Access control mechanisms for an IoT platform

• Autor(a) principal: Oliveira, Rui Filipe Dominguez de
• Data de Publicação: 2019
• Tipo de documento: Dissertação
• Idioma: eng
• Título da fonte: Repositório Científico de Acesso Aberto de Portugal (Repositórios Cientìficos)
• Texto Completo: http://hdl.handle.net/10773/29521
• topic: Access control mechanisms; Authorization; XACML; IoT; Attribute-based access control; Policy evaluation

Access control mechanisms are used to ensure that privileged information and resources are not accessed by, or disclosed to, unauthorized entities. The XACML specification, in addition to being one of the most important standards, is also widely used to define access control policies. XACML was proposed by the OASIS consortium and defines an attribute-based access control policy language expressed in an XML format. The standard also defines a reference architecture and a processing model in which are described how access requests should be evaluated according to the attributes defined in access control policies. The main drawback of XACML is the verbosity of its syntax, since it uses XML. To overcome this issue, we defined an access control language in YAML upon the key concepts of XACML. Unlike XACML, the YAML language is simple, which makes access control policies easy to define and interpret by humans. The main challenge of creating an IoT access control system is the performance of the policy evaluation engine, particularly in systems with a large number of clients. Sun Microsystems’ implementation of the XACML specification is the most widely used solution for defining and evaluating access control rules, but it is not the most efficient, since it performs a brute force search for evaluating the predicates defined in the access request against the access control policies defined in the authorization system. Our solution is based on two tree data structures, the Decision Tree and the Combining Tree. The attributes defined in the access control policies are extracted, combined and then later used to build up the Decision Tree. The Decision Tree is used to find the applicable rules for a given set of attributes defined in an access request. On the other hand, the Combining Tree is used to calculate the final authorization decision according to the combining algorithms defined in the access control policies applicable to a given access request. The results show that our solution is about two orders of magnitude more efficient than the Sun Microsystems’ implementation. Finally, we also introduced two caching strategies to improve the performance of our engine. For each access request the engine creates and stores the subset of the Decision Tree that was used to calculate the authorization decision for a given request. In the first strategy, the engine creates and stores a Decision Tree subset applicable to each access request that hits the authorization system. In the second strategy, the client can define when each subtree should be cached by the engine. The experimental results showed that our first caching solution does not improve the performance of the engine, whereas the second solution improves the overall processing time.