CAPLets: Resource Aware, Capability-Based Access Control for IoT
CAPLets: Resource Aware, Capability-Based Access Control for IoT
复制标题
DOI：
10.1145/3453142.3491289
复制
发表时间：
2021-12
期刊：
影响因子：
--
通讯作者：
F. Bakir;C. Krintz;R. Wolski
中科院分区：
文献类型：
--
作者：
F. Bakir;C. Krintz;R. Wolski
我们提出了CAPLETS，这是一种授权机制，它扩展了基于功能的安全性，以支持多规模(传感器、边缘、云)物联网部署的细粒度访问控制。为了实现这一点，CAPLETS使用强大的加密结构来提供完整性，同时保持资源受限系统的计算效率。此外，CAPLETS使用动态的、用户定义的约束来增强功能，以描述任意访问控制策略。我们引入了一个特定于应用程序的图灵完全虚拟机CapVM，以及eBPF和WASM来描述约束。我们证明了CAPLETS能够细粒度地表达权限和需求，从而促进了非平凡访问控制策略的构建。我们对使用资源受限设备和端到端物联网部署的CAPLET抽象的效率和灵活性进行了经验评估，并将其与目前广泛使用的相关机制进行了比较。我们的经验结果表明，CAPLETS比当前的物联网授权系统快一个数量级，能源效率更高。
We present CAPLets, an authorization mechanism that extends capability based security to support fine grained access control for multi-scale (sensors, edge, cloud) IoT deployments. To enable this, CAPLets uses a strong cryptographic construction to provide integrity while preserving computational efficiency for resource constrained systems. Moreover, CAPLets augments capabilities with dynamic, user defined constraints to describe arbitrary access control policies. We introduce an application specific, turing complete virtual machine, CapVM, alongside with eBPF and Wasm, to describe constraints. We show that CAPLets is able to express permissions and requirements at a fine grain, facilitating construction of non-trivial access control policies. We empirically evaluate the efficiency and flexibility of CAPLets abstractions using resource constrained devices and end-to-end IoT deployments, and compare it against related mechanisms in wide use today. Our empirical results show that CAPLets is an order of magnitude faster and more energy efficient than current IoT authorization systems.