![](bg2.png)
ternational drug traffickers worked with local hack-
ers to intrude the maritime cyber spaces at the Port
of Antwerp, Belgium. The criminals IT weaknesses
and manipulate sensitive data such as shipment char-
acteristics and pickup schedules to conceal drugs and
illegally import them without being detected.
An alarming trend is the emerging cyber-physical
attacks against maritime ICT systems. In the Antwerp
case, hackers breached physical communication ma-
chines to intrude the port’s database. These multi-
plex, organized attacks underscore the importance to
secure the maritime cyber operations in the first space
to safeguard the physical safety of people and goods.
Finding effective solutions and countermeasures
against cyber-attacks now becomes an urgent task for
maritime stakeholders. (Vanek et al., 2013) In a vul-
nerable cyber space, access control is a fundamen-
tal mechanism to prevent not only accidental but also
malicious violations of security requirements. An ac-
cess control system regulates user access to resources.
It defines the conditions under which to whom access
to resources can be granted. Each access request will
result in an access decision such as permit or deny.
This research contributes to the maritime supply
chain security literature by developing a system of
trustable access control. Within the maritime supply
chain, data always moves between extensively dis-
tributed machines and cannot possibly be controlled
by a single, trustable system. To address this chal-
lenge, this paper builds an access control framework
which can simultaneously achieve efficiency.
The remaining of the paper is organized into three
additional sections. In section 2, the related work
is discussed to provide the basis for framework and
approach development. Section 3 introduces the ac-
cess control framework for protecting maritime cyber
infrastructure. Section 4 presents the concluding re-
marks and directions of future work.
2 RELATED WORK
In the area of maritime operations and information se-
curity literature, papers regarding maritime cyberse-
curity, especially topics on access control, are few in
numbers. In contrast, there is a wealth of publications
associated with access control innovations and appli-
cations (C. Wang and Gupta, 2023; Singh et al., 2022;
Jeong and Li, 2022). Accordingly, we extensively re-
viewed recent access control publications deemed rel-
evant to maritime cyber operations.
The authors examine and discuss the literature
through the lens of the computer security policy
(CSP), the supreme principle to govern the goals and
elements of the computer systems within an organiza-
tion. (Li et al., 2015) For a normal maritime supply
chain, multiple CSPs may co-exist because of the par-
ticipation of various supply chain partners. The for-
mulation of any CSP is important because it defines
what it means to be secured within the organization
boundaries.
In the following discussion, we first discuss the
recent trends of maritime cyber-attacks. Secondly, we
discuss the state-of-the-art research on access control
and gaps and potentials for applications in maritime
cyber spaces. Finally, the CSPs of a trust management
system to verify maritime cybersecurity is presented
(Panos et al., 2020; Gupta et al., 2023; Fasoulis and
Kurt, 2019).
2.1 Recent Trends of Cyber Attacks
against Maritime Industries
Modern maritime industries are heavily reliant on the
information and communication technologies and the
use of data. On the one hand, this represents a shift
towards safer,more efficient and profitable operations.
For example, more and more maritime supply chain
partners have increased the use of e-bills of lading,
and port authorities have capitalized on computerized
systems for the container operations across sharing
economies. However, this greater reliance on tech-
nologies also brings increased risks in physical and
cyber maritime domains. (Brasington and Hadwin,
2016) As clearly stated in (Bull, 2016), “There is also
a very real danger that emails being sent to and from
ships are monitored or altered. This could have a huge
commercial effect on vessels.”
More specifically, vessels for both passengers and
cargo transportation are equipped with navigation
and communication technologies, such as Electronic
Charter Display & Information System (ECDIS),
Global Positioning System (GPS), Automatic Iden-
tification System (AIS), Industrial Control System
(ICS), and so on. Currently, all of these systems can
be infiltrated by cyber attackers. In fact, cyber-attacks
are happening more frequently in the maritime sector
according to various maritime reports s (Bull, 2016;
MTI, 2017; Vamosi, 2016; Paganini, 2015) and the
authors’ interviews with practitioners.
The maritime industry evidently is vulnerable to
a range of cyber risks. Damages from untrust-
worthy software or a loss of data integrity through
breaches into maritime instruments may result in cor-
rupt, skewed, or incorrect results. Attackers in the
Port of Antwerp case had access to control systems,
intercepted maritime communication, and altered sen-
sitive shipping information, e.g. characteristics of
Trust Management and Attribute-Based Access Control Framework for Protecting Maritime Cyber Infrastructure
535