An efficient security risk estimation technique for Risk-based access control model for IoT

Abstract

The need to increase information sharing in the Internet of Things (IoT) applications made the risk-based access control model to be the best candidate for both academic and commercial organizations. Risk-based access control model carries out a security risk analysis on the access request by using IoT contextual information to provide access decisions dynamically. Unlike current static access control approaches that are based on predefined policies and give the same result in different situations, this model provides the required flexibility to access system resources and works well in unexpected conditions and situations of the IoT system. One of the main issues to implement this model is to determine the appropriate risk estimation technique that is able to generate accurate and realistic risk values for each access request to determine the access decision. Therefore, this paper proposes a risk estimation technique which integrates the fuzzy inference system with expert judgment to assess security risks of access control operations in the IoT system. Twenty IoT security experts from inside and outside the UK were interviewed to validate the proposed risk estimation technique and build the fuzzy inference rules accurately. The proposed risk estimation approach was implemented and simulated using access control scenarios of the network router. In comparison with the existing fuzzy techniques, the proposed technique has demonstrated it produces precise and realistic values in evaluating security risks of access control operations in the IoT context.

A Comprehensive Study on IoT security problems based on blockchain

“…Also, the IoT arcade is developing dramatically. As indicated by statistically, the assessed income of Internet of Things in 2015 was USD 743 billion [15].…”

Efficient NFS Model for Risk Estimation in a Risk-Based Access Control Model

“…Based on the recommendations of the literature review, the fuzzy logic system was implemented in [9] to resolve the unavailability of datasets and provide a quantitative and a numeric risk value for each access request to determine the access decision. Although the fuzzy logic system provides accurate and realistic risk values to implement the risk-based access control model, the major issue associated with it was the scalability and inability to learn.…”

“…An access control model for the IoT system is intended to serve hundreds or thousands of users. Based on the experimental results discussed in [9], the risk estimation using the fuzzy logic system requires 57.38 s to estimate the security risks of 1000 access requests. This response time is efficient for a small network of devices, but with the IoT system, there are thousands of devices per network.…”

“…A dynamic risk-based access control model for the IoT was proposed by the authors and discussed in [8,9,32]. The proposed model has four inputs: user/agent context, resource sensitivity, action severity, and risk history, as shown in Figure 1.…”

“…The input involved risk factors: user context, resource sensitivity, action severity, and risk history. Then, the fuzzy logic system was implemented based on the input of IoT security experts [9] to provide a numeric risk value for each input combination. The output of the fuzzy logic system with input was used to build a dataset to train the neural network and select the most appropriate learning algorithm that provided the optimal performance for the risk estimation process.…”