Home // INTERNET 2020, The Twelfth International Conference on Evolving Internet // View article

IoTSEAR: A System for Enforcing Access Control Rules with the IoT

Authors:
Andreas Put
Bart De Decker

Keywords: Access Control, Security, Internet of Things

Abstract:
Internet of Things (IoT) environments are composed of heterogeneous sensors and devices that collect and share contextual information. This data can improve the accuracy and usability of access control systems, as authentication and authorization requirements can be specified more precisely. However, certain security requirements need to be enforced in order to use such data in access control decision processes. In short, the data must be authentic, recent, and unforgeable. In this paper, we present a generic model for context, which takes emph{data-security} into account along with properties about the device, or context-source. Security-objects, such as message signatures, are modeled as emph{proofs}, which are verifiable, while information about the context-source, communication channel, and the data itself is captured as emph{meta-data}. This model allows an access control system to verify the authenticity and trustworthiness of context-data by (1) checking the presence of a specific proof and verifying it, and (2) analyzing the associated meta-data. It covers not only data from IoT sources, but also authorization and identity tokens. In addition, we present IoTSEAR, a middleware for trustworthy context-aware access control, which uses this model internally. Finally, we show performance results of our IoTSEAR prototype, which show that the overhead is low and that the system is usable even on commodity hardware.

Pages: 1 to 6

Copyright: Copyright (c) IARIA, 2020

Publication date: October 18, 2020

Published in: conference

ISSN: 2308-443X

ISBN: 978-1-61208-796-2

Location: Porto, Portugal

Dates: from October 18, 2020 to October 22, 2020