A unified access control model for calibration traceability in safety-critical IoT

Shah, Ryan and Nagaraja, Shishir; Kanhere, Salil and Patil, Vishwas T and Sural, Shamik and Gaur, Manoj S, eds. (2020) A unified access control model for calibration traceability in safety-critical IoT. In: Information Systems Security - 16th International Conference, ICISS 2020, Proceedings. Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics) . Springer, IND, pp. 3-22. ISBN 9783030656096 (https://doi.org/10.1007/978-3-030-65610-2_1)

[thumbnail of Shah-Nagaraja-LNCS-2020-A-unified-access-control-model-for-calibration-traceability-in-safety-critical-IoT]
Preview
 Text. Filename: Shah_Nagaraja_LNCS_2020_A_unified_access_control_model_for_calibration_traceability_in_safety_critical_IoT.pdf
Accepted Author Manuscript
Download (952kB)| Preview

Abstract

Accuracy (and hence calibration) is a key requirement of safety-critical IoT (SC-IoT) systems. Calibration workflows involve a number of parties such as device users, manufacturers, calibration facilities and NMIs who must collaborate but may also compete (mutually untrusting). For instance, a surgical robot manufacturer may wish to hide the identities of third-parties from the operator (hospital), in order to maintain confidentiality of business relationships around its robot products. Thus, information flows that reveal who-calibrates-for-whom need to be managed to ensure confidentiality. Similarly, meta-information about what-is-being-calibrated and how-often-it-is-calibrated may compromise operational confidentiality of a deployment. We show that the challenge of managing information flows between the parties involved in calibration cannot be met by any of the classical access control models, as any one of them, or a simple conjunction of a subset such as the lattice model, fails to meet the desired access control requirements. We demonstrate that a new unified access control model that combines BIBA, BLP, and Chinese Walls holds rich promise. We study the case for unification, system properties, and develop an XACML-based authorisation framework which enforces the unified model. We show that upon evaluation against a baseline simple-conjunction of the three models individually, our unified model outperforms with authorisation times at least 10ms lower than the baseline. This demonstrates it is capable of solving the novel access control challenges thrown up by digital-calibration workflows.

CORE (COnnecting REpositories)