面向物联网的基于上下文和权能的访问控制架构

A Context-Aware Capability-Based Access Control Framework for the Internet of Things

针对物联网(Internet of Things,IoT)的安全和隐私问题,以及传统的访问控制方法不适应于IoT环境的现状,提出了一种分布式的基于上下文和权能的访问控制架构.该架构的授权决策过程由嵌入到设备中的授权决策模块PDP来实现,以达到分布式的授权目标;特别是权能令牌的特殊构造,不仅可方便实现基于设备上下文的访问控制,而且利用椭圆曲线密码体制来实现端到端的认证、完整性和不可抵赖性;消息传输机制采用更适合于物联网的受限应用协议CoAP(Constrained Application Protocol).实验结果表明,该架构是可行的.

Because of the security and privacy problem of the Internet of Things （IoT）, and the status of the traditional access control approaches not adapted to IoT environment, we proposed a distributed context-aware capabilitybased access control framework for IoT in this paper. In our proposed framework, devices themselves can make au- thorization decisions. Specifically, a capability token has been designed for CoAP （Constrained Application Protocol） resources, which is signed with the Elliptic Curve Cryptography（ECC） in order to carry out the access control based on devices local parameters and ensure end-to-end authentication, integrity and non-repudiation. We build the transport protocol upon the IETF CoAP which is specifically designed for constrained devices. In the end, the experiment results demonstrate the feasibility of the proposed framework.