Information Flow Control Based on Capability Token Validity for Secure IoT: Implementation and Evaluation

Abstract

In the CBAC (Capability-Based Access Control) model proposed for realizing the secure IoT (Internet of Things), authorizers issue subjects capability tokens, i.e. sets of access rights on objects in devices. Objects are data resources which are used to store sensor data and action data. Data of an object may be stored in another object through communication among subjects and devices. A subject can get data of an object from another object even if the subject is not allowed to get the data, i.e. information illegally flows from the object to the subject. In addition, a subject can get data generated at time before which the capability token to get the data starts to be valid. Here, information flows from the object to the subject later than expected by the subject to get the data. In our previous studies, the OI (Operation Interruption) and the TBOI (Time-Based OI) protocols are proposed to interrupt operations implying illegal type of information flow and not only illegal but also late types of information flows, respectively. In this paper, the TBOI protocol is designed and implemented. In the evaluation, it is shown the late information flow is prevented in addition to the illegal one in the TBOI protocol although the request processing time is almost the same as the OI protocol.