Delegated authenticated authorization in the life cycle of smart objects in the internet of things

Abstract

Equipping everyday objects with microprocessors opens up a new range of applications. These “smart” objects often have sensors and actuators that allow them to monitor their environment and interact with it. Interconnecting smart objects with the help of Internet protocols, thereby creating an Internet of Things, enables the devices to communicate with each other and their users. If smart objects are integrated into all aspects of everyday life, they will be entrusted with vast amounts of data. Due to limited hardware resources, smart objects are hard-pressed to use common security mechanisms. Also, their application scenarios differ from typical Web scenarios: smart objects often need to communicate unsupervised and must protect their user’s security objectives on their own.

To establish trust in the new applications, users must be in control of their smart objects, the data handled by them, and their effect on the physical world. This thesis aims at enabling smart objects to enforce their users’ security decisions and participate in the protection of data. To achieve this, we revisit the objectives and design of authentication and authorization solutions. The authenticated authorization model introduced in this thesis identifies the fundamental requirements for authorization and task delegation that effective security solutions must satisfy. From the fundamentals, we derive the tasks that an endpoint must at least be able to perform to communicate securely. The model thus assists solution designers in finding gaps and vulnerabilities in security specifications. It includes the protection of a security objective that was previously missing from the literature, the data destination verifiability; it is needed to avoid attacks that make endpoints believe they are the intended receiver of a message, such as man-in-the-middle attacks.

Based on our model, we develop the task delegation architectural style. It supports less powerful, constrained devices by coupling them with a less-constrained authorization manager, to which challenging authentication and authorization tasks are offloaded. We implement the architectural style with the Delegated CoAP Authenticated Authorization Framework (DCAF). As the, to the best of our knowledge, only protocol that implements a separate authorization manager for the client side, it supports unsupervised constrained clients as well as constrained servers, and facilitates RESTful communication across organization boundaries. DCAF’s design offers solutions for important problems such as secure key distribution, simplified time synchronization, and the revocation of authorization and authentication data. By coupling DCAF with common security solutions, smart objects can securely be integrated into the big Internet. Thus, DCAF enables a true Web of Things.