research-article

ZTA-IoT: A Novel Architecture for Zero-Trust in IoT Systems and an Ensuing Usage Control Model

Authors:

Lopamudra Praharaj,

Maanak GuptaAuthors Info & Claims

ACM Transactions on Privacy and Security, Volume 27, Issue 3

Article No.: 22, Pages 1 - 36

https://doi.org/10.1145/3671147

Published: 16 August 2024 Publication History

Abstract

Recently, several researchers motivated the need to integrate Zero Trust (ZT) principles when designing and implementing authentication and authorization systems for IoT. An integrated Zero Trust IoT system comprises the network infrastructure (physical and virtual) and operational policies in place for IoT as a product of a ZT architecture plan. This article proposes a novel Zero Trust architecture for IoT systems called ZTA-IoT. Additionally, based on different types of interactions between various layers and components in this architecture, we present ZTA-IoT-ACF, an access control framework that recognizes different interactions that need to be controlled in IoT systems. Within this framework, the article then refines its focus to object-level interactions, i.e., interactions where the target resource is a device (equivalently a thing) or an information file generated or stored by a device. Building on the recently proposed Zero Trust score-based authorization framework (ZT-SAF), we develop the object-level Zero Trust score-based authorization framework for IoT systems, denoted as ZTA-IoT-OL-SAF, to govern access requests in this context. With this machinery in place, we finally develop a novel usage control model for users-to-objects and devices-to-objects interactions, denoted as UCON \(_{IoT}\). We give formal definitions, illustrative use cases, and a proof-of-concept implementation of UCON\(_{IoT}\). This article is a first step toward establishing a rigorous formally defined score-based access control framework for Zero Trust IoT systems.

References

[1]

2023. AWS-IoT. https://aws.amazon.com/iot/

[2]

Tahir Ahmad, Umberto Morelli, Silvio Ranise, and Nicola Zannone. 2018. A lazy approach to access control as a service (ACaaS) for IoT: An AWS case study. In 23nd ACM on Symposium on Access Control Models and Technologies. 235–246.

Digital Library

[3]

Tahir Ahmad, Umberto Morelli, Silvio Ranise, and Nicola Zannone. 2022. Extending access control in AWS IoT through event-driven functions: An experimental evaluation using a smart lock system. International Journal of Information Security 21, 2 (2022), 379–408.

Digital Library

[4]

Ala Al-Fuqaha, Mohsen Guizani, Mehdi Mohammadi, Mohammed Aledhari, and Moussa Ayyash. 2015. Internet of Things: A survey on enabling technologies, protocols, and applications. IEEE Communications Surveys & Tutorials 17, 4 (2015), 2347–2376.

Digital Library

[5]

Fadele Ayotunde Alaba, Mazliza Othman, Ibrahim Abaker Targio Hashem, and Faiz Alotaibi. 2017. Internet of Things security: A survey. Journal of Network and Computer Applications 88 (2017), 10–28.

Digital Library

[6]

Asma Alshehri and Ravi Sandhu. 2016. Access control models for cloud-enabled Internet of Things: A proposed architecture and research agenda. In 2016 IEEE 2nd International Conference on Collaboration and Internet Computing (CIC’16). IEEE, 530–538.

[7]

Safwa Ammer, James Benson, and Ravi Sandhu. 2022. Hybrid approaches (ABAC and RBAC) toward secure access control in smart home IoT. IEEE Transactions on Dependable and Secure Computing (2022).

[8]

Safwa Ameer, James Benson, and Ravi Sandhu. 2020. The EGRBAC model for smart home IoT. In 2020 IEEE 21st International Conference on Information Reuse and Integration for Data Science (IRI). IEEE.

[9]

Safwa Ameer, James Benson, and Ravi Sandhu. 2022. An attribute-based approach toward a secured smart-home IoT access control and a comparison with a role-based approach. Information 13, 2 (2022), 60.

[10]

Safwa Ameer, Maanak Gupta, Smriti Bhatt, and Ravi Sandhu. 2022. BlueSky: Towards convergence of zero trust principles and score-based authorization for IoT enabled smart systems. In Proceedings of the 27th ACM on Symposium on Access Control Models and Technologies. 235–244.

Digital Library

[11]

Safwa Ameer, Ram Krishnan, Ravi Sandhu, and Maanak Gupta. 2023. Utilizing the DLBAC approach toward a ZT score-based authorization for IoT systems. In 13th ACM Conference on Data and Application Security and Privacy. 283–285.

Digital Library

[12]

Safwa Ameer and Ravi Sandhu. 2021. The HABAC model for smart home IoT and comparison to EGRBAC. In ACM Workshop on Secure and Trustworthy Cyber-Physical Systems (SAT-CPS’21).

Digital Library

[13]

Orlando Arias, Jacob Wurm, Khoa Hoang, and Yier Jin. 2015. Privacy and security in internet of things and wearable devices. TMSCS (2015).

[14]

Luigi Atzori, Antonio Iera, and Giacomo Morabito. 2010. The Internet of Things: A survey. Computer Networks 54, 15 (2010), 2787–2805.

Digital Library

[15]

Syafril Bandara, Takeshi Yashiro, Noboru Koshizuka, and Ken Sakamura. 2016. Access control framework for api-enabled devices in smart buildings. In APCC. IEEE.

[16]

Ezedine Barka, Sujith Samuel Mathew, and Yacine Atif. 2015. Securing the web of things with role-based access control. In C2SI. Springer.

[17]

Bruhadeshwar Bezawada, Kyle Haefner, and Indrakshi Ray. 2018. Securing home IoT environments with attribute-based access control. In ABAC’18. ACM.

Digital Library

[18]

Smriti Bhatt, Farhan Patwa, and Ravi Sandhu. 2017. An access control framework for cloud-enabled wearable internet of things. In 2017 IEEE 3rd International Conference on Collaboration and Internet Computing (CIC’17). IEEE, 328–338.

[19]

Smriti Bhatt, Farhan Patwa, and Ravi Sandhu. 2017. Access control model for AWS Internet of Things. In International Conference on Network and System Security.

[20]

Smriti Bhatt and Ravi Sandhu. 2020. ABAC-CC: Attribute-based access control and communication control for Internet of Things. In Proceedings of the 25th ACM Symposium on Access Control Models and Technologies.

Digital Library

[21]

Smriti Bhatt and Ravi Sandhu. 2020. Convergent access control to enable secure smart communities. In TPS-ISA. IEEE.

[22]

Alessio Botta, Walter De Donato, Valerio Persico, and Antonio Pescapé. 2016. Integration of cloud computing and Internet of Things: A survey. Future Generation Computer Systems 56 (2016), 684–700.

Digital Library

[23]

Z. Berkay Celik, Gang Tan, and Patrick D. McDaniel. 2019. IoTGuard: Dynamic enforcement of security and safety policy in commodity IoT. In NDSS.

[24]

Baozhan Chen, Siyuan Qiao, Jie Zhao, Dongqing Liu, Xiaobing Shi, Minzhao Lyu, Haotian Chen, Huimin Lu, and Yunkai Zhai. 2020. A security awareness and protection system for 5G smart healthcare based on zero-trust architecture. IEEE Internet of Things Journal 8, 13 (2020), 10248–10263.

[25]

Zhiyu Chen, Longchuan Yan, Zitong Lü, Yanling Zhang, Yonghe Guo, Wenjing Liu, and Jiaxing Xuan. 2021. Research on zero-trust security protection technology of power IoT based on blockchain. In Journal of Physics: Conference Series, Vol. 1769. IOP Publishing, 012039.

[26]

Pietro Colombo, Elena Ferrari, and Engin Deniz Tümer. 2021. Access control enforcement in IoT: State of the art and open challenges in the Zero Trust era. In 2021 3rd IEEE International Conference on Trust, Privacy and Security in Intelligent Systems and Applications (TPS-ISA’21). IEEE, 159–166.

[27]

Michael J. Covington, Matthew James Moyer, and Mustaque Ahamad. 2000. Generalized Role-based Access Control for Securing Future Applications. Technical Report. Georgia Tech.

[28]

Dorothy E. Denning. 1976. A lattice model of secure information flow. Commun. ACM 19, 5 (1976), 236–243.

Digital Library

[29]

Tamara Denning, Tadayoshi Kohno, and Henry M. Levy. 2013. Computer security and the modern home. Commun. ACM (2013).

Digital Library

[30]

Suparna Dhar and Indranil Bose. 2021. Securing IoT devices using zero trust and blockchain. Journal of Organizational Computing and Electronic Commerce 31, 1 (2021), 18–34.

[31]

Theo Dimitrakos, Tezcan Dilshener, Alexander Kravtsov, Antonio La Marra, Fabio Martinelli, Athanasios Rizos, Alessandro Rosett, and Andrea Saracino. 2020. Trust aware continuous authorization for zero trust in consumer Internet of Things. In TrustCom. IEEE.

[32]

Earlence Fernandes, Jaeyeon Jung, and Atul Prakash. 2016. Security analysis of emerging smart home applications. In SP. IEEE.

[33]

Earlence Fernandes, Justin Paupore, Amir Rahmati, Daniel Simionato, Mauro Conti, and Atul Prakash. 2016. Flowfence: Practical data protection for emerging IoT application frameworks. In 25th USENIX Security Symposium.

Digital Library

[34]

Maribel Fernández, Alex Franch Tapia, Jenjira Jaimunk, Manuel Martinez Chamorro, and Bhavani Thuraisingham. 2020. A data access model for privacy-preserving cloud-IoT architectures. In SACMAT’20.

Digital Library

[35]

David F. Ferraiolo, Ravi Sandhu, Serban Gavrila, D. Richard Kuhn, and Ramaswamy Chandramouli. 2001. Proposed NIST standard for role-based access control. TISSEC (2001).

Digital Library

[36]

Jorge Granjal, Edmundo Monteiro, and Jorge S. Silva. 2015. Security for the Internet of Things: A survey of existing protocols and open research issues. IEEE Comm. Surv. Tuts (2015).

Digital Library

[37]

Maanak Gupta and Ravi Sandhu. 2018. Authorization framework for secure cloud assisted connected cars and vehicular internet of things. In ACM SACMAT.

Digital Library

[38]

Maanak Gupta and Ravi Sandhu. 2021. Towards activity-centric access control for smart collaborative ecosystems. In 26th ACM Symposium on Access Control Models and Technologies. 155–164.

Digital Library

[39]

Grant Ho, Derek Leung, Pratyush Mishra, Ashkan Hosseini, Dawn Song, and David Wagner. 2016. Smart locks: Lessons for securing commodity internet of things devices. In ASIA CCS’16. ACM.

Digital Library

[40]

Vincent C. Hu, D. Richard Kuhn, David F. Ferraiolo, and Jeffrey Voas. 2015. Attribute-based access control. Comp. (2015).

[41]

X. Jin, R. Krishnan, and R. Sandhu. 2012. A unified attribute-based access control model covering DAC, MAC and RBAC. In IFIP Annual Conf. on Data and App. Sec.

Digital Library

[42]

Qi Jing, Athanasios V. Vasilakos, Jiafu Wan, Jingwei Lu, and Dechao Qiu. 2014. Security of the Internet of Things: Perspectives and challenges. Wireless Networks 20, 8 (2014), 2481–2501.

Digital Library

[43]

D. Richard Kuhn, Edward J. Coyne, and Timothy R. Weil. 2010. Adding attributes to role-based access control. Computer (2010).

Digital Library

[44]

R. Levin, E. Cohen, W. Corwin, F. Pollack, and W. Wulf. 1975. Policy/Mechanism separation in Hydra. SIGOPS Oper. Syst. Rev. 9, 5 (Nov.1975), 132–140. DOI:

Digital Library

[45]

Sudakshina Mandal, Danish Ali Khan, and Sarika Jain. 2021. Cloud-based zero trust access control policy: An approach to support work-from-home driven by COVID-19 pandemic. New Generation Computing 39, 3 (2021), 599–622.

Digital Library

[46]

Oscar Novo. 2018. Blockchain meets IoT: An architecture for scalable access management in IoT. IEEE IoT Journal (2018).

[47]

Aafaf Ouaddah, Hajar Mousannif, Anas Abou Elkalam, and Abdellah Ait Ouahman. 2017. Access control in the Internet of Things: Big challenges and new opportunities. Comp. NW 112 (2017).

[48]

Jaehong Park and Ravi Sandhu. 2004. The UCONABC usage control model. ACM Trans. Inf. Syst. Secur. 7, 1 (Feb.2004), 128–174. DOI:

Digital Library

[49]

Jaehong Park, Ravi Sandhu, and Yuan Cheng. 2011. ACON: Activity-centric access control for social computing. In ARES. IEEE.

[50]

Keyur K. Patel and Sunil M. Patel. 2016. Internet of things-IOT: Definition, characteristics, architecture, enabling technologies, application & future challenges. International Journal of Engineering Science and Computing 6, 5 (2016).

[51]

Pawani Porambage, Mika Ylianttila, Corinna Schmitt, Pardeep Kumar, Andrei Gurtov, and Athanasios V. Vasilakos. 2016. The quest for privacy in the Internet of Things. IEEE Cloud Computing (2016).

[52]

Jing Qiu, Zhihong Tian, Chunlai Du, Qi Zuo, Shen Su, and Binxing Fang. 2020. A survey on access control in the age of Internet of Things. IEEE Internet of Things Journal (2020).

[53]

B. B. Prahlada Rao, Paval Saluia, Neetu Sharma, Ankit Mittal, and Shivay Veer Sharma. 2012. Cloud computing for Internet of Things & sensing based applications. In 2012 6th International Conference on Sensing Technology (ICST’12). IEEE, 374–380.

[54]

Sowmya Ravidas, Alexios Lekidis, Federica Paci, and Nicola Zannone. 2019. Access control in Internet-of-Things: A survey. Journal of Network and Computer Applications 144 (2019), 79–101.

Digital Library

[55]

Rodrigo Roman, Jianying Zhou, and Javier Lopez. 2013. On the features and challenges of security and privacy in distributed Internet of Things. Computer Networks (2013).

Digital Library

[56]

Scott Rose, Oliver Borchert, Stu Mitchell, and Sean Connelly. 2020. Zero Trust Architecture. Technical Report NIST Special Publication (SP) 800-207. National Institute of Standards and Technology.

[57]

Mayra Samaniego and Ralph Deters. 2018. Zero-trust hierarchical management in IoT. In 2018 IEEE International Congress on Internet of Things (ICIOT’18). IEEE, 88–95.

[58]

Ravi Sandhu. 1996. Rationale for the RBAC96 family of access control models. In 1st ACM Workshop on Role-based Access Control. 9 pages.

Digital Library

[59]

R. Sandhu. 1998. Role-based access control. In Advances in Computers. Vol. 46.

[60]

Ravi Sandhu. 2000. Engineering authority and trust in cyberspace: The OM-AM and RBAC way. In 5th ACM Workshop on Role-based Access Control. 111–119.

Digital Library

[61]

Ravi Sandhu. 2009. The PEI framework for application-centric security. In 2009 5th International Conference on Collaborative Computing: Networking, Applications and Worksharing. IEEE, 1–5.

[62]

Ravi Sandhu and Venkata Bhamidipati. 2008. The ASCAA principles for next-generation role-based access control. In 3rd International Conference on Availability, Reliability and Security (ARES’08). 6 pages.

[63]

Ravi Sandhu, David Ferraiolo, and Richard Kuhn. 2000. The NIST model for role-based access control: Towards a unified standard. In ACM Workshop on Role-based Access Control.

[64]

Ravi Sandhu, Kumar Ranganathan, and Xinwen Zhang. 2006. Secure information sharing enabled by trusted computing and PEI models. In 2006 ACM Symposium on Information, Computer and Communications Security. 2–12.

Digital Library

[65]

Ravi S. Sandhu. 1993. Lattice-based access control models. Computer 26, 11 (1993), 9–19.

Digital Library

[66]

Ravi S. Sandhu, Edward J. Coyne, Hal L. Feinstein, and Charles E. Youman. 1996. Role-based access control models. Comp. (1996).

[67]

Daniel Servos and Sylvia L. Osborn. 2017. Current research and open problems in attribute-based access control. ACM Computing Surveys (CSUR) 49, 4 (2017), 1–45.

Digital Library

[68]

Jaspreet Singh, Yahuza Bello, Ahmed Refaey Hussein, Aiman Erbad, and Amr Mohamed. 2020. Hierarchical security paradigm for IoT multiaccess edge computing. IEEE Internet of Things Journal 8, 7 (2020), 5794–5805.

[69]

Bo Tang, Hongjuan Kang, Jingwen Fan, Qi Li, and Ravi Sandhu. 2019. IoT passport: A blockchain-based trust framework for collaborative Internet-of-Things. In SACMAT’19.

Digital Library

[70]

Yuan Tian, Nan Zhang, Yueh-Hsun Lin, XiaoFeng Wang, Blase Ur, Xianzheng Guo, and Patrick Tague. 2017. SmartAuth:User-Centered authorization for the Internet of Things. In USENIX Security 17.

[71]

Romans Vanickis, Paul Jacob, Sohelia Dehghanzadeh, and Brian Lee. 2018. Access control policy enforcement for zero-trust-networking. In 2018 29th Irish Signals and Systems Conference (ISSC’18). IEEE, 1–6.

[72]

Miao Wu, Ting-Jie Lu, Fei-Yang Ling, Jing Sun, and Hui-Ying Du. 2010. Research on the architecture of Internet of Things. In 2010 3rd International Conference on Advanced Computer Theory and Engineering (ICACTE’10), Vol. 5. IEEE, V5–484.

[73]

Zhang Xiaojian, Chen Liandong, Fan Jie, Wang Xiangqun, and Wang Qi. 2021. Power IoT security protection architecture based on zero trust framework. In 2021 IEEE 5th International Conference on Cryptography, Security and Privacy (CSP’21). IEEE, 166–170.

[74]

Wenjun Xiong and Robert Lagerström. 2019. Threat modeling – A systematic literature review. Computers & Security 84 (2019), 53–69. DOI:

Digital Library

[75]

Guoping Zhang and Jiazheng Tian. 2010. An extended role based access control model for the Internet of Things. In 2010 ICINA. IEEE.

Cited By

De Almeida ASalvador L(2024)Securing IoT Devices: ZTA Principles and Network Slicing2024 IEEE 22nd Jubilee International Symposium on Intelligent Systems and Informatics (SISY)10.1109/SISY62279.2024.10737622(000209-000214)Online publication date: 19-Sep-2024
https://doi.org/10.1109/SISY62279.2024.10737622

Recommendations

Dynamic Access Control and Authorization System based on Zero-trust architecture
CCRIS '20: Proceedings of the 2020 1st International Conference on Control, Robotics and Intelligent System

With the development of cloud computing, artificial intelligence, big data and other technologies, network systems are facing more and more security risks and threats. The traditional security architecture based on border protection cannot meet the ...
Secure Access Method of Power Internet of Things Based on Zero Trust Architecture
Advances in Swarm Intelligence
Abstract
With the development of the energy Internet, the terminals of the power Internet of Things are open and interactive, the grid protection boundary is ambiguous, and the traditional boundary based security system is difficult to ensure the secure ...
A critical analysis of Zero Trust Architecture (ZTA)
Highlights
- Zero trust (ZT) has become a very hot approach for building secure systems, promoted by industry and government as a new way to produce systems with a high degree of security.
- We have used security patterns to design and evaluate ...
Abstract
Zero Trust (ZT) has become a very hot approach for building secure systems, promoted by industry and government as a new way to produce systems with a high degree of security. ZT is based on not trusting any request for accessing resources. ...

Comments

Information & Contributors

Information

Published In

cover image ACM Transactions on Privacy and Security

ACM Transactions on Privacy and Security Volume 27, Issue 3

August 2024

193 pages

EISSN:2471-2574

DOI:10.1145/3613650

Editor:
Michael Waidner
ATHENE / TU Darmstadt / Fraunhofer SIT, Germany

Issue’s Table of Contents

Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than the author(s) must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected].

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 16 August 2024

Online AM: 17 June 2024

Accepted: 03 May 2024

Revised: 22 March 2024

Received: 28 March 2023

Published in TOPS Volume 27, Issue 3

Check for updates

Author Tags

Qualifiers

Research-article

Funding Sources

NSF CREST-PRF
NSF CREST

Contributors

Other Metrics

View Article Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

1
Total Citations
View Citations
706
Total Downloads

Downloads (Last 12 months)706
Downloads (Last 6 weeks)84

Reflects downloads up to 03 Mar 2025

Other Metrics

View Author Metrics

Citations

Cited By

De Almeida ASalvador L(2024)Securing IoT Devices: ZTA Principles and Network Slicing2024 IEEE 22nd Jubilee International Symposium on Intelligent Systems and Informatics (SISY)10.1109/SISY62279.2024.10737622(000209-000214)Online publication date: 19-Sep-2024
https://doi.org/10.1109/SISY62279.2024.10737622

View Options

Login options

Check if you have access through your login credentials or your institution to get full access on this article.

Full Access

Get this Article

View options

PDF

View or Download as a PDF file.

eReader

View online with eReader.

Full Text

View this article in Full Text.

Figures

Tables

Media

View full text|Download PDF

View Issue’s Table of Contents