Table 1.

The scope and contributions of the study.

Scope	Description
S1	We first cover the background of the traditional access control and context-aware access control literature.
S2	We then present different taxonomies of contextual conditions and authorization models according to the access control-specific contextual entities.
S3	We cover the existing context-sensitive access control approaches, including the Role-Based Access Control (RBAC) mechanisms and Context-Aware Access Control (CAAC) approaches for IoT sensor networks, privacy-preserving techniques and applications for distributed cloud databases and the policy-aware deployment and management of cloud applications.
S4	We divide the context-aware access control literature into main two categories: the access control mechanisms for centralized networks and the access control mechanisms for decentralized cloud and fog networks.
S5	We provide a comparative analysis of the existing context-aware access control mechanisms. We highlight the limitations and shortcomings of these mechanisms that motivate us to develop a new CAAC framework for cloud and fog networks.
S6	We discuss the directions of future research along with practical case studies, including access management against identify thefts, safeguarding health data against data breaches, protecting banking customers against data breaches, and security and privacy of the internet of things. We also include the research challenges and opportunities in these directions.
S7	In addition, we propose a new generation of fog-based CAAC model for today’s cloud and fog networks, including a layer-based framework.
S8	From our analysis of the state-of-the-art access control literature and open research issues, finally we identify the general requirements of an emerging fog-based CAAC mechanism.