An ABAC Framework fot IoT Applications, Utilizing the OSASIS XACML Standard

master's thesis

• Author: Vedran Semenski
• Mentor: Óscar Pereira (mentor); ISVU oznaka: OP013
• Committee member: André Ventura da Cruz Marnoto Zúquete (član povjerenstva); ISVU oznaka: AZ025
• Committee member: Miguel Filipe Leitao Pardal (član povjerenstva); ISVU oznaka: MP326
• Committee member: Óscar Mortágua Pereira (član povjerenstva); ISVU oznaka: OP013
• Granter: University of Zagreb; Faculty of Electrical Engineering and Computing; Zagreb
• Defense date and country: 2015-07-13, Croatia
• Scientific / art field, discipline and subdiscipline: TECHNICAL SCIENCES; Computing

Abstract

IoT (eng. Internet of Things) je područje koje puno obećava i iako već ima mnogo zadovoljavajućih rješenja, sigurnost je ostala veliki problem. Među sigurnosnim aspektima, u ovom radu naglašavamo kontrolu pristupa (eng. Access Control). Ona je jedan od mogućih načina osiguravanja sigurnosti na način da se zahtjevi (eng. requests) za pristup resursima (eng. resource) ocjene, njihova valjanost provjeri i odbijaju u slučaju da pristup nije dozvoljen. Na taj način se osigurava povjerljivim resursima. Kontrola pristupa je rok pojam koji sadržava mnogo metodologija od kojih su najznačajnije: IBAC - Konrola Pristupa Bazirana na Identitetu (eng. Identity Based Access Control), RBAC - Konrola Pristupa Bazirana na Ulozi (eng. Role Based Access Control) and ABAC - Konrola Pristupa Bazirana na Atributima (eng. Attribute Based Access Control). U ovom radu koristiti će se ABAC zato što pruža veću fleksibilnost od IBAC-a i RBAC-a. Također zbog veoma prilagodljive prirode, pruža dugovječnost i manje potrebe za održavanjem. OASIS (eng. Organization for the Advancement of Structured Information Standards) je razvio i objavio XACML (eXtensible Access Control Markup Language) standard koji definira jezik za pisanje i definiranje zahtjeva i pravila (eng. policy) i procesa ocjenjivanja zahtjeva naspram setova definiranih pravila u svrhu primjene Kontrole Pristupa na resursima. Standard je napravljen tako da je su zahtjevi i pravila čitljivi za ljude a opet imaju dobro definiranu strukturu kako bi mogli biti precizno ocjenjeni. Standard koristi ABAC. Ovaj rad je usmjeren na stvaranje sigurnosne platforme koja koristi ABAC i XACML standard i koja bi mogla biti korištena od strane drugih sustava za primjenu kontrole pristupa. Također pruža mogućnost definiranja preciznih i fino zrnatih pravila i zahtjeva za preciznije ocjenjivanje i stoga višu razinu sigurnosti. Primarni korisnički scenarij su velike IoT aplikacije kao na primjer Pametni Grad (eng. Smart City) tip aplikacije koji obuhvaćaju: pametno nadziranje i kontrolu prometa, korištenje i potrošnju energije, komunalnih usluga, nadziranje osobnog zdravlja itd. Ove aplikacije koriste i obrađuju velike količine podataka (Big Data) koje mogu biti privatni ili povjerljivi. Veliki broj nerelacijskih NoSQL (eng. Not Only SQL) rješenja postoji koji rješavaju probleme količine, ali sigurnost je još uvijek problem. Ovaj rad će koristiti dvije NoSQL baze podataka.
Redis baza podataka koja spada u ključ-vrijednost (eng. key-value) tip NoSQL baze za spremanje pravila i Cassandra koja spada u NoSQL baze podataka temeljene na matricama (engl. wide-column databases) za spremanje podataka sa senzora i spremanje dodatnih atributa tokom testiranja.

Abstract (english)

IoT (Internet of Things) is an area which offers great opportunities and although a lot of issues already have satisfactory solutions, security has remained somewhat unaddressed and remains to be a big issue. Among the security aspects, we emphasize access control. Access Control is a way of enforcing security that involves evaluating requests for accessing resources and denies access if it is unauthorised, therefore providing security for vulnerable resources. Access Control is a broad term that consists of several methodologies of which the most significant are: IBAC (Identity Based Access Control), RBAC (Role Based Access Control) and ABAC (Attribute Based Access Control). In this work ABAC will be used as it offers the most flexibility compared to IBAC and RBAC. Also, because of ABAC's adaptive nature, it offers longevity and lower maintenance requirements. OASIS (Organization for the Advancement of Structured Information Standards) developed the XACML (eXtensible Access Control Markup Language) standard for writing/defining requests and policies and the evaluation of the requests over sets of policies for the purpose of enforcing access control over resources. It is defined so the requests and policies are readable by humans but also have a well defined structure allowing for precise evaluation. The standard uses ABAC. This work aims to create a security framework that utilizes ABAC and the XACML standard so that it can be used by other systems and enforce access control over resources that need to be protected by allowing access only to authorised subjects. It will also allow for fine grained defining of rules and requests for more precise evaluation and therefore a greater level of security. The primary use-case scenarios are large IoT applications such as Smart City applications including: smart traffic monitoring, energy and utility consumption, personal healthcare monitoring, etc. These applications deal with large quantities (Big Data) of confidential and/or personal data. A number of NoSQL (Not Only SQL) solutions exist for solving the problem of volume but security is still an issue. This work will use two NoSQL databases. A key-value database (Redis) for the storing of policies and a wide-column database (Cassandra) for storing sensor data and additional attribute data during testing.

• Keywords: Kontrola Pristupa; ABAC; XACML; IoT; Big Data; NoSQL; XML; JSON; SMARTIE; Pametni Grad; M2M; Sigurnost Informacija
• Keywords (english): Access Control; ABAC; XACML; IoT; Big Data; NoSQL; XML; JSON; SMARTIE; Smart City; M2M; Information Security
• Language: english
• URN:NBN: urn:nbn:hr:168:100409
• Study programme: Title: Computing; Study programme type: university; Study level: graduate; Academic / professional title: magistar/magistra inženjer/inženjerka računarstva (magistar/magistra inženjer/inženjerka računarstva)
• Type of resource: Text
• File origin: Born digital
• Access conditions: Closed access
• Created on: 2019-03-19 18:49:14