Higher-Order Relationship-Based Access Control: A Temporal Instantiation with IoT Applications

Abstract

Cyberphysical systems involve connected devices that are physically embedded. These devices enter into transient relationships with one another and with the environment. We propose an access control model, HO(T)-ReBAC, for facilitating access control in such dynamic environments. Specifically, HO(T)-ReBAC bases its authorization decisions on the history of relationship changes. We demonstrate the usefulness of this model in a case study on a Medical Internet-of-Things application. We extend a recently proposed graph matching algorithm to handle temporality in our model, thereby yielding an efficient authorization mechanism, the performance of which has been evaluated empirically. This model is the first instantiation of a general idea, Higher-Order Relationship-Based Access Control, that we have been developing.