Authorizations in Cloud-Based Internet of Things: Current Trends and Use Cases

Abstract

With the advancement of the Internet and technology, the Internet of Things (IoT) has gained significant momentum in recent years. There is rapid growth in the number of smart IoT devices and IoT applications. These devices and applications primarily gather, store, and share user data. However, the IoT devices have limited resources, such as storage, power, and computation. Cloud Computing enables IoT to leverage its unlimited capabilities, such as storage, computation, and analytics. Today, Cloud and IoT have become parallels and move together to form a Cloud-Enabled IoT architecture. This diverse and dynamic Cloud-IoT architecture, where IoT devices connect and disconnect on the fly and share data for analysis and computation with the Cloud raises many security and privacy concerns and broadens the attack surface. For example, in a government organization with high security and data privacy risk, there has to be a secure access control mechanism in place to ensure authorized access to data and resources. In this paper, we discuss the state-of-art of authorization mechanisms in Cloud- Enabled IoT architecture. We present two use cases - A Smart Home use case, and A Smart University Parking use case, to discuss various access control and authorization requirements in Cloud-Based IoT. We then propose an Attribute-Based Access Control (ABAC), a flexible access control approach, to address these access control requirements in the Cloud-Based IoT architecture, mainly in the context of presented use cases.