Context-Aware Access Control With IoTSEAR
IoTSEAR is a middleware for context-aware access control in IoT environments. Contextual data
(e.g. time, location, current activity, …) can improve the accuracy and usability of access
control systems, as authentication and authorization requirements can be precisely specified.
However, certain security requirements need to be enforced to use such data in access control
decision processes. In short, the data must be authentic, recent, and unforgeable. The
middleware handles the collection, processing and verification of the context information. The
access rules, i.e., the rules that specify who is allowed to do what under which circumstances
are specified in policies. IoTSEAR supports the PACCo policy language, which can be used to
express contextual access conditions as well as the security requirements for the used context
data. This way, the system can guarantee a specific level of trustworthiness regarding the used
context data. Finally, these security requirements can be tailored to the accompanying risk of
the action, i.e. critical actions can require strong guarantees, while these guarantees can be
relaxed for standard actions.
For example, a Location context gathered on, and signed by an employee’s smartphone might be
suitable to consider when deciding whether the employee can enter the office building (in
combination with an authentication proof, such as an RFID badge).
Furthermore, to access a confidential document, a Bluetooth beacon can provide proximity context
showing that the employee is in a particular room. In addition, it can be mandated that this
context is confirmed by the employee’s superior (requiring the superior to be in the same room).
Seminar content
Technical background information
- Introduction to context-aware access control
- Concepts behind the IoTSEAR middleware
IoTSEAR middleware
- Integrate the IoTSEAR middleware in an application
- Use context-aware policies to secure critical actions
- Test different policy configurations in a demo environment
