Survey on Internet of Things Access Control Security

被引：0
作者：
Liu Q. [1 ,2 ]
Jin Z. [1 ,2 ]
Chen C. [1 ,2 ]
Gao X. [1 ,2 ]
Zheng N. [1 ,2 ]
Fang Y. [1 ,2 ]
Feng Y. [1 ]
机构：
[1] Institute of Information Engineering, Chinese Academy of Sciences, Beijing
[2] School of Cyber Security, University of Chinese Academy of Sciences, Beijing
来源：
Jisuanji Yanjiu yu Fazhan/Computer Research and Development | 2022年 / 59卷 / 10期
关键词：
Access control; Attack surface; Internet of things (IoT); Security; Trust chain;
D O I：
10.7544/issn1000-1239.20220510
中图分类号：
学科分类号：
摘要：
In recent years, Internet of things (IoT) security incidents have occurred frequently. As an important security mechanism, IoT access control plays an important role. However, the existing Internet access control policies cannot be directly applied to the IoT scenarios because of the differences between IoT and Internet. At present, the IoT access control schemes have not paid attention to the security issues. Once the IoT access control is broken, it will cause serious consequences such as privacy data leakage and authority abuse. Thus, it is urgent to comprehensively study the security issues and solutions for access control of IoT. According to the complex architecture, the variety of devices, low storage and computing performance of IoT, the protection surface and trust relationship in IoT access control is combed, the trust chain is built and the risk transmission law in the trust chain is discussed. Around the protection surface and trust chain, we summarize the existing access control attack surface from the perception layer, network layer, and application layer, and analyze the existing security risks. In view of these security risks, we present the necessary access control security demand, including mechanism improvement, attack surface answer, multilevel authentication and authorization, and the combination with specific scenarios. Based on the requirements, the existing security solutions and targeted access control framework are summarized. Finally, we discuss the challenges faced in IoT access control and point out the future research direction that consists of an in-depth study on access control of the cloud platform of IoT, IoT cloud docking standardization, and the introduction of zero trust concept. © 2022, Science Press. All right reserved.
引用
收藏
页码：2190 / 2211
页数：21
相关论文
共 99 条
[61]  
Wen Haohuang, Lin Zhiqiang, Zhang Yinqian, FirmXRay: Detecting Bluetooth link layer vulnerabilities from bare-metal firmware, Proc of the 2020 ACM Conf on Computer and Communications Security (SIGSAC), pp. 167-180, (2020)
[62]  
Wu Jianliang, Nan Yuhong, Kumar V, Et al., BLESA: Spoofing attacks against reconnections in Bluetooth low energy, Proc of the 14th USENIX Workshop on Offensive Technologies (WOOT), (2020)
[63]  
Ludant N, Vo-Huu T D, Narain S, Et al., Linking Bluetooth le & classic and implications for privacy-preserving Bluetooth-based protocols, Proc of the 2021 IEEE Symp on Security and Privacy (S&P), pp. 1318-1331, (2021)
[64]  
Morgner P, Mattejat S, Benenson Z, Et al., Insecure to the touch:Attacking ZigBee 3.0 via touchlink commissioning, Proc of the 10th ACM Conf on Security and Privacy in Wireless and Mobile Networks (WiSec), pp. 230-240, (2017)
[65]  
Akestoridis D G, Harishankar M, Weber M, Et al., Zigator: Analyzing the security of ZigBee-enabled smart homes, Proc of the 13th ACM Conf on Security and Privacy in Wireless and Mobile Networks (WiSec), pp. 77-88, (2020)
[66]  
Al Fardan N J, Paterson K G., Lucky thirteen: Breaking the TLS and DTLS record protocols, Proc of the 2013 IEEE Symp on Security and Privacy (S&P), pp. 526-540, (2013)
[67]  
Wang Qingying, Ji Shouling, Tian Yuan, Et al., MPInspector: Asystematic and automatic approach for evaluating the security of IoT messaging protocols, Proc of the 30th USENIX Conf on Security Symp, pp. 4205-4222, (2021)
[68]  
Fernandes E, Jung J, Prakash A., Security analysis of emerging smart home applications, Proc of 2016 IEEE Symp on Security and Privacy (S&P), pp. 636-654, (2016)
[69]  
Surbatovich M, Aljuraidan J, Bauer L, Et al., Some recipes can do more than spoil your appetite: Analyzing the security and privacy risks of IFTTT recipes, Proc of the 26th Int Conf on World Wide Web (WWW), pp. 1501-1510, (2017)
[70]  
Cobb C, Surbatovich M, Kawakami A, Et al., Howrisky are real users' IFTTT applets?, Proc of the 16th Symp on Usable Privacy and Security (SOUPS), pp. 505-529, (2020)
12345678910