IAACaaS: IoT Application-Scoped Access Control as a Service

Abstract

access control is a key element when guaranteeing the security of online services. However, devices that make the Internet of Things have some special requirements that foster new approaches to access control mechanisms. Their low computing capabilities impose limitations that make traditional paradigms not directly applicable to sensors and actuators. In this paper, we propose a dynamic, scalable, IoT-ready model that is based on the OAuth 2.0 protocol and that allows the complete delegation of authorization, so that an as a service access control mechanism is provided. Multiple tenants are also supported by means of application-scoped authorization policies, whose roles and permissions are fine-grained enough to provide the desired flexibility of configuration. Besides, OAuth 2.0 ensures interoperability with the rest of the Internet, yet preserving the computing constraints of IoT devices, because its tokens provide all the necessary information to perform authorization. The proposed model has been fully implemented in an open-source solution and also deeply validated in the scope of FIWARE, a European project with thousands of users, the goal of which is to provide a framework for developing smart applications and services for the future Internet. We provide the details of the deployed infrastructure and offer the analysis of a sample smart city setup that takes advantage of the model. We conclude that the proposed solution enables a new access control as a service paradigm that satisfies the special requirements of IoT devices in terms of performance, scalability and interoperability.

Evaluation of an IoT Application-Scoped Access Control Model over a Publish/Subscribe Architecture Based on FIWARE

“…IoT access control solutions must support and implement these paradigms and must be consistent with the IoT’s own protocols and architectures. Standards as OAuth 2.0 [ 2 ] or XACML [ 10 ] combined with these paradigms allow creation of a fine-grained access control model over IoT Publish/Subscribe architectures [ 6 , 7 , 8 ]. Moreover, the International Data Spaces created an IIoT standard [ 11 , 12 ] in which they define a vocabulary and data model—implemented with the NGSI FIWARE standard [ 13 ]—that boost and eases the definition of fine-grained access control policies with ABAC or UCON [ 8 , 14 ].…”

“…The IAACaaS model, proposed in previous works [ 6 , 7 ] and implemented through the FIWARE open-source platform, is based on the OAuth 2.0 protocol and relies on an XACML (eXtensible Access Control Markup Language) architecture to enable the administration of fine-grained policies. As explained before, we use this model to secure communications between IoT devices and a Publish/Subscribe broker.…”

An Identity Model for Providing Inclusive Services and Applications

“…As we pointed out earlier, the model we propose allows service providers to decide the interface they should serve to the users depending on their functional capabilities. To achieve this, we have considered IAACaaS (IoT Application-Scoped Access Control as a Service) model [46,47] as a starting point. IAACaaS enables the complete delegation of authentication and authorization to enable an as a service access control mechanism for Internet of Things applications.…”

Industrial Data Space Architecture Implementation Using FIWARE

“…Figure 2 shows the architecture we propose to achieve the Identity and Access Management IDS requirements using FIWARE components. It is based on the work explained in [ 26 , 27 ], where a generic IoT Application-Scoped Access Control as a Service (IAACaaS) mechanism is proposed. Here we extend and adapt it to fit the specific requirements of IDS.…”