SmartUcon: A Model-Driven Framework for Secure and Privacy-Aware Usage Control in Smart Environments

Asmand Joneghani, Mohammad; Samimi-Dehkordi, Leila

doi:10.22042/isecure.2026.554737.1262

SmartUcon: A Model-Driven Framework for Secure and Privacy-Aware Usage Control in Smart Environments

Articles in Press

Document Type : Research Article

Authors

Mohammad Asmand Joneghani

Leila Samimi-Dehkordi

Department of Computer Engineering, Faculty of Technology and Engineering, Shahrekord University, Shahrekord, Iran

10.22042/isecure.2026.554737.1262

Abstract

Ensuring secure and continuous access in smart environments requires dynamic and context-aware policy enforcement, which traditional access control models cannot adequately support. This paper presents SmartUcon, a model-driven domain-specific modeling language (DSML) based on the UCON+ model, designed for specifying and managing usage control policies in IoT-enabled and cyber-physical systems. SmartUcon provides a Sirius-based graphical editor for intuitive policy modeling, along with an EGL-based code generator that automatically transforms high-level models into executable Axiomatics Language for Authorization (ALFA) policies. The semantics of the DSML are defined translationally via explicit mapping rules to ALFA, ensuring semantic preservation. The framework further incorporates design-time conflict detection and model-time validation using the Epsilon Validation Language (EVL) to reduce policy misconfigurations. To evaluate its applicability, 14 case studies were developed across five domains—smart vehicles, smart homes, smart cities, healthcare, and industrial systems—while a user study with 32 participants and statistical significance tests confirm the usability advantages of graphical modeling. A structural comparison with related metamodels confirms its superior coverage of obligations, advice, and device interactions. Overall, SmartUcon offers a practical and extensible model-driven solution for secure and trustworthy policy enforcement in smart environments.

Keywords

Domain-Specific Modeling Language

IoT Security

Model-Driven Engineering

Smart Environments

Usage Control

[1] Kaushik Ragothaman, Yong Wang, Bhaskar Prasad Rimal, and Mark Lawrence. Access control for iot: A survey of existing research, dynamic policies and future directions. Sensors, 23(4):1805, 2023. . URL https://doi.org/10.3390/s23041805.

[2] Ravi S. Sandhu and Pierangela Samarati. Access control: principles and practice. IEEE Communications Magazine, 32(9):40–48, 1994. . URL https://doi.org/10.1109/35.312842.

[3] Ravi S. Sandhu. Lattice-based access control models. Computer, 26(11):9–19, 1993. . URL https://doi.org/10.1109/2.241422.

[4] Ravi S. Sandhu. Role-based access control. Adv. Comput., 46:237–286, 1998. . URL https:// doi.org/10.1016/S0065-2458(08)60206-5.

[5] Vincent C Hu, David Ferraiolo, Rick Kuhn, Arthur R Friedman, Alan J Lang, and Margaret M Cogdell. Guide to attribute based access control (abac) definition and considerations (draft). NIST special publication, 800(162):1–54, 2013.

[6] Sondes Baccouri and Takoua Abdellatif. BIGABAC: Leveraging Big Data for Adaptive, Scalable, and Context-Aware Access Control. CMES - Computer Modeling in Engineering and Sciences, 143(1):1071–1093, 2025. ISSN 1526-1492.

[7] Antonia M. Reina Quintero, Salvador Martínez Perez, Ángel Jesús Varela-Vaca, María Teresa Gómez-López, and Jordi Cabot. A domainspecific language for the specification of UCON policies. J. Inf. Secur. Appl., 64:103006, 2022. . URL https://doi.org/10.1016/j.jisa. 2021.103006.

[8] Ali Hariri, Amjad Ibrahim, Bithin Alangot, Subhajit Bandopadhyay, Antonio La Marra, Alessandro Rosetti, Hussein Joumaa, and Theo Dimitrakos. Ucon+: comprehensive model, architecture and implementation for usage control and continuous authorization. In Collaborative Approaches for Cyber Security in Cyber-Physical Systems, pages 209–226. Springer, 2023.

[9] Abdulgader Almutairi and François Siewe. CAUCON: a context-aware usage control model. In Tomoko Yonezawa and Waltenegus Dargie, editors, CASEMANS@Ubicomp ’11: The 5th ACM International workshop on context-awareness for self-managing systems, Beijing, China, 17 September 2011, pages 38–43. ACM, 2011. . URL https://doi.org/10.1145/2036146. 2036153.

[10] Quyet H. Cao, Giyyarpuram Madhusudan, Reza Farahbakhsh, and Noël Crespi. Usage control for data handling in smart cities. In 2015 IEEE Global Communications Conference, GLOBECOM 2015, San Diego, CA, USA, December 610, 2015, pages 1–6. IEEE, 2015. . URL https: //doi.org/10.1109/GLOCOM.2014.7417270.

[11] Vladimir Viyović, Mirjam Maksimović, and Branko Perisić. Sirius: A rapid development of dsm graphical editor. InIEEE 18th International Conference on Intelligent Engineering Systems INES 2014, pages 233–238, 2014.

[12] Louis M. Rose, Richard F. Paige, Dimitrios S. Kolovos, and Fiona Polack. The epsilon generation language. In Ina Schieferdecker and Alan Hartman, editors, Model Driven Architecture - Foundations and Applications, 4th European Conference, ECMDA-FA 2008, Berlin, Germany, June 9-13, 2008. Proceedings, volume 5095 of Lecture Notes in Computer Science, pages 1–16. Springer, 2008. . URL https: //doi.org/10.1007/978-3-540-69100-6_1.

[13] Qais Tasali, Chandan Chowdhury, and EugeneY. Vasserman. A flexible authorization architecture for systems of interoperable medical devices. In Elisa Bertino, Ravi S. Sandhu, and Edgar R. Weippl, editors, Proceedings of the 22nd ACM on Symposium on Access Control Models and Technologies, SACMAT 2017, Indianapolis, IN, USA, June 21-23, 2017, pages 9–20. ACM, 2017. . URL https://doi.org/10. 1145/3078861.3078862. [14] D. Steinberg, F. Budinsky, E. Merks, and M. Paternostro. EMF: Eclipse Modeling Framework. Pearson Education, 2008. URL https://sisis. rz.htw-berlin.de/inh2009/12368099.pdf. [15] Alberto Rodrigues da Silva. Model-driven engineering: A survey supported by the unified conceptual model. Computer Languages, Systems and Structures, 43:139–155, 2015. ISSN 1477-8424. URL https://doi.org/10.1016/j. cl.2015.06.001. [16] Marjan Mernik, Jan Heering, and Anthony M. Sloane. When and how to develop domainspecific languages. ACM Comput. Surv., 37(4): 316–344, 2005. . URL https://doi.org/10. 1145/1118890.1118892.

[17] Konstantinos Panayiotou, Constantine Doumanidis, Emmanouil G. Tsardoulias, and Andreas L. Symeonidis. SmAuto: A domain-specificlanguage for application development in smart environments. Pervasive Mob. Comput., 101: 101931, 2024. . URL https://doi.org/10. 1016/j.pmcj.2024.101931.

[18] Leila Samimi-Dehkordi, Bahman Zamani, and Shekoufeh Kolahdouz Rahimi. Leveraging product line engineering for the development of domain-specific metamodeling languages. J. Comput. Lang., 51:193–213, 2019. . URL https: //doi.org/10.1016/j.cola.2019.02.006.

[19] Ali Hariri. Extensible model and policy engine for usage control and policy-based governance: Industrial applications. 2024. URL https://tesidottorato.depositolegale. it/bitstream /20.500.14242/61583/1/ final-thesis-35-Ali-Hariri.pdf.

[20] Jaehong Park, Xinwen Zhang, and Ravi S. Sandhu. Attribute mutability in usage control. In Csilla Farkas and Pierangela Samarati, editors, Research Directions in Data and Applications Security XVIII, IFIP TC11/WG 11.3 Eighteenth Annual Conference on Data and Applications Security, July 25-28, 2004, Sitges, Catalonia, Spain, volume 144 of IFIP, pages 15–29. Kluwer/Springer, 2004. . URL https: //doi.org/10.1007/1-4020-8128-6_2.

[21] Jan-Philipp Töberg, Jonas Schiffl, Frederik Reiche, Bernhard Beckert, Robert Heinrich, and Ralf Reussner. Modeling and enforcing access control policies for smart contracts. In 2022 IEEE international conference on decentralized applications and infrastructures (DAPPS), pages 38–47. IEEE, 2022. URL https://doi.org/10. 1109/DAPPS55202.2022.00013.

[22] Xinwen Zhang, Jaehong Park, Francesco ParisiPresicce, and Ravi S. Sandhu. A logical specification for usage control. In Trent Jaeger and Elena Ferrari, editors, 9th ACM Symposium on Access Control Models and Technologies, SACMAT 2004, Yorktown Heights, New York, USA, June 2-4, 2004, Proceedings, pages 1–10. ACM, 2004. . URL https://doi.org/10. 1145/990036.990038.

[23] Christos Grompanopoulos, Antonios Gouglidis, and Anastasia Mavridou. Specifying and verifying usage control models and policies in TLA+. Int. J. Softw. Tools Technol. Transf., 23(5):685– 700, 2021. . URL https://doi.org/10.1007/ s10009-020-00600-0.