SCENARIO-BASED METHODOLOGY FOR EVALUATING A HYBRID ACCESS CONTROL METHOD IN UNIVERSITY INFORMATION SYSTEMS: SCENARIO-BASED METHODOLOGY FOR EVALUATING A HYBRID ACCESS CONTROL METHOD IN UNIVERSITY INFORMATION SYSTEMS

Radostin Lefterov

doi:10.46687/jsar.v31i1.510

Authors

Radostin Lefterov Department of Mathematics, Informatics and Natural Sciences, Technical University of Gabrovo, Gabrovo, Bulgaria, e-mail: rikitab@gmail.com

DOI:

https://doi.org/10.46687/jsar.v31i1.510

Keywords:

Access Control, Hybrid Method, RBAC, ABAC, Context-Aware Access Control, Risk Assessment, SIEM, EDR, University Information Systems

Abstract

This paper presents a scenario-based methodology for evaluating a hybrid access control method intended for university information systems. The proposed approach combines role-based and attribute-based access control with contextual information, SIEM and EDR signals, and dynamic risk assessment. A structured set of ten evaluation scenarios is defined for student, lecturer, and administrative access, including normal conditions, insufficient permissions, changed context, increased risk, and critical security situations. The methodology also defines comparative criteria for examining the expected behaviour of traditional RBAC, RBAC combined with ABAC, and the proposed hybrid method. The presented scenarios do not represent completed experimental results, but provide a consistent basis for subsequent implementation and validation in a controlled university information system environment.

Author Biography

Radostin Lefterov, Department of Mathematics, Informatics and Natural Sciences, Technical University of Gabrovo, Gabrovo, Bulgaria, e-mail: rikitab@gmail.com

Department of Mathematics, Informatics and Natural Sciences, Technical University of Gabrovo, Gabrovo, Bulgaria, e-mail: rikitab@gmail.com

References

Sandhu, R. S., E. J. Coyne, H. L. Feinstein, and C. E. Youman, “Role-Based Access Control Models,” Computer, vol. 29, no. 2, pp. 38–47, 1996. DOI: 10.1109/2.485845.

Hu, V. C., D. Ferraiolo, R. Kuhn, A. Schnitzer, K. Sandlin, R. Miller, and K. Scarfone, Guide to Attribute Based Access Control (ABAC) Definition and Considerations, NIST Special Publication 800-162, National Institute of Standards and Technology, 2014, updated 2019. DOI: 10.6028/NIST.SP.800-162.

Kayes, A. S. M., R. Kalaria, I. H. Sarker, M. S. Islam, P. A. Watters, A. Ng, M. Hammoudeh, S. Badsha, and I. Kumara, “A Survey of Context-Aware Access Control Mechanisms for Cloud and Fog Networks: Taxonomy and Open Research Issues,” Sensors, vol. 20, no. 9, art. 2464, 2020. DOI: 10.3390/s20092464.

Rose, S., O. Borchert, S. Mitchell, and S. Connelly, Zero Trust Architecture, NIST Special Publication 800-207, National Institute of Standards and Technology, 2020. DOI: 10.6028/NIST.SP.800-207.

Atlam, H. F., M. A. Azad, M. O. Alassafi, A. A. Alshdadi, and A. Alenezi, “Risk-Based Access Control Model: A Systematic Literature Review,” Future Internet, vol. 12, no. 6, art. 103, 2020. DOI: 10.3390/fi12060103.

González-Granadillo, G., S. González-Zarzosa, and R. Diaz, “Security Information and Event Management (SIEM): Analysis, Trends, and Usage in Critical Infrastructures,” Sensors, vol. 21, no. 14, art. 4759, 2021. DOI: 10.3390/s21144759.

Shen, X., Z. Li, G. Burleigh, L. Wang, and Y. Chen, “Decoding the MITRE Engenuity ATT&CK Enterprise Evaluation: An Analysis of EDR Performance in Real-World Environments,” Proceedings of the 19th ACM Asia Conference on Computer and Communications Security (ASIA CCS ’24), pp. 96–111, 2024. DOI: 10.1145/3634737.3645012.

SCENARIO-BASED METHODOLOGY FOR EVALUATING A HYBRID ACCESS CONTROL METHOD IN UNIVERSITY INFORMATION SYSTEMS