Context‐aware usage control for web of things

Abstract

The Web of Things (WoT), inherited from the Internet of Things (IoT), encapsulates functionalities into publishable services on the Web to enable the IoT a seamless integration with the Web. The openness of the Web, in turn, directly exposes WoT to existing attacks from the Web. In addition, WoT possesses characteristics of high security and privacy concerns, mobility, and limited capabilities, which require specific and additional security and privacy protection beyond existing mechanisms. More importantly, WoT is inherently connected to its context, so context information must be taken into account in its security and privacy measures. To address these challenges, we propose a context‐aware usage control model (ConUCON), which leverages the context information to enhance data, resource, and service protection for WoT. On the basis of ConUCON, we also design and implement a context‐aware usage control framework on the middleware layer in our ongoing SmartHome project, to provide security and privacy protection. ConUCON is designed specifically to express the context‐aware usage policy specification, such that security and privacy requirements can be easily specified and enforced with the proposed model and framework. Finally, we apply ConUCON to a remote appliance management prototype, as a case study, to demonstrates its feasibility in a real environment. Copyright © 2012 John Wiley & Sons, Ltd.

ControlChain: Blockchain as a Central Enabler for Access Control Authorizations in the IoT

“…A secure IoT-suitable access control system for IoT must be capable of (1) precisely identify the entities with robust anti-fraud mechanisms in order to prevent non-authorized malicious devices or users of accessing resources, (2) enforce the access policies defined by resource owners and would be (3) gainful if it attends all the following characteristics [39,5,18,14,13]: scalability, lightweight, transparency, user-friendly, fault-tolerance, privacy-friendly, delegation-capability, context-aware, fine-grained, relationships-aware and legacy-compatibility. Therefore, developing an access control for the IoT is a challenge task mainly because it commonly has to deal with these characteristics.…”

ControlChain: A new stage on the IoT access control authorization

“…A secure IoT access control system must be capable of (1) precisely identifying the entities with robust anti‐fraud mechanisms to prevent non‐authorized malicious devices or users from accessing resources, (2) enforce the access policies defined by resource owners, and should (3) have the following characteristics: scalability, lightweight, transparent, user‐friendly, fault‐tolerant, privacy‐friendly, delegation‐capable, context‐aware, and fine‐grained. Furthermore, we also argue that it needs to be relationships‐aware and legacy‐compatible.…”

Open Issues and Security Challenges of Data Communication Channels in Distributed Internet of Things (IoT): A Survey

“…To apply such a scheme to resource constrained architectures, it only uses simple hash and XOR computations, as in [33]. The authentication and access control method presented in [35] aims at establishing the session key based on Elliptic Curve Cryptography (ECC), another lightweight encryption mechanism. This scheme defines attribute-based access control policies, managed by an attribute authority, enhancing mutual authentication among the user and the sensor nodes, as well as solving the resourceconstrained issue at application level in IoT.…”

“…This paradigm derives from the integration of social networking concepts into IoT, since the objects belonging to the IoT infrastructure can establish social relationships in an autonomous way with respect to their owners. The challenge addressed in [35] is to build a reputation-based trust mechanism for the SIoT which can effectively deal with certain types of malicious behaviors aimed at misleading other nodes, to drive the use of services and information delivery only towards trusted nodes.…”