Survey on Internet of Things Access Control Security

被引：0
|
作者：
Liu Q. [1 ,2 ]
Jin Z. [1 ,2 ]
Chen C. [1 ,2 ]
Gao X. [1 ,2 ]
Zheng N. [1 ,2 ]
Fang Y. [1 ,2 ]
Feng Y. [1 ]
机构：
[1] Institute of Information Engineering, Chinese Academy of Sciences, Beijing
[2] School of Cyber Security, University of Chinese Academy of Sciences, Beijing
来源：
Jisuanji Yanjiu yu Fazhan/Computer Research and Development | 2022年 / 59卷 / 10期
关键词：
Access control; Attack surface; Internet of things (IoT); Security; Trust chain;
D O I：
10.7544/issn1000-1239.20220510
中图分类号：
学科分类号：
摘要：
In recent years, Internet of things (IoT) security incidents have occurred frequently. As an important security mechanism, IoT access control plays an important role. However, the existing Internet access control policies cannot be directly applied to the IoT scenarios because of the differences between IoT and Internet. At present, the IoT access control schemes have not paid attention to the security issues. Once the IoT access control is broken, it will cause serious consequences such as privacy data leakage and authority abuse. Thus, it is urgent to comprehensively study the security issues and solutions for access control of IoT. According to the complex architecture, the variety of devices, low storage and computing performance of IoT, the protection surface and trust relationship in IoT access control is combed, the trust chain is built and the risk transmission law in the trust chain is discussed. Around the protection surface and trust chain, we summarize the existing access control attack surface from the perception layer, network layer, and application layer, and analyze the existing security risks. In view of these security risks, we present the necessary access control security demand, including mechanism improvement, attack surface answer, multilevel authentication and authorization, and the combination with specific scenarios. Based on the requirements, the existing security solutions and targeted access control framework are summarized. Finally, we discuss the challenges faced in IoT access control and point out the future research direction that consists of an in-depth study on access control of the cloud platform of IoT, IoT cloud docking standardization, and the introduction of zero trust concept. © 2022, Science Press. All right reserved.
引用
收藏
页码：2190 / 2211
页数：21
相关论文
共 99 条
  • [11] Yan Han, Peng Guojun, Luo Yuan, Et al., Survey on smart home attack and defense methods, Journal of Cyber Security, 6, 4, pp. 1-27, (2021)
  • [12] Wang Jice, Li Yilian, Jia Yan, Et al., Survey of smart home security, Journal of Computer Research and Development, 55, 10, pp. 2111-2124, (2018)
  • [13] Peng Anni, Zhou Wei, Jia Yan, Et al., Survey of the Internet of things operating system security, Journal on Communications, 39, 3, pp. 22-34, (2018)
  • [14] Graham G S, Denning P J., Protection: Principles and practice, Proc of the Spring Joint Computer Conf, pp. 417-429, (1972)
  • [15] Bell D E, LaPadula L J., Secure computer systems: Mathematical foundations, (1973)
  • [16] Sandhu R S, Coyne E J, Feinstein H L, Et al., Role-based access control models, Computer, 29, 2, pp. 38-47, (1996)
  • [17] Yuan E, Tong Jin, Attributed based access control (ABAC) for Web services, Proc of IEEE Int Conf on Web Services (ICWS), (2005)
  • [18] Park J, Sandhu R., The UCONABC usage control model, ACM Transactions on Information and System Security, 7, 1, pp. 128-174, (2004)
  • [19] Gusmeroli S, Piccione S, Rotondi D., A capability-based security approach to manage access control in the Internet of things, Mathematical and Computer Modelling, 58, 5-6, pp. 1189-1205, (2013)
  • [20] Jia Yan, Xing Luyi, Mao Yuhang, Et al., Burglars' IoT paradise: Understanding and mitigating security risks of general messaging protocols on IoT clouds, Proc of 2020 IEEE Symp on Security and Privacy (S&P), pp. 465-481, (2020)
12345678910