A Novel Method for Risk Calculation of Access Control Policies for Physical Security of Buildings

Access logic algorithms govern how occupants gain entry to rooms in the building access control industry by validating credentials presented to electronic locks. The security of these systems depends on the policies used to design the underlying access logic. Quantifying and ranking the security risks associated with different access control policies helps building planners and architects make informed decisions to enhance security. This paper conducts a thorough security risk assessment for building access control systems, following NIST guidelines. It presents a structured method to calculate and evaluate security risks across four widely recognized access control policies - Discretionary Access Control (DAC), Mandatory Access Control (MAC), Rule-Based Access Control (RuBAC), and Attribute-Based Access Control (ABAC). Using a student dormitory model, the study introduces a Risk Ranking Value metric based on features such as room criticality, usage frequency, and building occupancy. The study ranks the aforementioned access control policies using the Risk Ranking Value metric and provides insights into their suitability for various application scenarios.