SentryIoTOAuth: um Provedor de Serviço de Autenticação e Autorização para Casas Inteligentes baseado no processo ACE-OAuth
Abstract
The Internet of Things(IoT) is present in many domains, among them the smart home. In this segment, most of the IoT applications perform cloud communication to offer various types of services for the devices. However, for the smart home scenario, through the ACE-OAuth framework, an authentication and authorization service can still be established in the LAN, making it easier to prevent cyber attacks. For this, the article presents the investigation of the proposal, the design and development of a prototype based on the ACE-OAuth framework. With this prototype in development it is intended that developers have a new practical understanding of the operation of new permission control trends for their applications.
References
Aragon, S. a. (2018). ACE of Spades in the IoT Security Game: A Flexible IPsec Security Profile for Access Control. 2018 IEEE Conference on Communications and Network Security (CNS).
Bormann, C. H. (Outubro de 2013). Concise Binary Object Representation (CBOR). Fonte: https://tools.ietf.org/html/rfc7049
Claeys, T. a. (2017). Securing Complex IoT Platforms with Token Based Access Control and Authenticated Key Establishment. International Workshop on Secure Internet of Things (SIoT).
DeLaOsa, J. (02 de Fevereiro de 2019). Japan Will Hack Into the Internet-Connected Devices of Its Own Citizens. Fonte: https://www.ecnmag.com/news/2019/02/japan-will-hack-internet-connected-devices-its-own-citizens
Demetriou, S. a. (2017). HanGuard: SDN-driven protection of smart home WiFi devices from malicious mobile apps. Proceedings of the 10th ACM Conference on Security and Privacy in Wireless and Mobile Networks.
Ed, D. H., & Microsoft. (October de 2012). The OAuth 2.0 Authorization Framework. Fonte: https://tools.ietf.org/html/rfc6749
Ed, L. S., Ed, S. G., Selander, G., Mani, M., & Kumar, S. (january de 2016). Use Cases for Authentication and Authorization. Fonte: https://tools.ietf.org/html/rfc7744
Fremantle, Aziz, P. a., & Benjamin. (2018). Cloud-based federated identity for the Internet of Things. Annals of Telecommunications.
He, W. a. (2018). Rethinking access control and authentication for the home internet of things (IoT). 27th USENIX Security Symposium (USENIX Security 18).
Jones, M., Microsoft, Wahlstroem, E., Erdtman, S., Spotify, A., H, T., & ARM. (05 de 2018). RFC 8392 -CBOR Web Token (CWT). Fonte: https://tools.ietf.org/html/rfc8392
Porciúncula, C. B. (2018). Authentication and Authorization for Constrained Environments (ACE) com Framework OAuth e Protocolo CoAP. Revista ComInG-Communications and Innovations Gazette.
Rescorla, E. M. (2012). Datagram Transport Layer Security Version 1.2. Fonte: https://tools.ietf.org/html/rfc6347
Schaad, J., & Cellars, A. (2017). CBOR Object Signing and Encryption (COSE). Fonte: https://tools.ietf.org/html/rfc8152
Sciancalepore, S. a. (2017). OAuth-IoT: An access control framework for the Internet of Things based on open standards. Computers and Communications (ISCC), 2017 IEEE Symposium on.
Seitz, L. G. (2016). Use Cases for Authentication and Authorization in Constrained Environments. Fonte: https://tools.ietf.org/html/rfc7744
Seitz, L. S. (2018). Authentication and Authorization for Constrained Environments (ACE) using the OAuth 2.0 Framework (ACE-OAuth) draft-ietf-ace-oauth-authz-17. Fonte: https://tools.ietf.org/html/draft-ietf-ace-oauth-authz-16
Seitz, L., RISE, Selander, G., Ericsson, Wahlstroem, E., Erdtman, S., . . . Arm, L. (31 de Janeiro de 2019).
Authentication and Authorization for Constrained Environments (ACE) using the OAuth 2.0 Framework (ACE-OAuth). Fonte: https://www.ietf.org/id/draft-ietf-ace-oauth-authz-19.txt
Selander, G., Mattsson, J., Palombini, F., Ericsson, A., Seitz, L., & RISE, S. (31 de Agosto de 2018). Object Security for Constrained RESTful Environments (OSCORE) draft-ietf-core-object-security-15. Fonte: https://tools.ietf.org/html/draft-ietf-core-object-security-15
Shelby, Z. H. (2014). The Constrained Application Protocol (CoAP). Fonte: https://tools.ietf.org/html/rfc7252
Shelby, Z., Hartke, K., Bormann, C., ARM, & TZI, U. B. (junho de 2014). The Constrained Application Protocol (CoAP). Fonte: https://tools.ietf.org/html/rfc7252
Styger, E. (2011). Introduction toSecurity and TLS.
Tschofenig, H. (s.d.). Analyzing the IETF ACE-OAuth Protocol. Acesso em 2018, disponível em http://st.fbk.eu/sites/st.fbk.eu/files/osw2018-ace.pdf WG-ACE. (2019). Authentication and Authorization for Constrained Environments (ACE). Fonte: https://datatracker.ietf.org/wg/ace/about/
WG-NET. (19 de Maio de 2018). State-of-the-Art and Challenges for the Internet of Things Security. Fonte: https://tools.ietf.org/html/draft-irtf-t2trg-iot-seccons-15
Bormann, C. H. (Outubro de 2013). Concise Binary Object Representation (CBOR). Fonte: https://tools.ietf.org/html/rfc7049
Claeys, T. a. (2017). Securing Complex IoT Platforms with Token Based Access Control and Authenticated Key Establishment. International Workshop on Secure Internet of Things (SIoT).
DeLaOsa, J. (02 de Fevereiro de 2019). Japan Will Hack Into the Internet-Connected Devices of Its Own Citizens. Fonte: https://www.ecnmag.com/news/2019/02/japan-will-hack-internet-connected-devices-its-own-citizens
Demetriou, S. a. (2017). HanGuard: SDN-driven protection of smart home WiFi devices from malicious mobile apps. Proceedings of the 10th ACM Conference on Security and Privacy in Wireless and Mobile Networks.
Ed, D. H., & Microsoft. (October de 2012). The OAuth 2.0 Authorization Framework. Fonte: https://tools.ietf.org/html/rfc6749
Ed, L. S., Ed, S. G., Selander, G., Mani, M., & Kumar, S. (january de 2016). Use Cases for Authentication and Authorization. Fonte: https://tools.ietf.org/html/rfc7744
Fremantle, Aziz, P. a., & Benjamin. (2018). Cloud-based federated identity for the Internet of Things. Annals of Telecommunications.
He, W. a. (2018). Rethinking access control and authentication for the home internet of things (IoT). 27th USENIX Security Symposium (USENIX Security 18).
Jones, M., Microsoft, Wahlstroem, E., Erdtman, S., Spotify, A., H, T., & ARM. (05 de 2018). RFC 8392 -CBOR Web Token (CWT). Fonte: https://tools.ietf.org/html/rfc8392
Porciúncula, C. B. (2018). Authentication and Authorization for Constrained Environments (ACE) com Framework OAuth e Protocolo CoAP. Revista ComInG-Communications and Innovations Gazette.
Rescorla, E. M. (2012). Datagram Transport Layer Security Version 1.2. Fonte: https://tools.ietf.org/html/rfc6347
Schaad, J., & Cellars, A. (2017). CBOR Object Signing and Encryption (COSE). Fonte: https://tools.ietf.org/html/rfc8152
Sciancalepore, S. a. (2017). OAuth-IoT: An access control framework for the Internet of Things based on open standards. Computers and Communications (ISCC), 2017 IEEE Symposium on.
Seitz, L. G. (2016). Use Cases for Authentication and Authorization in Constrained Environments. Fonte: https://tools.ietf.org/html/rfc7744
Seitz, L. S. (2018). Authentication and Authorization for Constrained Environments (ACE) using the OAuth 2.0 Framework (ACE-OAuth) draft-ietf-ace-oauth-authz-17. Fonte: https://tools.ietf.org/html/draft-ietf-ace-oauth-authz-16
Seitz, L., RISE, Selander, G., Ericsson, Wahlstroem, E., Erdtman, S., . . . Arm, L. (31 de Janeiro de 2019).
Authentication and Authorization for Constrained Environments (ACE) using the OAuth 2.0 Framework (ACE-OAuth). Fonte: https://www.ietf.org/id/draft-ietf-ace-oauth-authz-19.txt
Selander, G., Mattsson, J., Palombini, F., Ericsson, A., Seitz, L., & RISE, S. (31 de Agosto de 2018). Object Security for Constrained RESTful Environments (OSCORE) draft-ietf-core-object-security-15. Fonte: https://tools.ietf.org/html/draft-ietf-core-object-security-15
Shelby, Z. H. (2014). The Constrained Application Protocol (CoAP). Fonte: https://tools.ietf.org/html/rfc7252
Shelby, Z., Hartke, K., Bormann, C., ARM, & TZI, U. B. (junho de 2014). The Constrained Application Protocol (CoAP). Fonte: https://tools.ietf.org/html/rfc7252
Styger, E. (2011). Introduction toSecurity and TLS.
Tschofenig, H. (s.d.). Analyzing the IETF ACE-OAuth Protocol. Acesso em 2018, disponível em http://st.fbk.eu/sites/st.fbk.eu/files/osw2018-ace.pdf WG-ACE. (2019). Authentication and Authorization for Constrained Environments (ACE). Fonte: https://datatracker.ietf.org/wg/ace/about/
WG-NET. (19 de Maio de 2018). State-of-the-Art and Challenges for the Internet of Things Security. Fonte: https://tools.ietf.org/html/draft-irtf-t2trg-iot-seccons-15
Published
2019-05-06
How to Cite
ANDRADE, Richardson B. da S.; MONTEIRO, José A. Suruagy.
SentryIoTOAuth: um Provedor de Serviço de Autenticação e Autorização para Casas Inteligentes baseado no processo ACE-OAuth. In: DEMO SESSION - BRAZILIAN SYMPOSIUM ON COMPUTER NETWORKS AND DISTRIBUTED SYSTEMS (SBRC), 2. , 2019, Gramado.
Anais [...].
Porto Alegre: Sociedade Brasileira de Computação,
2019
.
p. 73-80.
ISSN 2177-9384.
DOI: https://doi.org/10.5753/sbrc_estendido.2019.7772.
