A Traceable Capability-based Access Control for IoT  

作　　者：Chao Li Fan Li Cheng Huang Lihua Yin Tianjie Luo Bin Wang 

机构地区：[1]Cyberspace Institute of Advanced Technology,Guangzhou University,Guangzhou,510700,China [2]PCL Research Center of Cyberspace Security,Peng Cheng Laboratory,Shenzhen,518052,China [3]Department of Electrical and Computer Engineering,University of Waterloo,Waterloo,N2L 3G1,Canada [4]College of Electrical Engineering,Zhejiang University,Hangzhou,310058,China

出　　处：《Computers, Materials & Continua》2022年第9期4967-4982,共16页计算机、材料和连续体（英文）

基　　金：This work supports in part by National Key R&D Program of China(No.2018YFB2100400);National Science Foundation of China(No.61872100);Industrial Internet Innovation and Development Project of China(2019);State Grid Corporation of China Co.,Ltd.technology project(No.5700-202019187A-0-0-00).

摘　　要：Delegation mechanism in Internet of Things(IoT)allows users to share some of their permissions with others.Cloud-based delegation solutions require that only the user who has registered in the cloud can be delegated permissions.It is not convenient when a permission is delegated to a large number of temporarily users.Therefore,some works like CapBAC delegate permissions locally in an offline way.However,this is difficult to revoke and modify the offline delegated permissions.In this work,we propose a traceable capability-based access control approach(TCAC)that can revoke and modify permissions by tracking the trajectories of permissions delegation.We define a time capability tree(TCT)that can automatically extract permissions trajectories,and we also design a new capability token to improve the permission verification,revocation and modification efficiency.The experiment results show that TCAC has less token verification and revocation/modification time than those of CapBAC and xDBAuth.TCAC can discover 73.3%unvisited users in the case of delegating and accessing randomly.This provides more information about the permissions delegation relationships,and opens up new possibilities to guarantee the global security in IoT delegation system.To the best of our knowledge,TCAC is the first work to capture the unvisited permissions.

关 键 词：IoT access control permission delegation delegation trajectory capability revocation capability modification 

分 类 号：TP391.44[自动化与计算机技术—计算机应用技术]