Towards a self-adaptive access control middleware for the Internet of Things

In order to cope with certain challenges posed by IoT environment and device capacity, a Self-Adaptive access control model is needed to resolve security and privacy issues. The use of complex encryption algorithms is infeasible due to the volatile nature of IoT environment and pervasive devices with limited resources. In this paper, we propose an access control middleware for the Internet of Things. The latter is an extension of the ABAC model in order to take into account the subject behavior and the trust value in the decision making process. In this work, we introduce a dynamic adaptation process of access control rules based on the risk value, the policies and rule sets which can effectively improve the security of IoT applications and produce more efficient access control mechanisms for the Internet of Things.

[1]  Elisa Bertino,et al.  GEO-RBAC: a spatially aware RBAC , 2005, SACMAT '05.

[2]  Ramjee Prasad,et al.  Identity Authentication and Capability Based Access Control (IACAC) for the Internet of Things , 2012, J. Cyber Secur. Mobil..

[3]  Xinyi Huang,et al.  Cryptographic Hierarchical Access Control for Dynamic Structures , 2016, IEEE Transactions on Information Forensics and Security.

[4]  Heejo Lee,et al.  Enforcing Access Control Using Risk Assessment , 2007, Fourth European Conference on Universal Multiservice Networks (ECUMN'07).

[5]  Manoj V. Thomas,et al.  Agent-based approach for distributed access control in cloud environments , 2013, 2013 International Conference on Advances in Computing, Communications and Informatics (ICACCI).

[6]  Sven Buchholz,et al.  Comprehensive structured context profiles (CSCP): design and experiences , 2004, IEEE Annual Conference on Pervasive Computing and Communications Workshops, 2004. Proceedings of the Second.

[7]  James H. Aylor,et al.  Computer for the 21st Century , 1999, Computer.

[8]  Luigi Atzori,et al.  Trustworthiness Management in the Social Internet of Things , 2014, IEEE Transactions on Knowledge and Data Engineering.

[9]  Rodrigo Roman,et al.  On the features and challenges of security and privacy in distributed internet of things , 2013, Comput. Networks.

[10]  Antonio Iera,et al.  The Internet of Things: A survey , 2010, Comput. Networks.

[11]  Benedict G. E. Wiedemann.  Protection? , 1998, Science.

[12]  Selim G. Akl,et al.  Cryptographic solution to a problem of access control in a hierarchy , 1983, TOCS.

[13]  Brice Morin,et al.  Models@ Run.time to Support Dynamic Adaptation , 2009, Computer.

[14]  Kamel Adi,et al.  Risk-based decision method for access control systems , 2011, 2011 Ninth Annual International Conference on Privacy, Security and Trust.

[15]  Junshan Li,et al.  A Trust and Context Based Access Control Model for Distributed Systems , 2008, 2008 10th IEEE International Conference on High Performance Computing and Communications.

[16]  Antonio F. Skarmeta,et al.  A decentralized approach for security and privacy challenges in the Internet of Things , 2014, 2014 IEEE World Forum on Internet of Things (WF-IoT).

[17]  Elisa Bertino,et al.  Context-Aware Adaptation of Access-Control Policies , 2008, IEEE Internet Computing.

[18]  Ravi S. Sandhu,et al.  Role-Based Access Control Models , 1996, Computer.

[19]  Ladan Tahvildari,et al.  Self-adaptive software: Landscape and research challenges , 2009, TAAS.

[20]  Hongxin Hu,et al.  Enabling Dynamic Access Control for Controller Applications in Software-Defined Networks , 2016, SACMAT.

[21]  M. A. Shibli,et al.  Attribute based access control in DSpace , 2012, 2012 7th International Conference on Computing and Convergence Technology (ICCCT).

[22]  Robert Laddaga.  Active Software , 2000, IWSAS.

[23]  Luming Tan,et al.  Future internet: The Internet of Things , 2010, 2010 3rd International Conference on Advanced Computer Theory and Engineering(ICACTE).

[24]  Lalana Kagal,et al.  A Semantic Context-Aware Access Control Framework for Secure Collaborations in Pervasive Computing Environments , 2006, SEMWEB.

[25]  Jian Zhu,et al.  Trust and privacy in attribute based access control for collaboration environments , 2009, iiWAS.

[26]  Xinyi Huang,et al.  Supporting dynamic updates in storage clouds with the Akl-Taylor scheme , 2017, Information Sciences.

[27]  Ravi S. Sandhu,et al.  Lattice-based access control models , 1993, Computer.