Abstract
The proliferation of IoT devices across various application domains led to a high level of heterogeneity which introduced new device management challenges. These challenges include, bringing the capability of the service delivery and the underlying accounting, authentication and authorization mechanisms. Moreover, IoT devices tend to no longer require a centralized authority to authenticate and authorize access to the services offered. In this work, we address this by introducing a decentralized Authentication, Authorization and Accounting (AAA) framework using Capability-based Tokens based on the ERC721 standard to provide secure authentication and authorization for IoT devices. The approach is tested on a private Ethereum Blockchain node to analyze performance factors related to access time, timeout ratio and overhead.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
References
Gartners, Inc. The value and impact of IoT on business, 2015. http://www.gartner.com/newsroom/id/3114217
E. Bertino, N. Islam, Botnets and internet of things security. Computer 50(2), 76–79 (2017)
B. Ali, A.I. Awad, Cyber and physical security vulnerability assessment for IoT-based smart homes. Sensors (Basel, Switzerland) 18(3), 817 (2018)
OAuth 2.0. https://oauth.net/2
D. Recordon, D. Reed, OpenID 2.0: a platform for user centric identity management, in DIM ’06: Proceedings of the 2nd ACM Workshop on Digital Identity Management, 2006, pp. 11–16
M. Nakhjiri, M. Nakhjiri, AAA and network security for mobile access: radius, diameter, EAP, PKI and IP mobility. (Wiley, New York, 2005), pp. 1–24
General Data Protection Regulation, 2018. https://gdpr-info.eu
O. Liberg, M. Sundberg, E. Wang, J. Bergman, J. Sachs, Cellular Internet of Things: Technologies, Standards, and Performance (Academic Press, London, 2018)
V. Buterin, Ethereum: a next-generation smart contract and decentralized application platform. Ethereum Foundation. 2014. https://github.com/ethereum/wiki/wiki/White-Paper
A. Sghaier Omar, O. Basir, Identity management in IoT networks using Blockchain and smart contracts, in Proceedings of the 2018 IEEE International Conference on Blockchain, Halifax, NS, Canada, 2018
G. Wood, Ethereum: a secure decentralised generalised transaction ledger, 2014. http://gavwood.com/paper.pdf
Solidity Documentation. https://solidity.readthedocs.io/en/v0.4.25/
F. Vogelsteller, V. Buterin, ERC 20 Token Standard, 2015. https://github.com/ethereum/EIPs/blob/master/EIPS/eip-20.md
W. Entriken, D. Shirley, J. Evans, N. Sachs. ERC-721 Non-fungible token standard, 2018. https://github.com/ethereum/EIPs/blob/master/EIPS/eip-721.md
Non-fungible token Market. https://nonfungible.com
R. Xu, Y. Chen, E. Blasch, G. Chen, Blendcac: a Blockchain-enabled decentralized capability-based access control for iots, in IEEE International Conference on Blockchain, Selected Areas in IoT and Blockchain, 2018
D. Ferraiolo, R. Kuhn, Role-based access controls, in Proceedings of the 15th National Computer Security Conference, 1992, pp. 554–563
S. Gavrila, J. Barkley, Formal specification for role based access control user/role and role/role relationship management, in Proceedings of the 3rd ACM Workshop on Role-Based Access Control (RBAC’98), 1998, pp. 81–90
G. Zhang, J. Tian, An extended role based access control model for the internet of things, in Proceedings of the International Conference on Information, Networking and Automation, Proceedings, 2010, pp. 319–323
J.L. Hernandez-Ramos, A.J. Jara, L. Marin, A.F. Skarmeta, Distributed capability-based access control for the internet of things. J. Internet Serv. Inform. Secur. 3(3/4), 1–16 (2013)
A. Ouaddah, A. Abou Elkalam, A. Ait Ouahman, Fairaccess: a new Blockchain-based access control framework for the internet of things. Secur. Comm. Network. 9(18), 5943–5964 (2016)
R. Xu, Y. Chen, E. Blasch, G. Chen, A federated capability-based access control mechanism for internet of things (iots), in SPIE Defense & Commercial Sensing. Conference on Sensors and Systems for Space Applications, 2018
S. Gusmeroli, S. Piccione, D. Rotondi, A capability-based security approach to manage access control in the internet of things. Math. Comput. Model., 1189–1205 (2013)
A. Ouaddah, H. Mousannif, A.A. Elkalam, A.A. Ouahman, Access control in the internet of things: big challenges and new opportunities. Comput. Netw. 112, 237–262 (2017)
Study of Authorization Architecture for Supporting Heterogeneous Access Control Policies (2016) OneM2M Technical Report, TR-0016-V-2.0
IPFS Documentation, Protocol Labs, https://docs.ipfs.io
L. Chen, G. Guang, Communication System Security (Chapman & Hall/CRC, London/Boca Raton, 2012)
M. Collina, COAP Node.js Library, https://github.com/mcollina/node-coap
Web3.js Ethereum Javascript API. https://github.com/ethereum/wiki/wiki/JavaScript-API
Z. Shelby, K. Hartke, C. Bormann, The Constrained Application Protocol (CoAP), IETF RFC 7252, 2014. http://tools.ietf.org/html/rfc7252
S. Deering, R. Hinden, Internet Protocol, Version 6 (IPv6) Specification, Internet Engineering Task Force (IETF) RFC 8200, 2017. https://tools.ietf.org/html/rfc8200
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2020 Springer Nature Switzerland AG
About this chapter
Cite this chapter
Sghaier Omar, A., Basir, O. (2020). Capability-Based Non-fungible Tokens Approach for a Decentralized AAA Framework in IoT. In: Choo, KK., Dehghantanha, A., Parizi, R. (eds) Blockchain Cybersecurity, Trust and Privacy. Advances in Information Security, vol 79. Springer, Cham. https://doi.org/10.1007/978-3-030-38181-3_2
Download citation
DOI: https://doi.org/10.1007/978-3-030-38181-3_2
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-030-38180-6
Online ISBN: 978-3-030-38181-3
eBook Packages: Computer ScienceComputer Science (R0)