Access Control for Smart Objects Access Control for Smart Objects - - PowerPoint PPT Presentation

access control for smart objects access control for smart
SMART_READER_LITE
LIVE PREVIEW

Access Control for Smart Objects Access Control for Smart Objects - - PowerPoint PPT Presentation

IAB Workshop on Smart Object Security Paris, March 2012 Access Control for Smart Objects Access Control for Smart Objects Jan Janak, Hyunwoo Nam, Henning Schulzrinne I R T Columbia University Internet Real-Time Laboratory This work is


slide-1
SLIDE 1

Access Control for Smart Objects Access Control for Smart Objects

I R T

Jan Janak, Hyunwoo Nam, Henning Schulzrinne

IAB Workshop on Smart Object Security Paris, March 2012 Internet Real-Time Laboratory Columbia University

This work is sponsored by AT&T Research.

slide-2
SLIDE 2

Office Automation with Smart Objects

  • Multiple controllers
  • Need to specify and

enforce policy

  • A variety of inputs
  • Provide reasonable

default policies for SO

id==“irt_switch” or location==“irt_lab” or (action==“OFF” and app==“SECE”) or Group==“Facilities” Overhead Light Policy:

slide-3
SLIDE 3

Initial System Architecture

  • Controllers sends requests with a set of attributes
  • PEP verifies attribute values and signs the request.
  • Policy documents specify conditions and required attributes.
  • Each Smart Object type has a default policy that can be overridden.
slide-4
SLIDE 4

What Makes it Complicated?

  • Lights
  • Motion detectors
  • Door locks
  • Wall sockets
  • Towel dispensers
  • Fire alarm buttons
  • Elevator controls
  • Phones
  • Indoor location
  • Identity
  • Date and time
  • Proximity
  • Geo-location
  • Effort (press 3x)
  • Result of a vote
  • Current state of SO
  • Organizational role
  • Randomness

SO Candidates Policy Inputs

slide-5
SLIDE 5

Open Questions

  • How do we describe and enforce access

restrictions applied to Smart Objects?

  • What protocols can we use to implement

attribute-based access control?

  • Mapping of credentials to CoAP/HTTP

requests?

  • Where is policy enforced? How do SOs learn

the outcome?

  • Default policy from SO manufacturers?