An Overview of Risk Estimation Techniques in Risk-based Access Control for the Internet of Things <s> RISK ESTIMATION TECHNIQUE FOR THE IoT <s> We examine the use of Federated Identity andAccess Management (FIAM) approaches for the Internet ofThings (IoT). We look at specific challenges that devices, sensorsand actuators have, and look for approaches to address them.OAuth is a widely deployed protocol -- built on top of HTTP -- forapplying FIAM to Web systems. We explore the use of OAuth forIoT systems that instead use the lightweight MQTT 3.1 protocol.In order to evaluate this area, we built a prototype that usesOAuth 2.0 to enable access control to information distributed viaMQTT. We evaluate the results of this prototyping activity, andassess the strengths and weaknesses of this approach, and thebenefits of using the FIAM approaches with IoT and Machine toMachine (M2M) scenarios. Finally we outline areas for furtherresearch. <s> BIB001 </s> An Overview of Risk Estimation Techniques in Risk-based Access Control for the Internet of Things <s> RISK ESTIMATION TECHNIQUE FOR THE IoT <s> Abstract The increase in Internet-connected physical devices offers new possibilities and opportunities. This Internet of Things (IoT) fosters the development of new platforms, services and applications that connect the physical world (represented by physical objects) to the virtual world (represented by the Internet). The work presented here proposes a study of role and attribute-based access control models that tackle the security concerns of our already developed data sharing framework. The framework introduced a formal theoretical model, the IOTCollab domain specific language, and an integrated development environment that implements this model. We have extended this framework by completing the formal theoretical model with access control capabilities. <s> BIB002
The distributed and dynamic nature of the IoT system demands many requirements that should be taken into consideration when choosing the appropriate risk estimation technique of the risk-based access control model for the IoT system. These requirements include:  Dynamic interaction: The access control model required for the IoT should not be static and predefined. It should be adjustable, predictable, and specified in a dynamic and continuous way by considering context changing during the access control process BIB001 . Hence, the risk estimation technique should have the ability to adapt to environment changes and uses realtime contextual information.  Scalability: The IoT system connects billions of devices. The increasing rate of newly connected objects should be taken into consideration when selecting the risk estimation technique. Also, the performance should not be affected.  Limited resources: The resources associated with IoT devices such as energy, memory, and processing power are limited due to the small size of these devices BIB002 . Therefore, the risk estimation technique should support efficient solutions.  Data availability: In order to accurately calculate the risk associated with a particular factor, data is needed. Once real world data is collected, it can be used in various probability distributions to calculate a much more accurate risk value. So the availability of the proper data will allow to analytically determine the appropriate risk estimation technique for the IoT.