Abstract
Internet of Things (IoT) brings not only wide range of opportunities but also security and privacy concerns. Consisting of many connected devices used in a highly interactive way, one of the main security concerns in IoT is unauthorized access. Traditional access control models do not support dynamic and fine-grained access control policies. Attribute-Based Access Control (ABAC) model is usually considered the most satisfactory access control model for running IoT applications. In this paper, we propose to take into the user authentication matching score obtained from a biometric authentication system consideration during making access control decisions. We emphasize the need of fine-grained access control and suggest to create access control policies per functionality of the device instead of per device regarding to the least privilege principle of information security. We give full or partial permission to certain functionalities of the IoT devices based on the user's authentication matching score thus provide more fine-grained and powerful access control mechanism. We present an extended Attribute-Based Access Control model that includes the assurance level of user authentication in access control policies and partially or fully permit the request accordingly.
Original language | English |
---|---|
Title of host publication | 2020 International Conference on Information Security and Cryptology, ISCTURKEY 2020 - Proceedings |
Editors | Seref Sagiroglu, Sedat Akleylek, Ferruh Ozbudak, Yavuz Canbay |
Publisher | Institute of Electrical and Electronics Engineers Inc. |
Pages | 48-55 |
Number of pages | 8 |
ISBN (Electronic) | 9781665418638 |
DOIs | |
Publication status | Published - 3 Dec 2020 |
Externally published | Yes |
Event | 13th International Conference on Information Security and Cryptology, ISCTURKEY 2020 - Virtual, Ankara, Turkey Duration: 3 Dec 2020 → 4 Dec 2020 |
Publication series
Name | 2020 International Conference on Information Security and Cryptology, ISCTURKEY 2020 - Proceedings |
---|
Conference
Conference | 13th International Conference on Information Security and Cryptology, ISCTURKEY 2020 |
---|---|
Country/Territory | Turkey |
City | Virtual, Ankara |
Period | 3/12/20 → 4/12/20 |
Bibliographical note
Publisher Copyright:© 2020 IEEE.