ALLPCB
This article examines access control in IoT systems. Access control refers to authentication and the regulation of legitimate use of resources, i.e., granting or denying access to specific resources according to authorization rules to prevent unauthorized access or improper use by authorized users, thereby ensuring resources are used appropriately.
Because IoT applications operate in multiuser, multitask environments, the potential for improper use of system resources increases. Therefore, effective security measures are required for computers and network systems to prevent unauthorized access and misuse of resources by legitimate users.
Access control encompasses three main aspects.
Key Meanings of Access Control
1. Legitimacy: Prevent access by users who lack formal authorization, and stop illegal access by unauthorized users.
2. Integrity: Ensure collected, transmitted, and stored data remain intact and are not arbitrarily added to, deleted, or modified.
3. Timeliness: Ensure system resources cannot be tampered with by unauthorized users within a required time window, maintaining system integrity during that period.
With access control, systems can prevent and impede unauthorized users from accessing or operating system resources.
1. Basic Principles of Access Control
An access control mechanism enforces policies that limit access to resources, granting permissions only to authorized users. Organizations should establish strict procedures for requesting, issuing, and revoking user authorizations, and implement mechanisms to manage and supervise user responsibilities.
Authorization should follow three basic principles to achieve system security.
1. Least Privilege
Least privilege is a fundamental security principle. It means granting each subject (user or process) only the privileges essential to perform its tasks. Limiting privileges minimizes potential damage from accidents, errors, or tampering. The principle ensures subjects receive only the privileges necessary to complete required tasks, and nothing beyond that.
2. Shared Responsibility
Shared responsibility, or distribution of authorization, assigns critical functions across multiple individuals so no single person holds complete authority or knowledge. For example, responsibilities can be split so no one person has the entire cryptographic key.
3. Separation of Duties
Separation of duties reduces risk by assigning different responsibilities to different personnel to create mutual checks and balances. For example, the roles of cashier, treasurer, and auditor should be held by different people. In computing environments, certain permissions should not be granted to the same user concurrently to avoid security gaps.
2. Basic Concepts of Access Control
Access control grants subjects different permissions to access objects or other resources based on control policies. The three core elements are: subject, object, and control policy.
2.1 Subject
A subject is an active entity that can act on information objects. Typically a subject is a user, but jobs, processes, or devices can also be subjects. For example, a user operating on a file is a subject; a process started by that user is also a subject; a device that detects power failures is a subject. In interactive systems, a user registers, then starts a process that inherits the user's access rights; that process is a subject as well.
2.2 Object
An object is an information entity or a carrier that receives information from other subjects or objects. Objects include records, data blocks, pages, segments, files, directories, mailboxes, programs, bits, bytes, fields, processors, communication lines, clocks, and network nodes. In some systems, objects are logically treated as files. Each hardware device is treated as an object and has associated access control information. A subject must have appropriate access rights to access a device, and security checks verify those rights.
2.3 Control Policy
A control policy is the set of permitted operations and constraints that define how subjects may act on objects. The policy defines which operations a subject can perform on an object and any conditional constraints. It embodies authorization: the permissions an object grants to subjects and the rules that must not be exceeded.
The three elements of access control can be represented as a triplet (S, O, P), where S is the subject, O the object, and P the permission. Subjects can access objects only after authentication, and authentication does not imply authorization to perform operations. A user identifier uniquely distinguishes each user; when registering, the system verifies that the current user corresponds to the claimed identifier.
Current access control models generally describe systems using the definitions of subject, object, and permission and their relationships. The core problem access control addresses is how an active entity (subject) can access a passive protected entity (object) under security policies. Access types on an object can include extracting information or inserting information; access modes include read-only, read-write, write-only, and read-and-write.
3. Implementing Access Control Policies
Access control policy is a core part of IoT information security. Its purpose is to prevent unauthorized use and access, provide a framework for protecting information assets, and define security methods for managing and accessing IoT resources, including the responsibilities of each element.
3.1 Fundamental Principles of Policy Design
Policy design and implementation must address the relationships among subject, object, and the set of control rules. The specific principles include:
1. Least Privilege. Assign subjects the minimum rights required to perform their tasks to limit potential damage from incidents, errors, or unauthorized subjects.
2. Need-to-Know (Minimum Disclosure). Grant subjects only the information they need to perform tasks.
3. Multilevel Security. Control data flow and permissions based on security levels such as top secret, secret, confidential, restricted, and unclassified. Only subjects with security clearance at or above the resource level may access it, reducing the spread of sensitive information.
3.2 Policy Implementation Methods
Access control security policies generally fall into identity-based policies and rule-based policies. Both rely on authorization behavior.
Identity-Based Policies
Identity-based policies align with authentication: only authenticated subjects are allowed to access resources. They include user-based and group-based policies.
User-based policies center on individual users and consist of lists that specify which users may perform which operations on specific objects.
Group-based policies extend user-based policies by allowing multiple users to share the same access rules for the same objects.
Two basic implementations are capability lists and access control lists. Capability lists are subject-oriented, while access control lists are object-oriented.
Rule-Based Policies
Rule-based policies often depend on sensitivity labels. Data or resources are labeled with security markings, and processes acting on behalf of users inherit the security labels of their originators. The system compares the user's security level with the object's security level to decide whether to allow access.
