SentryIoTOAuth: um Provedor de Serviço de Autenticação e Autorização para Casas Inteligentes baseado no processo ACE-OAuth
Resumo
A Internet das Coisas (IoT) está presente em vários domínios, dentre eles o das casas inteligentes. Grande parte das aplicações de IoT realizam comunicação em nuvem para oferecer diversos tipos de serviços aos dispositivos. No entanto, para o cenário de casas inteligentes, por meio do framework ACE-OAuth, um serviço de autenticação e autorização pode ser estabelecido ainda na própria HAN, facilitando na prevenção contra ataques cibernéticos. Para isso, o artigo apresenta a investigação da proposta, a concepção e o desenvolvimento de um protótipo baseado no framework ACE-OAuth. Com esse protótipo, pretende-se que desenvolvedores tenham uma nova compreensão prática do funcionamento dos novos processos de controle de permissão em suas aplicações.
Referências
Aragon, S. a. (2018). ACE of Spades in the IoT Security Game: A Flexible IPsec Security Profile for Access Control. 2018 IEEE Conference on Communications and Network Security (CNS).
Bormann, C. H. (Outubro de 2013). Concise Binary Object Representation (CBOR). Fonte: https://tools.ietf.org/html/rfc7049
Claeys, T. a. (2017). Securing Complex IoT Platforms with Token Based Access Control and Authenticated Key Establishment. International Workshop on Secure Internet of Things (SIoT).
DeLaOsa, J. (02 de Fevereiro de 2019). Japan Will Hack Into the Internet-Connected Devices of Its Own Citizens. Fonte: https://www.ecnmag.com/news/2019/02/japan-will-hack-internet-connected-devices-its-own-citizens
Demetriou, S. a. (2017). HanGuard: SDN-driven protection of smart home WiFi devices from malicious mobile apps. Proceedings of the 10th ACM Conference on Security and Privacy in Wireless and Mobile Networks.
Ed, D. H., & Microsoft. (October de 2012). The OAuth 2.0 Authorization Framework. Fonte: https://tools.ietf.org/html/rfc6749
Ed, L. S., Ed, S. G., Selander, G., Mani, M., & Kumar, S. (january de 2016). Use Cases for Authentication and Authorization. Fonte: https://tools.ietf.org/html/rfc7744
Fremantle, Aziz, P. a., & Benjamin. (2018). Cloud-based federated identity for the Internet of Things. Annals of Telecommunications.
He, W. a. (2018). Rethinking access control and authentication for the home internet of things (IoT). 27th USENIX Security Symposium (USENIX Security 18).
Jones, M., Microsoft, Wahlstroem, E., Erdtman, S., Spotify, A., H, T., & ARM. (05 de 2018). RFC 8392 -CBOR Web Token (CWT). Fonte: https://tools.ietf.org/html/rfc8392
Porciúncula, C. B. (2018). Authentication and Authorization for Constrained Environments (ACE) com Framework OAuth e Protocolo CoAP. Revista ComInG-Communications and Innovations Gazette.
Rescorla, E. M. (2012). Datagram Transport Layer Security Version 1.2. Fonte: https://tools.ietf.org/html/rfc6347
Schaad, J., & Cellars, A. (2017). CBOR Object Signing and Encryption (COSE). Fonte: https://tools.ietf.org/html/rfc8152
Sciancalepore, S. a. (2017). OAuth-IoT: An access control framework for the Internet of Things based on open standards. Computers and Communications (ISCC), 2017 IEEE Symposium on.
Seitz, L. G. (2016). Use Cases for Authentication and Authorization in Constrained Environments. Fonte: https://tools.ietf.org/html/rfc7744
Seitz, L. S. (2018). Authentication and Authorization for Constrained Environments (ACE) using the OAuth 2.0 Framework (ACE-OAuth) draft-ietf-ace-oauth-authz-17. Fonte: https://tools.ietf.org/html/draft-ietf-ace-oauth-authz-16
Seitz, L., RISE, Selander, G., Ericsson, Wahlstroem, E., Erdtman, S., . . . Arm, L. (31 de Janeiro de 2019).
Authentication and Authorization for Constrained Environments (ACE) using the OAuth 2.0 Framework (ACE-OAuth). Fonte: https://www.ietf.org/id/draft-ietf-ace-oauth-authz-19.txt
Selander, G., Mattsson, J., Palombini, F., Ericsson, A., Seitz, L., & RISE, S. (31 de Agosto de 2018). Object Security for Constrained RESTful Environments (OSCORE) draft-ietf-core-object-security-15. Fonte: https://tools.ietf.org/html/draft-ietf-core-object-security-15
Shelby, Z. H. (2014). The Constrained Application Protocol (CoAP). Fonte: https://tools.ietf.org/html/rfc7252
Shelby, Z., Hartke, K., Bormann, C., ARM, & TZI, U. B. (junho de 2014). The Constrained Application Protocol (CoAP). Fonte: https://tools.ietf.org/html/rfc7252
Styger, E. (2011). Introduction toSecurity and TLS.
Tschofenig, H. (s.d.). Analyzing the IETF ACE-OAuth Protocol. Acesso em 2018, disponível em http://st.fbk.eu/sites/st.fbk.eu/files/osw2018-ace.pdf WG-ACE. (2019). Authentication and Authorization for Constrained Environments (ACE). Fonte: https://datatracker.ietf.org/wg/ace/about/
WG-NET. (19 de Maio de 2018). State-of-the-Art and Challenges for the Internet of Things Security. Fonte: https://tools.ietf.org/html/draft-irtf-t2trg-iot-seccons-15
Bormann, C. H. (Outubro de 2013). Concise Binary Object Representation (CBOR). Fonte: https://tools.ietf.org/html/rfc7049
Claeys, T. a. (2017). Securing Complex IoT Platforms with Token Based Access Control and Authenticated Key Establishment. International Workshop on Secure Internet of Things (SIoT).
DeLaOsa, J. (02 de Fevereiro de 2019). Japan Will Hack Into the Internet-Connected Devices of Its Own Citizens. Fonte: https://www.ecnmag.com/news/2019/02/japan-will-hack-internet-connected-devices-its-own-citizens
Demetriou, S. a. (2017). HanGuard: SDN-driven protection of smart home WiFi devices from malicious mobile apps. Proceedings of the 10th ACM Conference on Security and Privacy in Wireless and Mobile Networks.
Ed, D. H., & Microsoft. (October de 2012). The OAuth 2.0 Authorization Framework. Fonte: https://tools.ietf.org/html/rfc6749
Ed, L. S., Ed, S. G., Selander, G., Mani, M., & Kumar, S. (january de 2016). Use Cases for Authentication and Authorization. Fonte: https://tools.ietf.org/html/rfc7744
Fremantle, Aziz, P. a., & Benjamin. (2018). Cloud-based federated identity for the Internet of Things. Annals of Telecommunications.
He, W. a. (2018). Rethinking access control and authentication for the home internet of things (IoT). 27th USENIX Security Symposium (USENIX Security 18).
Jones, M., Microsoft, Wahlstroem, E., Erdtman, S., Spotify, A., H, T., & ARM. (05 de 2018). RFC 8392 -CBOR Web Token (CWT). Fonte: https://tools.ietf.org/html/rfc8392
Porciúncula, C. B. (2018). Authentication and Authorization for Constrained Environments (ACE) com Framework OAuth e Protocolo CoAP. Revista ComInG-Communications and Innovations Gazette.
Rescorla, E. M. (2012). Datagram Transport Layer Security Version 1.2. Fonte: https://tools.ietf.org/html/rfc6347
Schaad, J., & Cellars, A. (2017). CBOR Object Signing and Encryption (COSE). Fonte: https://tools.ietf.org/html/rfc8152
Sciancalepore, S. a. (2017). OAuth-IoT: An access control framework for the Internet of Things based on open standards. Computers and Communications (ISCC), 2017 IEEE Symposium on.
Seitz, L. G. (2016). Use Cases for Authentication and Authorization in Constrained Environments. Fonte: https://tools.ietf.org/html/rfc7744
Seitz, L. S. (2018). Authentication and Authorization for Constrained Environments (ACE) using the OAuth 2.0 Framework (ACE-OAuth) draft-ietf-ace-oauth-authz-17. Fonte: https://tools.ietf.org/html/draft-ietf-ace-oauth-authz-16
Seitz, L., RISE, Selander, G., Ericsson, Wahlstroem, E., Erdtman, S., . . . Arm, L. (31 de Janeiro de 2019).
Authentication and Authorization for Constrained Environments (ACE) using the OAuth 2.0 Framework (ACE-OAuth). Fonte: https://www.ietf.org/id/draft-ietf-ace-oauth-authz-19.txt
Selander, G., Mattsson, J., Palombini, F., Ericsson, A., Seitz, L., & RISE, S. (31 de Agosto de 2018). Object Security for Constrained RESTful Environments (OSCORE) draft-ietf-core-object-security-15. Fonte: https://tools.ietf.org/html/draft-ietf-core-object-security-15
Shelby, Z. H. (2014). The Constrained Application Protocol (CoAP). Fonte: https://tools.ietf.org/html/rfc7252
Shelby, Z., Hartke, K., Bormann, C., ARM, & TZI, U. B. (junho de 2014). The Constrained Application Protocol (CoAP). Fonte: https://tools.ietf.org/html/rfc7252
Styger, E. (2011). Introduction toSecurity and TLS.
Tschofenig, H. (s.d.). Analyzing the IETF ACE-OAuth Protocol. Acesso em 2018, disponível em http://st.fbk.eu/sites/st.fbk.eu/files/osw2018-ace.pdf WG-ACE. (2019). Authentication and Authorization for Constrained Environments (ACE). Fonte: https://datatracker.ietf.org/wg/ace/about/
WG-NET. (19 de Maio de 2018). State-of-the-Art and Challenges for the Internet of Things Security. Fonte: https://tools.ietf.org/html/draft-irtf-t2trg-iot-seccons-15
Publicado
06/05/2019
Como Citar
ANDRADE, Richardson B. da S.; MONTEIRO, José A. Suruagy.
SentryIoTOAuth: um Provedor de Serviço de Autenticação e Autorização para Casas Inteligentes baseado no processo ACE-OAuth. In: SALÃO DE FERRAMENTAS - SIMPÓSIO BRASILEIRO DE REDES DE COMPUTADORES E SISTEMAS DISTRIBUÍDOS (SBRC), 2. , 2019, Gramado.
Anais [...].
Porto Alegre: Sociedade Brasileira de Computação,
2019
.
p. 73-80.
ISSN 2177-9384.
DOI: https://doi.org/10.5753/sbrc_estendido.2019.7772.
