Federated Identity and Access Management for the Internet of Things

Abstract

We examine the use of Federated Identity andAccess Management (FIAM) approaches for the Internet ofThings (IoT). We look at specific challenges that devices, sensorsand actuators have, and look for approaches to address them.OAuth is a widely deployed protocol -- built on top of HTTP -- forapplying FIAM to Web systems. We explore the use of OAuth forIoT systems that instead use the lightweight MQTT 3.1 protocol.In order to evaluate this area, we built a prototype that usesOAuth 2.0 to enable access control to information distributed viaMQTT. We evaluate the results of this prototyping activity, andassess the strengths and weaknesses of this approach, and thebenefits of using the FIAM approaches with IoT and Machine toMachine (M2M) scenarios. Finally we outline areas for furtherresearch.