The ISC International Journal of Information Security

Abstract Ensuring secure and continuous access in smart environments requires dynamic and context-aware policy enforcement, which traditional access control models cannot adequately support. This paper presents SmartUcon, a model-driven domain-specific modeling language (DSML) based on the UCON+ model, designed for specifying and managing usage control policies in IoT-enabled and cyber-physical systems. SmartUcon provides a Sirius-based graphical editor for intuitive policy modeling, along with an EGL-based code generator that automatically transforms high-level models into executable Axiomatics Language for Authorization (ALFA) policies. The semantics of the DSML are defined translationally via explicit mapping rules to ALFA, ensuring semantic preservation. The framework further incorporates design-time conflict detection and model-time validation using the Epsilon Validation Language (EVL) to reduce policy misconfigurations. To evaluate its applicability, 14 case studies were developed across five domains—smart vehicles, smart homes, smart cities, healthcare, and industrial systems—while a user study with 32 participants and statistical significance tests confirm the usability advantages of graphical modeling. A structural comparison with related metamodels confirms its superior coverage of obligations, advice, and device interactions. Overall, SmartUcon offers a practical and extensible model-driven solution for secure and trustworthy policy enforcement in smart environments.