Abstract
As a direct consequence of the rapid development of wireless sensor networks, smart gadgets, and traditional information and communication technologies, there has been a considerable rise in the utilization of applications and services connected to the Internet of Things (IoT) in our day-to-day lives. This has led to an increase in the importance that the IoT has been given. The Internet of Things processes large amounts of data. This data may be very sensitive since it may contain highly personal information such as a person’s health, finances, location, and other highly sensitive details. In order to implement fine-grained security management in the internet of things, an efficient access control system is required. Access control for the Internet of Things is considered in a number of suggestions; nevertheless, the development of blockchain-based solutions for IoT access control receives relatively little attention at this time. In this post, we take a look at some recent advances and essential needs for blockchain-based solutions for managing access to the Internet of Things. We highlight a few features controlling access to the Internet of Things, such as decentralized control, secure storage, and the ability to exchange information in a trustless manner. These include both the advantages and the constraints of this technology. In conclusion, we suggest some possible routes for further research on how to incorporate blockchain technology with IoT access control in an efficient and effective way.
Introduction
In an IoT system, the number of devices, apps, users, and services that are linked with them may reach vast proportions [1]. It is estimated that there will be a total of 50 billion intelligent devices connected to the internet by the time the year 2022 comes to a close. In actuality, this will lead to an increase in the usual number of connected devices and Internet connections seen inside a single household. In addition to this, it is expected that the annual traffic around the globe will reach 3.3 ZB (zettabytes) per year by the end of 2021 [2]. The proliferation of different Internet of Things applications may result in enhanced user experiences, better services, and lower overall application costs; nevertheless, these benefits come at the expense of severe security risks [3, 4, 5]. The problem of access control is of the utmost importance [6] in relation to the Internet of Things (IoT), among other potential security risks. Access control is a security technique that enables reliable access to resources only for authorized entities that are managed by a set of rules governing access control. This kind of control is also known as authorization control. It restricts who (for example, an entity) may access or what (for example, a resource) can be accessed under particular circumstances by imposing a selective restriction on access [7].
In the Internet of Things, the increased susceptibility of the device to network assaults is caused by its small and portable form factor, low battery life, and slow processing speed. The underlying reason for this growing vulnerability is that resource-constrained IoT devices cannot directly implement well-established classical security methods [8]. This is the main cause of the problem. In addition, it is hard to centrally specify in advance a full set of access control rules for both the users and the devices in IoT networks because of the number and diversity of devices that are present in IoT networks. This makes it difficult to regulate who has access to what on the network.
There are several advantages associated with the decentralized approach [9]. To begin, the design is applicable even in non-interconnected managerial domains. Therefore, every managerial domain has the flexibility to administer the Internet of Things devices while the rules in the blockchain continue to enforce access control laws. Second, our approach allows for the simultaneous management of several managers, each of whom has the ability to access and alter the access control rules of an Internet of Things device simultaneously. Since Internet of Things devices do not obtain management information directly from the managers, restricted managers are able to easily administer a number of Internet of Things devices simultaneously. This makes managing multiple IoT devices simpler. Constrained managers, on the other hand, do not have to be continuously linked to the system, which results in energy savings for the system. Fourthly, cross-platform communication is enabled thanks to the interaction between managers and IoT devices that takes place via the blockchain network.
Figure 1 depicts the general architecture of the IoT in its entirety. Smart devices and sensors that are linked to the Internet of Things are physically installed in the right places so that an application or service that relies on the Internet of Things may be carried out. For instance, in a smart home IoT network, smart home appliances are put all around the house in different locations, and the users of the smart home have access to the services provided by this smart home equipment. As can be seen in the figures, intelligent devices that are installed in various target domains become components of many applications, like smart transportation, smart healthcare, smart grids, and so on. Every use case that was taken into consideration has its own gateway node that acts as the database repository. A gateway node is placed at various locations across the target area, and it is responsible for registering each individual smart device. Intelligent gadgets and sensors are responsible for gathering information and acquiring data from their surroundings.
Generic architecture of IoT.
After successfully authenticating one another, each of the smart devices has the capacity to interact with one another, as well as with other devices and the gateway node. The data collected from each device is sent to the gateway node that is geographically closest to it for further processing. The processed data, as well as the information that is saved, contribute to the decision-making process and assist in delivering user services. In addition, the data is saved on cloud servers that are located on the internet so that it may be accessed by users of the Internet of Things. On a wireless open channel, communication takes place between the various devices as well as between those devices and the gateway node.
The following is a condensed summary of the contributions that this work makes:
The fundamental contribution of this work is the proposal of an original architecture for securing an Internet of Things system that is based on blockchain technology. The method makes use of a multi-agent system and is predicated on the idea of decentralized access control. The concept makes use of a private blockchain that is structured in a hierarchical manner. In addition, our suggested solution makes use of mobile agent software, which has the potential to play a substantial role in reducing traffic overheads. We came up with a solution that is versatile, easy to implement, and lightweight, and it can be used for a broad range of Internet of Things applications.
The second part of this research looks at the access control architecture that is already in place for the internet of things. This section will provide a more in-depth explanation of blockchain technology and the applications that it has in the internet of things (IoT). The Related Works are described in Section 2. The Proposed Solution is discussed in length in Section 3. In Section 4, we examine and have a discussion about several Blockchain-based authorization methods. The last section of the paper is Section 7.
Authentication and Authorization (AC) refers [10] to the process of ensuring that communication rights and resource access are granted in accordance with all applicable security standards and laws. Access control methods, although the subject of substantial research and having been successfully implemented, do not quickly convert to an Internet of Things architecture owing to the complexity of those methods and their failure to fit IoT standards. Adopting, installing, and eventually becoming comfortable with a new solution all take a significant amount of time [11]. System administrators worldwide are facing an increasing challenge brought on by the proliferation of networked devices. As more and more Internet of Things devices of diverse sorts are being deployed, scalability has become an increasingly important characteristic for decentralized and distributed access control systems [12].
A blockchain is a kind of distributed ledger that stores user transactions in groupings that are referred to as blocks. These blocks are linked together to form a chain and include data that is encrypted using hashes (a kind of data security). As can be seen in Fig. 2, editing records is a laborious process because it relies on prior records. A league’s transactions are recorded in blocks, which also provide a hash of the previous block and a timestamp verifying its legitimacy. Image 2 Due to their interdependence, records are difficult to edit. Due to data security concerns, blockchain-stored information is immutable once it has been recorded [13]. Numerous papers have examined access control mechanisms. The contributions made by these survey publications as well as their limitations are outlined in Table 1, which may be seen below.
Maw et al. [14] created a taxonomy to classify access control models in WSN. Using this taxonomy, we can classify access control strategies as either role-based, cryptography-based, or privacy-preserving. Two additional measures were developed to facilitate comparison between the various access control methods. The efficiency with which the strategy is put into practice is the basis for the second measure. This involves things like extra processing time, power consumption, and memory requirements.
The contributions and limitations of related works
The contributions and limitations of related works
Components and fundamental structure of the blockchain.
Access control was the subject of research by Cai et al. [15] that looked at various models. They did a deeper analysis of each model by comparing it to others based on several criteria, such as security, confidentiality, authorization flexibility, minimal privilege, and role separation.
In the article [16], Rouhani and Deters dissect the flaws with the access control solutions that are already on the market and demonstrate how blockchain technology may solve these concerns. The authors also looked at the solutions’ application domains and blockchain platforms.
In their work [17], Riabi et al. divided the research into two categories: those that focused on transaction-based access control and those that focused on smart-contract-based access control. The comparison was made using solely blockchain features, such as transactions and smart contracts. Furthermore, the authors did not describe the implementation of blockchain technology during access control in any detail.
Patil et al. released a review article on blockchain-based authentication in the IoT [18]. In this post, we’ll look at some of the other ways that blockchain technology may be put to use in industries like healthcare, supply chains, and even VANETs.
A review of current blockchain-based access control techniques was provided by Hussain et al. in the article [19]. In order to categorize these answers, they divided them into two categories: In the first group, blockchain-based transactions serve as the basis for determining who has entry and who does not. The second one is on the application of smart contract technology to problems. In addition, the writers discuss both the good and bad elements of each solution while describing the degree of security offered by each option. In the course of conducting this survey, the implementation criteria were also taken into account.
A review of the advantages of blockchain-based access management and a comparison to existing research utilizing five criteria were offered in a recent study by Shantanu et al. [20]. The aforementioned capabilities included things like attribute management, scalability, resource management, permission enforcement, and access rights transfer. The authors conclude that more effort must be put into standards, policymaking, identity management, and trust administration.
In order to build an Internet of Things system with lightweight and decentralized access control security, the proposed method relies on a multi-agent system and employs a private blockchain. The suggested design, shown in Fig. 3, is a hierarchical implementation of the blockchain. A Local Blockchain Manager (LBCM) sits at the foundation of our proposed architecture, coordinating the activities of IoT devices. The proposed model is scalable, distributed, and device-constrained; it protects against a wide range of security threats, like single points of failure. In conclusion, our designed architecture is flexible enough to be used in many Internet of Things scenarios.
Proposed blockchain-based system.
The huge processing overheads necessary to solve cryptographic challenges like Proof of Stake (PoS) make it difficult to apply blockchain to IoT devices. The bitcoin market, however, is giving this technology more prominence. Each Blockchain Manager (BCM) in our suggested architecture is outfitted with a miner, a specialist online high-resource device. Within each Blockchain Manager (BCM), communications within and between BCMs are governed by a device called a miner. In addition, it is the responsibility of the BCM to add or delete IoT devices, and the BCM’s control over all internal and external transactions is enabled by its ownership of a policy header. In addition, each Blockchain Manager (BCM) has at their disposal roving agents for authentication, authorization, encryption and decryption, and signature verification. Because of their processing expenses, encryption and decryption techniques are not suitable for the limited resources of IoT devices.
Consensus mechanisms in public blockchains require time- and resource-intensive mining techniques like Proof of Work (PoW), which is relevant to our proposed solution. The consensus process in a public blockchain, for instance, is open to participation from any node in the network, making it feasible for transactions to be seen by the general public. This feature is undesirable for many corporate blockchain solutions because it raises the risk that sensitive data will be disclosed and the users’ privacy will be violated. In addition, the implications of a 51% assault are susceptible to being exploited on public blockchains. As a result, we make use of private blockchains, also known as permissioned blockchains, in conjunction with a lightweight consensus method in order to overcome the problems outlined above that are related to IoT resource limits. In permissioned blockchains, the mining operations are overseen by individuals who have been verified as legitimate and are closed off to the general public. In the following sections, we will show the primary components of the framework that has been suggested.
Any time two or more IoT gadgets, fog nodes, core fog nodes, or the cloud itself exchange data, this is called a transaction. Based on the activities they do, transactions may be categorized as “access,” “update,” “add,” “monitor,” and “remove.” The granting of read-only permission is related to the creation of an Access transaction by BCMs for the purpose of accessing data. The purpose of update transactions is to provide authorization for a device or node to read and write previously stored data. BCMs have read/write rights, allowing them to generate, add, remove, or Monitor transactions. BCMs may also monitor transactions. Add transactions are used in the process of adding a new Internet of Things device or node, while Remove transactions are used in the process of removing them. Monitor transactions are what are used to keep track of the information and status of IoT devices and nodes.
MAC policy
Mandatory Access Control, or MAC for short, is an improved method of security. Since only BCMs have access to the access control policy and can make changes to it, this may reduce the frequency with which security flaws are introduced. Secret, top secret, or confidential security clearances for subjects and secret, top secret, or confidential resource classifications for items are what combine to form a MAC.
The clearance levels of subjects and the categorization levels of objects are taken into consideration when making a decision about whether or not to give access to a request. When enforcing access control based on multilayer security policies, the Bell-LaPadula model compares the subject’s clearance to that of the object to determine whether or not the subject is allowed access. This comparison is made in accordance with the Bell-LaPadula model. Furthermore, it ensures that users do not have access to resources beyond the scope of their security clearance (as depicted in Fig. 4), thereby protecting user privacy.
Bell-LaPadula model.
Local Blockchain Managers (LBCMs), Fog Blockchain Managers (FBCMs), CoreFog Blockchain Managers (CFBCMs), and Cloud Blockchain Managers (CBCMs) are the four types of BCMs that make up our proposed system. These BCMs are responsible for managing all communications across all four levels. In addition, BCMs are accountable for establishing the policy for access control that will be enforced on all devices and nodes across all tiers. There are two types of headers for each blockchain block: the block header and the policy header. These headers include information about the block. Each transaction on the blockchain has a MAC policy that is included in the block structure of that transaction. Because the BCMs are equipped with a policy header, they have the ability to exercise control over the permissions associated with all transactions. However, only the most recently updated policy header at the very top of the block header in BCMs can be used to verify and make changes to policies, even though each block in a blockchain has its own policy header. According to the proposed procedure, the BCM stands in for the miner at each successive stratum. The BCM is the primary security element responsible for carrying out these three tasks (authentication, authorization, and auditing) for all other devices. Additionally, BCMs produce a pointer to the previous block when a new block is added to the blockchain, copy the policy from the previous block’s header to the new block, and finally attach the new block to the blockchain.
Software agent
The suggested system uses a software agent that works well because it is mobile, flexible, transparent, erratic, and can start and stop itself. Also, the software driver can help IoT devices with limited resources save money and resources when working with other machines. Each program agent in the suggested structure is described in the parts that follow.
Signature verification agent
The BCMs are where this mobile worker is. The agent needs assurance that a communication came from a certain sender and was not altered during the route. It doesn’t care about protected data. In LBCM, all we care about is making sure that the data hasn’t been changed so that IoT devices can trust each other using symmetric-key methods. So, we use a lightweight hashing method and proof bots that can work on IoT devices with limited resources.
Every LBCM layer transfer includes the sender’s hash value and shared secret key. The verification agent verifies the LBCM layer data by decrypting the message with the help of the shared secret key and comparing the received hash value to the generated one. Due to their increased computational capability, FBCM, CFBCM, and CBCM use digital signatures in Fig. 5. This approach includes the sender’s private key and a hash value from the original message. The verification agent first decrypts the data using the sender’s public key, and then compares the hash value to its own. The sender and message are authentic if both sets of numbers match.
Fog Blockchain Manager (FBCM), signing agent and verification agent.
This agent is in charge of checking a user’s credentials to make sure they are correct and legitimate. A shared secret key is required for every device and node. An Authentication Agent is included in every BCM miner, and its only purpose is to confirm that a user’s credentials are correct and genuine. The BCM miner at each tier is responsible for issuing a shared secret key, which is used by the Authentication Agent to verify the identity of IoT devices and nodes. Diffie-Hellman key exchange underpins the shared secret key. To protect their communications, the technology enables two people who have never met to generate a shared secret key via an unsecured route. The Diffie-Hellman key exchange technique may be used to produce the shared secret key between the parties.
When two Internet of Things devices or nodes in the same layer wish to interact with one another, the agent will first check to see whether it has the appropriate shared key. If, on the other hand, the IoT nodes are distributed over many levels, communication between the BCMs of each tier takes place via public-key cryptography. If their characteristics are found to be acceptable by the agent, then they will be able to interact and go to the next phase, which is the Authorization Agent. Based on the MAC policy, the Authorization Agent will determine which resources are accessible.
Authorization agent
After the requester has been authenticated, this agent is tasked with the responsibility of implementing access control rules and providing authorization privileges to the requester based on the requester’s digital identity (ID). This agent confirms the connected party’s identity with the Authentication Agent, even if the latter has already granted permission for the connection. Afterward, it checks the MAC policy that has been stored in the BCM to see if the user is authorized and if the resources that they have access to fall into a specific category. The most recent blockheader is used to determine which version of the MAC policy file the BCM miner will employ. This agent puts into practice the notion of the MAC policy, which determines the kind of authorization (read or write) based on the security classification level. In addition, the Authentication Agent will keep an eye on how the IoT devices and nodes are behaving. In addition, it keeps tabs on how well users are following the rules of the access control policy in order to determine, in accordance with the Bell-LaPadula model, the resources they are authorized to use.
Encryption and decryption agent
This mobile agent ensures that data is kept secret by ensuring that only authorized users and agents are able to view and comprehend the data. Although we presume that maintaining data secrecy between IoT devices in LBCM is not necessary, maintaining data confidentiality between any two BCMs is essential. All access control rules and data that are being communicated between BCMs may be encrypted and decrypted by the agent. This agent makes use of an asymmetric algorithm, sometimes known as public cryptography. The communication is encrypted using the recipient’s public key; only the recipient’s private key may decrypt it.
Figure 6 is a sequence diagram depicting the communication in response to a user’s request to modify resource data. We will show how a user may manipulate data inside our framework. A user requests modifications from the Authentication Agent. After that, the Authentication Agent checks the user’s credentials. A user in this situation has access to a private shared key. The user is given an identification card once the Authentication Agent has validated their identity by checking their key and confirming that they are who they say they are. The user then uses their ID to request the Authorization Agent, which executes the MAC procedure. It performs a check on the user’s MAC policy as well as the resource’s MAC policy. Access is given to the user in our scenario since the user is unable to read or write information more or less than its categorization level. The user must submit a request to the authorized resource in order to edit the data, and they are only able to carry out operations that are permitted by the MAC policy. Following the modification of the resource, an updated transaction that includes a revised value for the blockchain hash is sent to the LBCM. In the last step, the LBCM will submit an updated transaction to the Authorization Agent in order to inform them as well as change the hash value on the blockchain for the modified resource.
Diagram of the order in which Authentication and Authorization Agents are used.
Experimental setup
Python was used in the development of the permissioned blockchain-based secured cloud storage architecture, and further research was carried out to validate the system’s transactional latency, amount of time required, and efficiency. In order to establish that the blockchain-based cloud data transmission model is superior, an evaluation was conducted in which both the current methods and the newly developed ones were evaluated. The population size was set at 10, and the maximum number of iterations allowed was 100. These values were used in the model that was constructed. The suggested CCP-ABE was differentiated from other algorithms such as the “Whale Optimization Algorithm (WOA), Coronavirus Herd Immunity Optimization (CHIO), GOA and DHOA, and machine learning algorithms such as BIoTHR and EACMS.”
Convergence analysis
Figure 7 shows the results of a series of tests conducted using several already-existing methodologies to determine the convergence rate of the proposed model at progressively longer iterations. The suggested CCP-ABE-based EHR transmission paradigm guarantees a decreased ciphertext size, reduced computation costs, and reduced encryption costs by customizing the encrypted keys for encryption and decoding. This is shown when compared to the standard optimization strategies. At the 40th iteration, the improvement of the suggested model was found to be better than WOA-CCP-ABE, CHIO-CCPABE,GOA-CCP-ABE, and DHOA-CCP-ABE, respectively. As a result, it has been established that the HGHO-CCP-ABE-based architecture that was recommended has secured the data transmission of the cloud storage with higher performance.
Decryption time analysis
Figure 8 demonstrates that the investigated model, which is based on the heuristic CCP-ABE approach, achieves high levels of decryption efficiency. The comparisons and assessments between the algorithms and the various baseline methods are carried out here. The developed method suggests a short decryption time for retrieving health data, and the suggested model outperforms BIoTHR and EACMS by 11.67 percentage points and 13.6 percentage points, respectively.
Convergence study on a suggested blockchain-based safe cloud storage data model with permissions.
Decryption time “(a) different heuristic algorithms and (b) existing models”.
Access control mechanisms across a variety of Internet of Things applications have been the subject of in-depth research that has been carried out as part of this survey. An in-depth examination of Internet of Things applications, together with their security issues, feature needs, security threats, and countermeasures, is presented here. In addition, we go into more detail on blockchain technology, consensus processes, and its development in the Internet of Things. The research provides broad knowledge of how blockchain may protect Internet of Things apps from various risks. The decryption times of various heuristic algorithms and the existing models are compared, which shows the efficiency of the proposed system. This system has a good level of decryption efficiency. The proposed system has reduced computation costs and encryption costs by customizing the encrypted keys for encryption and decoding. In addition, in order to facilitate a deeper level of comprehension, we have divided the access control protocols into three categories: those that are certificate-based, those that do not need certificates, and those that are envisioned using blockchain technology. For each categorization, an in-depth assessment of some current systems and a comparative analysis of the costs of computing and transmission are presented. The mechanism of each access protocol is broken down in further detail for a broader perspective by expanding on the specifics of each use case. The readers will not only be able to comprehend the access method, but they will also be able to clear up any confusion about the use cases of IoT applications. In conclusion, the study identifies a few problematic areas and good future paths for research.