Context-aware Automatic Access Policy Specification for IoT Environments

Abstract

Data privacy becomes a primary impediment to the realization of the IoT vision. One approach to the IoT security and privacy problem is to restrict access to sensitive data via access control and authorization models. Yet access context in IoT changes frequently raising the need for flexible and dynamic access control policies. Towards developing dynamic access control policies, context-based access control techniques are being investigated due to their robustness in assigning dynamic access permissions according to changes in context. In this paper, we propose to automate the generation of access control policies to overcome the inflexibility in traditional access policy specification techniques, and improve its adaptability to dynamic IoT environments. In our framework, we use context, attributes, and predication to describe the core access control elements. In response to access requests, our algorithm automatically produces conflict-free access control policies and makes the final access decisions at runtime. Our framework prevents non-authorized data accesses, and satisfies privacy constraints for authorized access requests in highly dynamic IoT environments. Our preliminary evaluation shows that the proposed approach offers greater flexibility and improved scalability than the current state-of-the-art methods.