Contexts-States-Aware Access Control for Internet of Things

The more and more connected devices and rapidly developing Internet of Things (IoT) applications are the foundations of the future smart cities which provide ubiquitous services. The extension and proliferation of the technology brings huge security challenges, especially for the infrastructural IoT applications in the open environments. The traditional access model, such as Role-Based Access Control (RBAC) cannot provide the flexible fine-grained access control which is required due to dynamic changing users and environments. On the other hand, some other features of the IoT applications like constrained-resources devices and large-scale deployments make it very difficult to apply Attribute-Based Access Control (ABAC). Furthermore, the ABAC mechanism cannot control the way that the requester uses the services once the requester obtains the access permission. To address these issues, in this paper, we propose an access control model based on ABAC with Contexts-States-Awareness. The proposed model is implemented by using Semantic Web technologies with a sample ontology for the model and some access control policies in SWRL (Semantic Web Rule Language). We also give a logical architecture which is the extension from the reference architecture of XACML eXtensible Access Control Markup Language specification.