Domenico Rotondi

A capability-based security approach to manage access control in the Internet of Things

Abstract Resource and information protection plays a relevant role in distributed systems like the ones present in the Internet of Things (IoT). Authorization frameworks like RBAC and ABAC do not provide scalable, manageable, effective, and efficient mechanisms to support distributed systems with many interacting services and are not able to effectively support the dynamicity and scaling needs of IoT contexts that envisage a potentially unbound number of sensors, actuators and related resources, services and subjects, as well as a more relevance of short-lived, unplanned and dynamic interaction patterns. Furthermore, as more end-users start using smart devices (e.g. smart phones, smart home appliances, etc.) the need to have more scalable, manageable, understandable and easy to use access control mechanisms increases. This paper describes a capability based access control system that enterprises, or even individuals, can use to manage their own access control processes to services and information. The proposed mechanism supports rights delegation and a more sophisticated access control customization. The proposed approach is being developed within the European FP7 IoT@Work project to manage access control to some of the project’s services deployed in the shop floor.

IoT Access Control Issues: A Capability Based Approach

Resource and information protection plays a relevant role in distributed systems. Most of the currently proposed authorization frameworks do not provide scalable, manageable, effective, and efficient mechanisms to support distributed systems with many interacting services. The advent of IoT will further increase the need for scalable and manageable solutions able to face the potentially unbound number of sensors, actuators and related resources, services and subjects. This is even more relevant if we take into account that IoT environments can envisage not only a greater number of resources to manage, but also a substantial increase of the interaction dynamics. This paper presents a capability based access control system that enterprises, or even individuals, can use to manage their own access control processes to services and information. The proposed mechanism supports rights delegation and a more sophisticated access control customization. The proposed approach is being developed within the European FP7 IoT@Work project to manage access control for some of the projects services deployed in the shop floor.

Agile manufacturing: General challenges and an IoT@Work perspective

This paper describes the potential impact of the Internet of Things (IoT) technologies and architecture on factory automation. Whereas, IoT use cases range from intelligent infrastructure and smart cities to health care and shopping assistants, it is important to note that factory automation could benefit as well from an IoT approach. In this paper, we argue that there will not be one IoT but many IoTs that could differ in the type of infrastructure they are running or applications they support. In IoT@Work we focus on the potential of making manufacturing environments more agile and flexible. We explain how the IoT-centric architecture for manufacturing also needs a deep understanding of the manufacturing system and its state today. We, therefore, do a reverse engineering based on the requirements and the description of the agility expected in the automation system itself.

IoT@Work automation middleware system design and architecture

The industrial sector is being impacted by the Internet of Things due to the increasing availability of computing and communication capabilities in a wide range of devices and equipment deployed in the shop floor. This requires substantial architectural and functional improvements in order to actually manage and exploit the potential of such smart components. The EU FP7 IoT@Work project aims at addressing the issues of Plug&Work configuration and self-management features in automation systems. This paper focuses on presenting the architecture and the main features of the IoT@Work Event Notification Service (ENS) middleware that is used to support an event-driven communication paradigm among devices and services, both inside and outside the factory plant.

Applicability of security metrics for adaptive security management in a universal banking hub system

Banking applications require a high standard of security, resilience and adaptation. The results presented here were obtained from a case study of the deployment of the security metrics-driven adaptive security solutions of a distributed middleware in the context of monetary transfers. The focus of this study is on the analysis of the applicability of security metrics for adaptive authentication, authorization, and end-to-end confidentiality, and the applicability of trust metrics.

Innovations and Advances in Adaptive Secure Message Oriented Middleware

Increasing requirements for the resilience, security, adaptation, intelligence and scalability of complex business critical systems have set new challenges for system developers and application designers. Messaging infrastructures are often used to implement systems of this type. We provide an overview of the main advances in the adaptive security, security metrics, vulnerability discovery, anomaly detection and authentication solutions of the GEMOM (Genetic Message Oriented Secure Middleware) research project and discuss exploitation possibilities.

Advanced Services for Supply Chain Design Processes in Collaborative Networks

Design and production of small series for specific customer target groups in collaborative networks can help companies to increase their competitiveness. This paper aims to describe a new framework of services for collaborative networking for on-demand productions. After describing the business processes that need to be supported by innovative tools for partner search and collaborative production planning, we describe the developed services and how they are integrated to ease the communication between different activities.

A digital envelope approach using attribute-based encryption for secure data exchange in IoT scenarios

The inclusion of the Big Data paradigm in our everyday life is giving rise to different IoT scenarios in which there is a continuous sensitive data sharing (e.g., remote healthcare or domestic automation). For such scenarios, the protection of such data is a key challenge to achieve the acceptance, by the end users, of new services and systems oriented to these scenarios. In order to address this issue, this work presents a novel approach combining the efficiency of symmetric cryptography and the flexibility and fine granularity of attribute-based cryptography, with the aim of carrying out secure information exchanges among different entities that make up this new IoT context.

Semantics and KPIs to improve partner selection for small series production

This paper describes an on-going research and development activity to implement a semantic-based Partner Search service for supporting companies in a supply chain network configuration as one of the key elements of a comprehensive architecture with the aim of supporting collaborative design, planning and manufacturing for highly customised goods. The Partner Search service is the module in charge of managing and improving the manufacturers knowledge about its, even potential, supply chains. This service, therefore, has to support the manufacturer in managing information, based on capabilities and performance, about past and present partners, as well as in identifying new potential suppliers. The service is useful especially to develop effective partnerships when producing small batches, where it is necessary to have a reduced and easily manageable supply base.

Advances in Adaptive Secure Message‐Oriented Middleware for Distributed Business‐Critical Systems

Distributed business‐critical systems are often implemented using distributed messaging infrastructures with increasingly stringent requirements with regard to resilience, security, adaptability, intelligence and scalability. Current systems have limited ability in meeting these requirements. This paper describes advances in adaptive security, security metrics, anomaly detection and resilience, and authentication architecture in such distributed messaging systems.