![](bga.png)
specified in the core protocol of UMA. Unlike UMA,
the approach of this paper presupposes requirements
which allow a simplification of the UMA protocol.
Problems with outsourcing and sharing data are
discussed in (di Vimercati et al., 2007). De Capitani
di Vimercati et al. challenge the problem of shar-
ing data in distributed systems without providing it to
the public by using selective encryption. Therefore,
shared resources are encrypted using a key. Tokens
are derived from that key and can be used to access
the shared resource. The approach focuses on encryp-
tion and the derivation of keys. Access methods are
always expected to be read only and an authorization
is defined as a double of user and resource whereby
users also can be groups.
(Gusmeroli et al., 2012) focuses on a Capability
Based Access Control (CapBAC), having a token as
a representation of the capability to access resources.
In contrast to this paper, the initial credential is issued
by the owner of the resource, not by an authorization
and access control server. Furthermore, no semantics
of the access rules are defined.
As Section 4.2 already shows, IoT devices lack
of efficient decryption algorithms with which faster
processing times could be accomplished. (Zhang
et al., 2014) mentions that designing lightweight cryp-
tographic systems is still a challenging task: While
a public key system offers data integrity, data pri-
vacy and is suited for authentication, it produces more
computational overhead.
Constrained Application Protocol (CoAP) is
stated as an appropriate protocol for Machine-to-
Machine (M2M) communication – due to its simplic-
ity and low overhead, it is suited for IoT devices (Raza
et al., 2013). Since HTTPS is highly connected to
TLS as its security protocol, TCP is required which is
processed slower. CoAP utilizes Datagram Transport
Layer Security (DTLS), running over UDP which is
processed faster.
Next to simplifying protocols, (Shafagh and Hith-
nawi, 2014) focuses its attention on the hardware of
IoT devices: Although E2EE only needs the public
key crypto system at the configuration process, its
memory is allocated during the whole running time
of the application – this means less memory for the
actual application logic during the entire time span.
Hardware encryption engines within recent SoC de-
vices are not only offered for symmetrical encryption,
with only little additional cost. Acceleration engines
are also offered for public key systems and contribute
to faster processing times of encryption tasks.
6 CONCLUSION AND FUTURE
WORK
Since SoC devices distinguish from conventional pro-
cessors, they imply limitations and therefore demand
special design requirements. After stating enabling
technologies, especially OAuth, ABAC and REST,
the overall architecture is revealed. This concludes
in a closer look at all involved entities, as well as
in demonstrating a proof of concept. Furthermore,
the experimental results give an impression of how
well RestACL meets the demands of the introduced
architecture: Since the runtime remains stable, de-
spite of rising repositories, all domains and policies
can be managed by one authorization and access con-
trol server. Therefore, it is approved that a centralized
access control system with flexible policies can pro-
vide a dynamic configuration of IoT entities within a
changing environment and therefore offer the possi-
bility of configuring resources dynamically according
to attributes. As the introduced Raspberry Pi is still
a powerful device, compared to smaller IoT devices,
the rising file sizes do not meet the requirements of
IoT devices, according to their memory capacity. Es-
pecially when implementing authentication, the mem-
ory consumption of V1 increases further. This leads
even more to centralizing the access control logic and
the trust mechanism, relieving the IoT device. Con-
sidering the overall runtime (t
TotalV x
), the decision of
sourcing RestACL out depends on practical condi-
tions. Although the runtime increases due to a greater
communication effort, the practical benefits of a cen-
tralized access control logic are high scalability, ease
of use, non-redundancy, changeability, data consis-
tency and more convenient data backups.
REFERENCES
Boyd, R. (2012). Getting Started with OAuth 2.0. O’Reilly
Media.
di Vimercati, S. D. C., Foresti, S., Jajodia, S., Paraboschi,
S., and Samarati, P. (2007). Over-encryption: Man-
agement of Access Control Evolution on Outsourced
Data. VLDB ’07 Proceedings of the 33rd International
Conference on Very Large Data Bases.
Ferraiolo, D., Kuhn, R., and Hu, V. (2015). Attribute-Based
Access Control. In Computer, Vol. 48. IEEE Computer
Society.
Fielding, R. T. (2000). Architectural Styles and the Design
of Network-based Software Architectures. University
of California, Irvine.
Gusmeroli, S., Piccione, S., and Rotondi, D. (2012). IoT
Access Control Issues: a Capability Based Approach.
In 2012 Sixth International Conference on Innovative
IoTBDS 2017 - 2nd International Conference on Internet of Things, Big Data and Security
68