  The prevalence of Internet of Things (IoTs) allows heterogeneous embedded
smart devices to collaboratively provide intelligent services with or without
human intervention. While leveraging the large-scale IoT-based applications
like Smart Gird and Smart Cities, IoT also incurs more concerns on privacy and
security. Among the top security challenges that IoTs face is that access
authorization is critical in resource and information protection over IoTs.
Traditional access control approaches, like Access Control Lists (ACL),
Role-based Access Control (RBAC) and Attribute-based Access Control (ABAC), are
not able to provide a scalable, manageable and efficient mechanisms to meet
requirement of IoT systems. The extraordinary large number of nodes,
heterogeneity as well as dynamicity, necessitate more fine-grained, lightweight
mechanisms for IoT devices. In this paper, a federated capability-based access
control (FedCAC) framework is proposed to enable an effective access control
processes to devices, services and information in large scale IoT systems. An
identity-based capability token management strategy is presented, which
involves registering, propagation and revocation of the access authorization.
Through delegating centralized authorization decision-making policy to local
domain delegator, the access authorization process is locally conducted on the
service provider that integrates situational awareness (SAW) and customized
contextual conditions. Implemented and tested on both resources-constrained
devices, like smart sensors and Raspberry PI, and non-resource-constrained
devices, like laptops and smart phones, our experimental results demonstrate
the feasibility of the proposed FedCAC approach to offer a scalable,
lightweight and fine-grained access control solution to IoT systems connected
to a system network.
