State-aware access control for cyber-physical-social space: Model and policy security assurance

Abstract

The cyber–physical-social space provides its users with a comfortable and convenient environment for work or living, achieved through the integration of state information from the cyber world, the physical world and the social world. While this integration creates a smart environment, it also presents a significant challenge to access control methods. This paper addresses the evolving access control requirements in the cyber–physical-social space and introduces a state-aware access control model along with an access control policy security assurance mechanism. To articulate the contextual state and state transformations in the cyber, physical, and social worlds, we propose the cyber–physical-social state description method. Building upon this method, we construct a state-aware access control model to precisely define the security requirements of the cyber–physical-social space. Additionally, we introduce a liveness requirement-oriented access control policy generation method and a safety requirement verification method to analyze how changes in the state of humans, cyber data, and physical entities impact authorization. Through a case study involving an intelligent hospital, we demonstrate that the proposed model possesses rich semantics and effectively conveys the security requirements of the cyber–physical-social space. The access control policy set, generated using our proposed methods, successfully avoids issues of missing and incorrect authorizations, ensuring a robust and reliable security system.