面向物联网的基于上下文和权能的访问控制架构

面向物联网的基于上下文和权能的访问控制架构 A Context-Aware Capability-Based Access Control Framework for the Internet of Things 沈海波 SHEN Haibo 1 first-author 刘少波 LIU Shaobo 2 广东第二师范学院计算机科学系 广东第二师范学院计算机科学系 Department of Computer Science,Guangdong University of Education Department of Computer Science,Guangdong University of Education 广东第二师范学院教育技术中心 广东第二师范学院教育技术中心 Education Technology Center,Guangdong University of Education Education Technology Center,Guangdong University of Education 针对物联网（Internet of Things,IoT）的安全和隐私问题,以及传统的访问控制方法不适应于IoT环境的现状,提出了一种分布式的基于上下文和权能的访问控制架构.该架构的授权决策过程由嵌入到设备中的授权决策模块PDP来实现,以达到分布式的授权目标;特别是权能令牌的特殊构造,不仅可方便实现基于设备上下文的访问控制,而且利用椭圆曲线密码体制来实现端到端的认证、完整性和不可抵赖性;消息传输机制采用更适合于物联网的受限应用协议CoAP（Constrained Application Protocol）.实验结果表明,该架构是可行的. Because of the security and privacy problem of the Internet of Things（IoT）,and the status of the traditional access control approaches not adapted to IoT environment,we proposed a distributed context-aware capabilitybased access control framework for IoT in this paper.In our proposed framework,devices themselves can make authorization decisions.Specifically,a capability token has been designed for CoAP（Constrained Application Protocol）resources,which is signed with the Elliptic Curve Cryptography（ECC）in order to carry out the access control based on devices local parameters and ensure end-to-end authentication,integrity and non-repudiation.We build the transport protocol upon the IETF CoAP which is specifically designed for constrained devices.In the end,the experiment results demonstrate the feasibility of the proposed framework. 物联网 基于权能的访问控制 上下文感知 椭圆曲线密码体制 受限应用协议 Internet of Things（IoT） capability-based access control context-aware elliptic curve cryptography（ECC） constrained application protocol（CoAP） 10.14188/j.1671-8836.2014.05.008 TN929.5;TP391.44 国家自然科学基金资助项目（62370186） 2014-05-01 2021-04-01 5 60