Work

Capabilities-based access control for IoT devices using Verifiable Credentials

Year: 2022

Type: conference-paper

Abstract: Capabilities-based access control is a promising paradigm that can handle the particularities of IoT systems. Nevertheless, existing systems are not interoperable and they have limitations, such as lack of proof of possession, inefficient revocation mechanisms, and reliance on trusted third parties. In this paper we overcome these limitations by designing and implementing a system that leverages Verifiable Credentials (VCs) to encode the access rights. Our solution specifies protocols for requesting and using VCs that can be mapped to OAuth 2.0, includes an efficient and privacy preserving proof of possession mechanism, and it supports revocation. We implement and evaluate our solution and we show that it can be directly used even by constrained devices.

Source: IEEE Security and Privacy Workshops (SPW)

DOI: 10.1109/spw54247.2022.9833873

Authors: Nikos Fotiou, Vasilios A. Siris, George C. Polyzos, Yki Kortesniemi, Dmitrij Lagutin

Institutions: Athens University of Economics and Business, Aalto University

Language: English

Topic: Access Control and Trust

Subfield: Sociology and Political Science

Field: Social Sciences

Domain: Social Sciences

Open Access status: green

Funder: European Commission

Awards: Next Generation IoT as part of Next Generation Internet, European Self Sovereign Identity Framework Laboratory