Oh Se-Ra, Kim Young-Gab, Cho Sanghyun
Department of Computer and Information Security, Sejong University, Seoul 05006, Korea.
Security Team, Naver Corporation, Bundang 13561, Korea.
Sensors (Basel). 2019 Apr 20;19(8):1884. doi: 10.3390/s19081884.
Due to the rapid development of Internet of Things (IoT), IoT platforms that can provide common functions for things are becoming increasingly important. However, access control frameworks in diverse IoT platforms have been developed for individual security goals, designs, and technologies. In particular, current OAuth-based access control frameworks that are widely used in IoT research have not been providing interoperability among IoT platforms even though sharing resources and services is a critical issue for IoT platforms. Therefore, we analyze the main requirements for an IoT access control framework to properly design our framework and propose an interoperable access control framework based on OAuth 2.0 and Role. Our approach describes a new extended authorization grant flow to issue an Interoperable Access Token (IAT) that has a global access scope across IoT platforms using multiple pairs of clients' credentials. With the IAT and proposed framework, we can access client-specific domains in heterogeneous IoT platforms, then valuable resources (e.g., data and services) in the domains can be accessed by validating the roles, which will greatly simplify permission management. Furthermore, IAT supports a simple token management (e.g., token issuance, refreshing, and revocation) by managing only one token for diverse IoT platforms. In addition, we implement our interoperable access control framework on Mobius and FIWARE, which are promising open-source IoT platforms, and test an interoperability scenario to demonstrate our approach with the implementation. Furthermore, the proposed framework is compared with other IoT access control approaches based on the selected requirements in this paper.
由于物联网（IoT）的快速发展，能够为物联网设备提供通用功能的物联网平台正变得越来越重要。然而，不同物联网平台中的访问控制框架是为各自的安全目标、设计和技术而开发的。特别是，目前在物联网研究中广泛使用的基于OAuth的访问控制框架，即使共享资源和服务对物联网平台来说是一个关键问题，也未能在物联网平台之间提供互操作性。因此，我们分析了物联网访问控制框架的主要需求，以正确设计我们的框架，并提出了一个基于OAuth 2.0和角色的可互操作访问控制框架。我们的方法描述了一种新的扩展授权授予流程，以颁发可互操作访问令牌（IAT），该令牌使用多对客户端凭证在物联网平台间具有全局访问范围。借助IAT和所提出的框架，我们可以访问异构物联网平台中特定于客户端的域，然后通过验证角色来访问这些域中的宝贵资源（如数据和服务），这将大大简化权限管理。此外，IAT通过仅为不同的物联网平台管理一个令牌来支持简单的令牌管理（如令牌颁发、刷新和撤销）。此外，我们在Mobius和FIWARE这两个有前景的开源物联网平台上实现了我们的可互操作访问控制框架，并测试了一个互操作性场景以通过实现来展示我们的方法。此外，本文还根据选定的要求将所提出的框架与其他物联网访问控制方法进行了比较。
