Putting Things in Context: Securing Industrial Authentication with Context Information

Abstract

The development in the area of wireless communication, mobile and embedded computing leads to significant changes in the application of devices. Over the last years, embedded devices were brought into the consumer area creating the Internet of Things. Furthermore, industrial applications increasingly rely on communication through trust boundaries. Networking is cheap and easily applicable while providing the possibility to make everyday life more easy and comfortable and industry more efficient and less time-consuming. One of the crucial parts of this interconnected world is sound and secure authentication of entities. Only entities with valid authorisation should be enabled to act on a resource according to an access control scheme. An overview of challenges and practices of authentication is provided in this work, with a special focus on context information as part of security solutions. It can be used for authentication and security solutions in industrial applications. Additional information about events in networks can aid intrusion detection, especially in combination with security information and event management systems. Finally, an authentication and access control approach, based on context information and-depending on the scenariomultiple factors is presented. The combination of multiple factors with context information makes it secure and at the same time case adaptive, so that the effort always matches, but never exceeds, the security demand. This is a common issue of standard cyber security, entities having to obey strict, inflexible and unhandy policies. This approach has been implemented exemplary based on RADIUS. Different scenarios were considered, showing that this approach is capable of providing flexible and scalable security for authentication processes.

SocIoTy: Practical Cryptography in Smart Home Contexts

“…Deployability. Prior work on context sensitivity for cryptographic operations [6,14,43,[60][61][62]66] has not been deployed in practice due to its reliance on specific hardware to provide security properties or non-standard adversarial models. Therefore, we aim to use existing devices to build the context: namely, the IoT devices of the user's smart home.…”

“…Certain works employ IoT-specific characteristics for user authentication; in particular, [16,21,59] use wearable IoT devices as a second-factor for authentication. Anton et al [6] propose context authentication for industrial IoT systems. Location-sensitive cryptography.…”

“…Past research efforts also focus on the use of dedicated hardware to build this functionality. While context-sensitive cryptography (of which at-home cryptography is a subset) has been studied in both the theoretical [13,15,17,34,50] and applied [6,43,[60][61][62]66] literature, no practical constructions have been realized or widely deployed. 1 As such, we turn to a more pragmatic approach: re-use the devices users already have to establish a context.…”

Context-Aware Security for Vehicles and Fleets: A Survey

“…The group of Anton et al addresses with several publications the security of industrial IoT and SCADA environments [151]- [153]. In [151], the authors focus on including context information in the authentication mechanism RADIUS.…”

“…The group of Anton et al addresses with several publications the security of industrial IoT and SCADA environments [151]- [153]. In [151], the authors focus on including context information in the authentication mechanism RADIUS. They use a simple scheme of location, access time, and the criticality of the action that shall be authorized (i.e.…”