Access Control Policies – Who Can See What in an IoT System

Our last post described oneM2M’s use of REST APIs for communications between a sensor, an IoT platform (CSE in oneM2M terms) and a visualization dashboard. IoT systems are more complicated than this basic system because they contain multiple sensors and multiple consumers of IoT data. Examples include actuators, databases, decision-making systems, and users from different business units among others.?

For operational purposes, there can be reasons to control which entities are permitted to interact with one another. In other words, “who is allowed to see or update what.” The use of access control policies allows system architects to control the way that data-consuming endpoints access IoT data.

oneM2M’s uses Access Control Lists to allow and filter access to individual resources or attributes. Without the proper access rights, a CSE’s security mechanisms prevent an entity that forms part of an IoT system from retrieving or performing actions on system resources and IoT data.

Each permission can be parameterized with further dependencies, such as schedules (to control access based on time), location information (to control access based on geographic location), IP address ranges, and more. These possibilities enable fine-grained access controls that cover many use cases.

Each REST API request represents an operation (such as CREATE, RETRIEVE, UPDATE, DELETE), has an originator, and is directed at a target resource. A request tuple (originator, resource, operation) sent by an Application Entity (AE) is checked by a CSE against all the assigned permissions. The processing sequence identifies and authenticates the sender, authorizes and then performs the requested operation.

By default, access to a resource is always denied. However, if only one assigned permission grants access, then the request is allowed and will be executed by the CSE. Watch the accompanying animation to see oneM2M’s Access Control functionality in action. For hands-on experience follow the link below to a video talk and Jupyter Notebook code that shows Access Control in action.

#LearnToUseoneM2M-5 #AccessControl #IoT #StandardsMatter

Access Control code example - https://wiki.onem2m.org/index.php?title=OneM2M_Tutorials_using_Jupyter_Notebooks#Episode_6_-_Access_Control