No abstract

The Internet of Things is taking hold in our everyday life. Regrettably, the security of IoT devices is often being overlooked. Among the vast array of security issues plaguing the emerging IoT, we decide to focus on access control, as privacy, trust, and other security properties cannot be achieved without controlled access. This article classifies IoT access control solutions from the literature according to their architecture (e.g., centralized, hierarchical, federated, distributed) and examines the suitability of each one for access control purposes. Our analysis concludes that important properties such as auditability and revocation are missing from many proposals while hierarchical and federated architectures are neglected by the community. Finally, we provide an architecture-based taxonomy and future research directions: a focus on hybrid architectures, usability, flexibility, privacy, and revocation schemes in serverless authorization.

No abstract

Smart cards are highly successful thanks to their unique combination of mobility and security. Based upon a single-chip microcontroller with volatile and non-volatile memories, a smart card implementes a small computer system that is very portable (credit card size), easy to use, and extremely resistant against external attacks. However, today's smart cards use proprietary protocols, application schemes, and development tools. This is due to the limitations of current technology, and it leads to situation of "splendid isolation" where smart cards are not being regarded as an integral part of the overall IT architecture. In this paper, we describe recent research towards "next generation" smart cards. It combines an advanced programming language (Java), novel hardware architectures that provide the required "MIPS budget" (RISC 32 bit), as well as an implementation of key Internet protocols (IP, HTTP) on smart cards. As a result, we show how smart cards can be seamlessly integrated within a distributed computing environment.

No abstract