Permissions are highly sensitive in Internet-of-Things (IoT) applications, as IoT devices collect our personal data and control the safety of our environment. Rather than simply granting permissions, further constraints shall be imposed on permission usage so as to realize the Principle of Least Privilege. Since IoT devices are physically embedded, they are often accessed in a particular sequence based on their relative physical positions. Monitoring if such sequencing constraints are honoured when IoT devices are accessed provides a means to fence off malicious accesses. This paper proposes a history-based capability system, HCAP, for enforcing permission sequencing constraints in a distributed authorization environment. We formally establish the security guarantees of HCAP, and empirically evaluate its performance.
HCAP is an extension of ICAP @cite_36 in order to enforce HBAC policies. While an ICAP capability carries the list of granted permissions, an HCAP capability carries a partial specification of an SA, which we call an SA fragment. In the degenerate case when the SA has only one state, an HCAP capability is structurally equivalent to an ICAP capability. Another point of comparison concerns the exceptions. Exceptions are created in ICAP when the authorization server informs the resource server of capability revocations. In HCAP, an exception is created when the resource server exercises a permission that leads to SA state transition, thereby invalidating an existing capability. In addition, HCAP exceptions are much more complex: each exception chronicles the history of SA state transition, rather than a single event of revocation.
@cite_36
1928533667
The author presents the design of an identity-based capability protection system called ICAP, which is aimed at a distributed system in a network environment. The semantics of traditional capabilities are modified to incorporate subject identities. This enables the monitoring, mediating, and recording of capability propagations to enforce security policies. It also supports administrative activities such as traceability. The author has developed an exception-list approach to achieve rapid revocation and the idea of capability propagation trees for complete revocation. Compared with existing capability system designs, ICAP requires much less storage and has the potential of lower cost and better real-time performance. The author proposes to expand R.Y. Kain and C.E. Landwehr's (1987) design taxonomy of capability-based systems to cover a wider range of designs. >