IRJET- Authentication and Context Awareness Access Control in Internet of Things

International Research Journal of Engineering and Technology (IRJET) Volume: 05 Issue: 04 | Apr 2018

www.irjet.net

e-ISSN: 2395-0056 p-ISSN: 2395-0072

AUTHENTICATION AND CONTEXT AWARENESS ACCESS CONTROL IN INTERNET OF THINGS Bhramarambika R S , Dept of CS Engineering,NIE College,Karnataka,India Navya V Hegde , Dept of CS Engineering,NIE College,Karnataka,India Anjali S , Dept of CS Engineering,NIE College,Karnataka,India Smt. Rashmi M R , Assistant Professor,Dept of CS Engineering,NIE College,Karnataka,India ---------------------------------------------------------------------***---------------------------------------------------------------------

Abstract - For security in internet of things, access control

the fields like in clinics, in army, in cultivation, in rural

is achieved by using another method as compare to the old

areas for the luxury of the publics. IoT provides many

way. The need for security and privacy for IoT devices is

services, however on the further hand threats ‘as

illuminated here. Moreover, assessment of various schemes

regards the security are also growing. For that, we talk

related to access control in IoT over the latest years is

over around the access control and authentication in

discussed. Lastly, we provide guesses for upcoming research in

the field of IoT Access control. Access control explains I

the field of access control in IoT. On the basis of shortcomings

formation possession issues and empowers new plans

observed in the existing model, the proposed model is designed

of action, Access control empowers organizations to

to protect IoT networks with context-aware access control

share IoT gadget information.

scheme. The proposed model covers the access control policy for IoT networks with context awareness. IoT is a very useful

The access control policy for IoT networks with

ecosystem that provides various services; however, at the same

context awareness approach which is included to

time, risk can be huge too. The main purpose of this paper is to

describe the context and type of the IoT nodes In IoT

survey the access control and authentication in IOT and

network.it is used to determine the rate of data

analyzing three basic characteristics (i.e., heterogeneity, resource constraint, dynamic environment)of security

transfer among the network nodes. The nodes not

requirements along six key elements of IoT (i.e., IoT network,

following the policy as per their data transmission limit

cloud, user, attacker, service, Platform).

according to context, are not provided the access to the network resources under this access control model.

Key Words: Internet of Things (IoT), Access Control,

1.1

Authentication, Security Requirements

INTERNET OF THINGS This section analyzes security requirements based

1. INTRODUCTION

on 3 typical IoT characteristics that have been

The meaning of the internet is connecting the

researched in other researches. These security

physical devices with each other. Physical devices are ingrained

with

ANALYSIS OF CHARACTERISTICS IN

sensors,

electronics,

requirements are commonly applied in IoT security.

software,

actuators. Every aspect of actual life. IoT is used in all Š 2018, IRJET

|

Impact Factor value: 6.171

|

ISO 9001:2008 Certified Journal

|

Page 4238

International Research Journal of Engineering and Technology (IRJET) Volume: 05 Issue: 04 | Apr 2018

www.irjet.net

e-ISSN: 2395-0056 p-ISSN: 2395-0072

Therefore, it is important to understand and advantage

send a large number of requests. Hence,nnot only

of it to design security mechanisms in IoT environment.

flexibility, but also scalability is required in IoT

A. Heterogeneity

communication

In IoT, heterogeneity means diversity of

protocols.

Consequently,

flexibility and scalability will be key security

hardware performances(e.g., CPU computation,

requirements of IoT.

memory footprint),protocols,platforms,polices,etc. the biggest problem of heterogeneity is absence of

1.2 SECURITY ISSUES AND REQUIREMENTS

common security service .heterogeneity weakens

FOR IOT ENVIRONMENTS

interoperability and causes extra fees about performance and money to interpret each other.besides, making security-related policies

Fig. 1 shows six key elements of IoT (i.e., IoT

and updates are more complex.in order to solve

network, cloud, user, attacker, service, and

these

some

platform). We consider reviewing security

data

requirements from the elements to be the most

registry(MDR),middleware);however, it is not a

effective way. A more detailed description is in the

fundamental solution. For providing common

following subsections.

problems,

we

technologies(e.g.,

can

use

meta

security service, unified IoT security standard has to be established.

B. Resource constraint Most iot devices are lacking performance and battery capacity.therefore,legacy security services, such

as

TLS(transport

security),AES(advanced

layer encryption

standard),cannot be applied to iot devices directly.therefore, these services or algorithms should be designed to be lightweight and straightforward

to

increase

efficiency

Fig 1: Six key elements of IoT

of

CPU,memory and battery.in addition, scalability IoT network is a specialized form of conventional

has to be considered.

network .It has three features as described in Section 3.

In IoT network, there are many Things (e.g., gateways,

C. Dynamic Environment

sensors), and they may communicate using lightweight

Due to mobility and bad connections, IoT has

communication protocols, such as MQTT and CoAP

a dynamic network topology. In very demanding

based on IEEE 802.15.4.

cases (e.g., smart city),numerous devices may Š 2018, IRJET

|

Impact Factor value: 6.171

|

ISO 9001:2008 Certified Journal

|

Page 4239

International Research Journal of Engineering and Technology (IRJET) Volume: 05 Issue: 04 | Apr 2018

www.irjet.net

e-ISSN: 2395-0056 p-ISSN: 2395-0072

The most important fact is that IoT network is

user makes the password with a simple and guessable

basically not different from conventional networks.

passphrase, attackers could crack the password easily

Therefore, most existing problems (e.g., fragmentation,

using brute force attack or dictionary attack which is

security attacks) could happen in IoT network. In this

well known security attack. That is, the user has to

subsection, we focus on the following issues: privacy,

follow strictly the security rules, and the user needs to

security in multicasting and bootstrapping. Privacy. IoT

be educated about social engineering.

is becoming more and more closer to human life like ubiquitous. It can be used anywhere, anytime with

D. Attacker

anything.

Security service can be compromised by attacker Although a user follows security rule. Due to

B. Cloud

IoT devices are connected to network, it can be victim

Usually, IoT devices use cloud because they

anytime. most of IoT devices cannot apply strong

cannot save the data in their low memory capacity. In

security service because of its constrained resources.

some cases, sensitive data (e.g., home CCTV video,

Besides, current IoT security services have not been

personal location, health information) can be used for

fully validated. For these reasons, IoT is easy target to

rescue people. However, if cloud out of order for some

attack so that security attack will be increased and

reasons, IoT devices cannot save the data. Then critical

diversified. Thus, in this subsection, we analyze

data that will be used for rescue can be missing. As a

security requirements against security threats.

result, rescue service that require the data may be stopped. Therefore, in this case, availability is highly

E. Service

necessary, so that device should have back-up cloud to

In this subsection, we analyze security issues

be replaced with original cloud. There are a lot of data

(i.e., trust, access control, middleware, storage) as

sent from many devices in cloud. To protect the data

illustrated in Fig. 2. Before we describe the security

from unauthorized user, cloud should use proper

requirements based on security Issues To take

access control (i.e., authentication, authorization),

advantage of a service, the user needs to trust the

encryption, data anonymity, etc. In addition, the data

server, and the server needs to provide privacy to the

may not be fully needed to be encrypted based on the

user. If the user decides the server is trustworthy, the

importance of data.

user will use service provided by the server or group of devices with smart phone, smart watch, or some kind

C. User

of network devices. After that, the devices have to User is the most vulnerable element in IoT

progress bootstrapping and access control (i.e.,

security. Even if information system is implemented

authentication and authorization). Thereby, devices

securely, if a user, especially system engineer, is

obtain trust from server. Especially, automated,

careless to manage, any security system will be useless.

intelligent and context-aware devices in real IoT

For example, in ID-password authentication model, if a

environment might be operated by itself without

Š 2018, IRJET

|

Impact Factor value: 6.171

|

ISO 9001:2008 Certified Journal

|

Page 4240

International Research Journal of Engineering and Technology (IRJET) Volume: 05 Issue: 04 | Apr 2018

www.irjet.net

e-ISSN: 2395-0056 p-ISSN: 2395-0072

human intervention. Finally, the attacker can

is secure enough for reply attack, node capture attack,

compromise the server for malicious

DoS attack and manYin middle attack.

intentions (e.g., collecting personal information).

B. Chan et al. [2] define SYCBAC stands for SecureY Capability Based Access Control model. This model is

F. Platform

used for IoT things in a distributed environment. This

AllSeen, oneM2M, OIC (open interconnect

model is mainly used for group access in SYCBAC user

consortium) and other standards organizations have

access mutual service which is functioning at

been established IoT platform standards. Open IoT

numerous devices by using a single token. In SYCBAC,

platform (e.g., Mobius, OneM2M, AllJoyn, COMUS) provides

multiple

cooperation,

functions

execution

(e.g.,

control,

IPsec channel technique is used to transfer all

distributed

datagram packets with the Encapsulating Security

interoperability

Payload

between heterogeneous devices to share data). They

(ESP)

header.

This

maintains

the

confidentiality of data. In this model a group of devices

are focusing on the functionality of platform mainly,

is created those produce a common service. A

however, security is considered only in common

requestor who wants to access these services can

services (e.g., encryption, access control through

access any device of the group by using a only one

authentication and authorization, signature). At this

token.

time, as mentioned earlier, because it is necessary to

H. Che et al. [3]tell that IoT is now used in number of

consider the performance of various IoT devices, all of

areas such as clinic, family circle, towns and societies.

security services should be lightweight.

Due to safety and confidentiality challenges, the use of Internet of Things is restricted. The IoT devices have a

2. LITERATURE REVIEW

constrained storage capacity. The main target during the intention of IoT is on facility rather than safety and

S. Patelet al. [1] in this paper authors describe the

secrecy. In this paper, the author explains the role

mechanism for security, and privacy and access

based access control in a hierarchy for the security of

control. Different types of things are communicates

computer

with each other in IoT environment. So maintain the

networks.

Some

authors

describe

cryptography key for security in IoT.

security and privacy of these is the man requirement when we implement a system. In this paper, the crucial

Q. Liu et al. [4]in the given paper authors discuss an

methods to assure protected transmission among

access control model which aimed at source

devices are access control and authentication. Aimed at

distribution established on the RoleYBased Access

this determination the author defines the Elliptic Curve

Control. Which are planned for multi area MIoT

Cryptography

and

[Manufacturing Internet of Things] Furthermore, AROP

Capability based access control model to assure protect

and PGAO‫ כ‬procedures are planned. The suggested

authorization. An AVISPA tool is used to check this

model and algorithms can support supervisors to

with

mutual

authentication

protocol. AVISPA tool presents that the given protocol © 2018, IRJET

|

Impact Factor value: 6.171

|

ISO 9001:2008 Certified Journal

|

Page 4241

International Research Journal of Engineering and Technology (IRJET) Volume: 05 Issue: 04 | Apr 2018

www.irjet.net

e-ISSN: 2395-0056 p-ISSN: 2395-0072

create a precise conclusion, reduce the loads, and

Debaty,

This

The context This

support the access protection in source distribution.

philippe,

paper

based

IEEE

discusses

approach is focuses

the Internet of Things (IoT) and the habit of little

Personal

the

proposed,

upon

powered strategies such as devices a huge amount of

Communicat

correlatio

which

web

individuals are consuming IoT structures in their home

ions 2001[8] n

M. Hemdi et al. [5] describe that by the expansion of

scheme the

of utilizes the presence in

environment and companies to have additional control

people,

diversified

the terms of

above their equipment. But the security of data in IoT

places

network

people,

environment is a major threat, when the IoT devices

and

properties

places and

are misplaced and robbed. In this paper author

things

including

things

explains that how we can protect our data from illegal

using the location,

consumers.

internet.

the

tion ability.

capabilities.

(devices) are communicate with each other with the help of internet. These devices are constrained devices,

Gornbaek,

This

Diverse

so they have a limited storing ability and computing

Inge,IEEE

article

interconnec scheme

control. Due to these restrictions it is a challenge in IoT

2008[9]

discusses

tion

the

environment to offer robust authorization procedures.

Author,publi sher

Techniqu

and e

Problem

Brief

addressed

review

year

proposed

Castellani,an

This

The

gelo

article

technique is IoT

p,IEEE,2010[ presents 7]

the

This involves the

IoT problems in network

architectu the IoT are architecture re and the covered in with multineeds of this paper homing APIs

new IPv6 based

for with

QoS ability

based

IP mobile

exchange.

networking

networks

in IoT.

constructed

the is analyzed

study on requiremen

for

the

ts of IoT in ability

versatile

the

highly tackle

in

data

designed to architecture

case meet

best

identity and interconnec device

S. Kinikaret al. [6] In IoT huge number of things

in

with

its

dynamic

to

membershi

the

p

of

architectu flexible and diverse and

network

res

nodes in I

and expandable

protocols

environmen ous

IoT t

for

heterogene IoT

Ot.

network.

H

networks. Š 2018, IRJET

|

Impact Factor value: 6.171

weber, This

Rolf,Elsevier |

paper

The

This article

legislative

discusses

ISO 9001:2008 Certified Journal

|

Page 4242

International Research Journal of Engineering and Technology (IRJET) Volume: 05 Issue: 04 | Apr 2018

2010[10]

www.irjet.net

e-ISSN: 2395-0056 p-ISSN: 2395-0072

presents

and security the

context aware ontology approach will regularly

the

related

upcoming

monitor the node performance, which will help to find

various

challenges

internet

the anomaly (or attacking behavior) of the target node.

security

are

based

we analysed three key characteristics of IoT ,such as

as well as discussed in technical

heterogeneity, resource constraint, and dynamic

privacy

detailed for architecture

environment

challenge

the

requirements. In addition, we analyzed overall IoT

facilities for

to

find

out

basic

IoT

security

s in the managemen the

security requirements. We hope this paper can be a

IoT.

exchange of

guide to design IoT system securely, and improve

goods

general understanding of IoT security

t of IoT.

for

issues and requirements.

supply chain

REFERENCES

managemen t.

[1]

Sudha Patel; Dhiren R. Patel; Ankit P. Navik Ienergy efficient intergrated authentication

Table 1: Summary of Literature work

and access control mechanism for internet of things", 2016 International Conference on Internet of Things and Application (iOtA),

4. CONCLUSION AND FUTURE WORK

Year: 2016 Now technology is increased day by day, and

rt

[2]

he

u

u

ua

esut u es

the internet is used all over the world, so the scope of

s

iot is bright. iot makes our life smart, easier, faster and

su

comfortable. But, still needs to confront hard

th

s

difficulties identified with the use of security,

on

Software

furthermore access control structures. For further

Workshops (ISSREW), Year: 2015

research block chain technology based access control

[3]

se ure a ess rt

HsingYChung

r u

tr

a ess

r

ter at

Che;

ter et

a

Reliability

e su

Engineering

ChiaYHui

Chang;

model is used to fulfill the iot necessities. the utilization

FangYYie Leu, Iimplement of agent with

of capacity based messaging for decentralized access

roleYbased hierarchy access control for

control is innovative and should be additionally

secure grouping iots", 2017 14th ieee Annual

researched, particularly with regards to iot. . the

Consumers Communication & Networking

ontology analysis model will be designed, which will

Conference (CCNC); Year: 2017

analyze the ontology of each node to determine the

[4]

attacker nodes on the basis of their behavior. the Š 2018, IRJET

|

Impact Factor value: 6.171

Qiang Liu; Hao Zhang; Jiafu Wan; Xin Chen, IAn Access Control Model for Resource

|

ISO 9001:2008 Certified Journal

|

Page 4243

International Research Journal of Engineering and Technology (IRJET) Volume: 05 Issue: 04 | Apr 2018

www.irjet.net

sharing Based on the RoleYBased Access Control

[5]

intended

for

e-ISSN: 2395-0056 p-ISSN: 2395-0072

[10]

Weber, Rolf H. 9internet of things-New

MultiYDomain

security and privacy challenges.9 Computer

Manufaturing internet of things", ieee Access,

law & security review 26, no. 1 (2010):

Year: 2017, Volume: 5

23Y30.

Marwah Hemdi; Ralph Deters, Iusing Rest based protocol to enable ABAC within iot systems", 2016 IEEE 7th Annual Information Technology,

Electronics

and

Mobile

Communication Conference (ieMCON), Year: 2016 [6] Swati Kinikar; sujatha terdal, Iimplementation

of open authentication for ot application", 2016 International Conference on Inventive Computation

application,

year:

2016,

Volume: [7]

Castellani, Angelo P., Nicola Bui, Paolo Casari, Michele Rossi, Zach shelby, and Michele Zorzi. 9Architecture and protocols for the internet of things: A case study.9 in Pervasive Computing and Communications Workshops (PERCOM Workshops), 2010 8th IEEE International Conference on, pp.

678Y683. ieee, 2010.

[8]

Debaty, Philippe, and Deborah Caswell.

9uniform web presence architecture for people, places, and things.9 IEEE Personal Communications 8, no. 4 (2001): 46Y51.

[9]

Gr0nbak, inge. 9Architecture for the internet of things (iot): APi and interconnect.9 in Sensor Technologies & Applications, 2008.

SENSORCOMM 08. Second International Conference on, pp. 802Y807. ieee, 2008.

Š 2018, IRJET

|

Impact Factor value: 6.171

|

ISO 9001:2008 Certified Journal

|

Page 4244