Risk-Aware Access Control And XACML

In this thesis, we propose an extension of an existing RAAC abstract model that supports risk assessment, risk-aware authorisation decision making and the use of system and user obligations as risk mitigation methods. We also propose an implementation of the extended abstract model based on XACML, a standard that defines an XML-based language for the specification of access control policies, requests and responses. We develop a novel Risk-Aware Group Based Access Control (RA-GBAC)