type
journal article
Language
en
Open access
Locations
  • Internet of Things (publishedVersion)
  • ePrints Soton (University of Southampton) (submittedVersion)
  • University of Derby Online Research Archive. (University of Derby) (submittedVersion, cc-by)
Topics
  • Social Sciences › Sociology and Political Science › Access Control and Trust
  • Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
  • Physical Sciences › Computer Science › Computer Networks and Communications › Advanced Authentication Protocols Security
Keywords
risk-based access control, Internet of Things security, fuzzy inference system, expert opinion, fuzzy inference rules

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review