Access control technologies are fundamental for addressing the security and privacy requirements of the Internet of Things (IoT). This paper proposes an access control solution for Constrained Application Protocol (CoAP)- based IoT services. The proposed solution considers a network of a single provider that interconnects various IoT endpoints. It leverages the Software-Defined Networking (SDN) paradigm and implements application aware policy enforcement at the network level. All operations are transparent to the IoT endpoints and no modifications are required to the IoT communication protocol. Furthermore, our solution is built on standard OpenFlow, hence it is realistic and it can be easily deployed to an existing network. We prove the feasibility of our solution through a proof of concept implementation using network emulation.

Introduction

Nowadays, many aspects of our life are controlled–or assisted–by cyber-physical systems. The so-called Internet of Things (IoT) is already used in many domains, including agriculture, patient monitoring, home automation, well-being, smart cities, and many others. The IoT is mainly composed of devices which may be deprived of computational power, continuous network connectivity, energy, or even physical security. Therefore, it comes as no surprise that applying security solutions in this environment is a challenging problem. In this paper, we focus on a particular aspect of security, that is access control. We consider the case of a network of a single operator that interconnects various IoT devices. These devices provide resources or actuation services, and can be accessed using the Constrained Application Protocol(CoAP) [1]. In order to motivate our solution, we consider the use case of a smart city management system. This system is composed of IoT sensors (e.g., temperature sensors) and actuators (e.g., switches). Our goal is to enable system administrators to define context-aware access control policies that will mediate access to the IoT devices. More formally, we want to provide a Mandatory Access Control (MAC) solution where policies are centrally defined by the system administrators and cannot be modified or overridden by end users. An example of such policy, in our reference system, is the case of a switch that turns on and off street lights; in that case the system administrator could create an access control policy that defines that “street lights switches can be turned on after 8pm and turned off after 6am, and all operations should originate from the management center building”.