Access control framework for API-enabled devices in smart buildings
Syafril Bandara, Takeshi Yashiro, Noboru Koshizuka, Ken Sakamura · 2016
With the rapid advances of Internet of Things (IoT) technologies in recent years, more devices around us are becoming connected to the Internet. Such devices are often equipped with web API, which allows them to work as a whole in smart buildings or cities, not as a standalone object that conventional devices used to be. In order to make these device API practical, security cannot be disregarded because the impact of a security breach in physical objects tends to be larger, as it directly affects the physical environment we live in. However, enforcing security for such devices is challenging, because it may consist of heterogeneous devices including those with limited resources. Additionally, devices in smart building environment may be attached or removed at any time dynamically. In order to fill up this gap, we present an access control framework for API-enabled devices in smart buildings. To accommodate a dynamic environment in smart buildings, we split security manager as a third party in the system. Complex security computations are delegated to the security manager so that resource-constrained devices can be securely handled as well in our framework. To guarantee only authorized user can access the device, the device is forced to ask security manager to evaluate requests. The proposed framework is implemented in the real smart building, which consists of more than 300 devices and its performance is evaluated by conducting a various of experiments. The average of response time has less than 0.1 seconds, which indicates that the proposed framework is reasonable to be practically used in a real smart building.