A Capability Token Selection Algorithm for Lightweight Information Flow Control in the IoT

Abstract

The CBAC (Capability-Based Access Control) model where device owners issue subjects capability tokens, i.e., a set of access rights on objects in devices, is adopted to the IoT (Internet of Things). Objects are data resource in a device which are used to store sensor data and action data. A subject $sb_i$ can get data of an object $o_m^k$ in a device $d_k$ by accessing an object $o_n^l$ in another device $d_l$ even if the subject $sb_i$ is not allowed to get the data from the object $o_m^k$. Here, information of the object $o_m^k$ illegally flows to the subject $sb_i$. In addition, a subject may get data of an object generated at time $\tau$ when the subject is not allowed to get the data from the object. Here, since the data come to the subject later than expected by the subject to get the data, i.e., the data flow late to the subject. In our previous studies, protocols are implemented to interrupt operations implying both illegal and late types of information flow. Here, the request processing time takes longer as the number of capability tokens whose signatures are verified in devices increases. Hence, in this paper, an MRCTS (Minimum Required Capability Token Selection) algorithm to reduce the number of capability tokens used is proposed. In the evaluation, it is shown that the request processing time is shortened by the MRCTS algorithm.