Privilege Management in Internet of Things (IoT) Networks

Abstract

In one approach, a processor receives, at an edge node, a message from an IoT device associated with the edge node, the message having at least one non-fungible token (NFT) embedded therein, each of the at least one NFT representing a corresponding authority associated with the IoT device. The processor retrieves, at the edge node, the at least one NFT from the received message. The processor validates, at the edge node, the received message based on the at least one NFT retrieved. In response to validating the received message, the processor forwards, by the edge node, the received message to a central node associated with the edge node.

Description

[Technical field]

[0001] The present invention relates to the Internet of Things (IoT), and more particularly to authorization management in IoT networks. [Background technology]

[0002] The Internet of Things (IoT) is a network of physical objects that connect and exchange data with other devices and systems over the Internet or other communication networks. Such physical objects may typically be referred to as IoT devices, which may include a wide range of devices that are hardware such as sensors, actuators, gadgets, appliances, or machines that are programmed for a specific use and can transmit data over the Internet or other communication networks. While the IoT can provide a wealth of data, it also attracts many security issues due to the wide variety of insecure IoT devices. For example, a hacked thermometer device may report humidity data that can lead to unwanted actions.

[0003] There is a strong need for enhanced privilege management in IoT networks. Summary of the Invention

[0004] According to one aspect, a computer-implemented method is provided that includes receiving, at an edge node, a message from an IoT device associated with the edge node, the message having at least one non-fungible token (NFT) embedded therein, each of the at least one NFT representing a corresponding authority associated with the IoT device; retrieving, at the edge node, the at least one NFT from the received message; validating, at the edge node, the received message based on the retrieved at least one NFT; and, in response to validating the received message, forwarding, by the edge node, the received message to a central node associated with the edge node.

[0005] According to another aspect, a computer program product is provided comprising: one or more computer readable storage media; and program instructions collectively stored on the one or more computer readable storage media, the program instructions including: program instructions at an edge node for receiving a message from an IoT device associated with the edge node, the message having at least one non-fungible token (NFT) embedded therein, each of the at least one NFT representing a corresponding authority associated with the IoT device; program instructions at the edge node for retrieving at least one NFT from the received message; program instructions at the edge node for validating the received message based on the retrieved at least one NFT; and program instructions for forwarding, by the edge node, the received message to a central node associated with the edge node in response to validating the received message.

[0006] According to another aspect, a computer system is provided comprising: one or more computer processors; one or more computer readable storage media; and program instructions collectively stored on the one or more computer readable storage media for execution by at least one of the one or more computer processors, the program instructions including: program instructions at an edge node for receiving a message from an IoT device associated with the edge node, the message having at least one Non-Fungible Token (NFT) embedded therein, each of the at least one NFT representing a corresponding authority associated with the IoT device; program instructions at the edge node for retrieving at least one NFT from the received message; program instructions at the edge node for validating the received message based on the retrieved at least one NFT; and program instructions for forwarding, by the edge node, the received message to a central node associated with the edge node in response to validating the received message.

[0007] One or more embodiments described herein describe a device, system, computer implemented method, apparatus, and / or computer program product for data recovery.

[0008] In one illustrative embodiment, a computer-implemented method for device authority management in an Internet of Things (IoT) network is provided. The IoT network includes a plurality of edge nodes and a plurality of central nodes, and the method includes receiving, at the edge node, a message from an IoT device associated with the edge node, the message having at least one non-fungible token (NFT) embedded therein, each of the at least one NFT representing a corresponding authority associated with the IoT device. The method further includes retrieving, at the edge node, the at least one NFT from the received message. The method further includes validating, at the edge node, the received message based on the retrieved at least one NFT, and forwarding, by the edge node, the received message to a central node associated with the edge node in response to the validation indicating that the received message conforms to the corresponding authority of the retrieved at least one NFT. Such an approach provides the advantage of enhanced security for authorizing edge nodes.

[0009] In another illustrative embodiment, a computer-implemented system for device authority management in an Internet of Things (IoT) network is also provided. The IoT network includes a plurality of edge nodes and a plurality of central nodes, and the system includes a processor and a memory medium coupled to the processor having program instructions. The program instructions include program instructions configured to receive, at the edge node, a message from an IoT device associated with the edge node, the message having at least one non-fungible token (NFT) embedded therein, each of the at least one NFT representing a corresponding authority associated with the IoT device. The program instructions further include program instructions configured to retrieve, at the edge node, the at least one NFT from the received message. The program instructions further include program instructions configured to validate, at the edge node, the received message based on the retrieved at least one NFT, and, in response to the validation indicating that the received message matches the corresponding authority of the retrieved at least one NFT, forward, by the edge node, the received message to a central node associated with the edge node. Such an approach provides the advantage of enhanced security for authorizing edge nodes.

[0010] In another illustrative embodiment, a corresponding computer program product is also provided. The IoT network includes a plurality of edge nodes and a plurality of central nodes, and the system includes a processor and a memory medium coupled to the processor having program instructions. The program instructions include program instructions configured to receive, at the edge node, a message from an IoT device associated with the edge node, the message having at least one non-fungible token (NFT) embedded therein, each of the at least one NFT representing a corresponding authority associated with the IoT device. The program instructions further include program instructions configured to retrieve, at the edge node, the at least one NFT from the received message. The program instructions further include program instructions configured to validate, at the edge node, the received message based on the retrieved at least one NFT, and, in response to the validation indicating that the received message conforms to a corresponding authority of the retrieved at least one NFT, forward, by the edge node, the received message to a central node associated with the edge node. Such an approach provides the advantage of enhanced security for authorizing edge nodes.

[0011] Preferred embodiments of the invention will now be described, by way of example only, and with reference to the following drawings, in which: [Brief description of the drawings]

[0012] [Figure 1] FIG. 2 is a diagram of a cloud computing node according to an embodiment of the present invention. [Diagram 2] FIG. 1 is a diagram of a cloud computing environment in accordance with an embodiment of the present invention. [Diagram 3] FIG. 2 is a diagram of abstraction model layers according to an embodiment of the present invention. [Figure 4]FIG. 1 is a diagram of a system architecture according to an embodiment of the present invention. [Diagram 5] FIG. 5 is a flow diagram of the system of FIG. 4 in accordance with an embodiment of the present invention. [Figure 6] 2 is a flow chart according to an embodiment of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0013] The following detailed description is merely illustrative and is not intended to limit the embodiments or the application and / or uses of the embodiments.

[0014] One or more embodiments are now described with reference to the drawings, wherein like reference numerals are used to refer to like elements throughout. In the following description, for purposes of explanation, numerous specific details are set forth in order to provide a more thorough understanding of one or more embodiments. Nevertheless, it will be apparent that in various cases one or more embodiments may be practiced without these specific details.

[0015] Embodiments of the present disclosure may be implemented in, but are not limited to, a cloud computing environment as described below.

[0016] Although this disclosure includes a detailed description of cloud computing, it should be understood that implementations of the teachings recited herein are not limited to cloud computing environments. Rather, embodiments of the invention may be practiced in conjunction with any other type of computing environment now known or later developed.

[0017] Cloud computing is a model of service delivery for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, network bandwidth, servers, processing, memory, storage, applications, virtual machines, and services) that can be quickly provisioned and released with minimal administrative effort or interaction with a service provider. The cloud model may include at least five characteristics, at least three service models, and at least four deployment models.

[0018] The characteristics are as follows:

[0019] On-Demand Self-Service: Cloud customers can unilaterally provision computing capacity, such as server time and network storage, as needed, automatically, without the need for human interaction with the service provider.

[0020] Pervasive Network Access: Capabilities are available over the network and accessed through standard mechanisms that facilitate use by heterogeneous thin- and thick-client platforms (e.g., mobile phones, laptops, and PDAs).

[0021] Resource Pooling: A provider's computing resources are pooled to serve multiple consumers using a multi-tenant model, where various physical and virtual resources are dynamically allocated and reallocated on demand. Location independence is meant in that consumers generally have no control or knowledge of the exact location of the resources provided, but the location may be specified at a higher level of abstraction (e.g., country, state, or data center).

[0022] Rapid Elasticity: Capacity can be rapidly and elastically provisioned, sometimes automatically, to quickly scale out, and rapidly released to quickly scale in. To the consumer, the capacity available for provisioning often appears unlimited, and can be purchased in any amount at any time.

[0023] Metered Services: Cloud systems automatically control and optimize resource usage by leveraging metering capabilities at several levels of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency to both providers and consumers of the services utilized.

[0024] The service model is as follows:

[0025] Software as a Service (SaaS): The consumer is provided with the ability to use a provider's applications running on a cloud infrastructure. The applications are accessible from a variety of client devices through thin-client interfaces such as web browsers (e.g., web-based email). The consumer has no management or control over the underlying cloud infrastructure, including networks, servers, operating systems, storage, or possibly individual application capabilities, with the possible exception of limited user-specific application configuration settings.

[0026] Platform as a Service (PaaS): The capability provided to a consumer is to deploy consumer-created or acquired applications, created using programming languages ​​and tools supported by the provider, onto a cloud infrastructure. The consumer does not manage or control the underlying cloud infrastructure, including networks, servers, operating systems, or storage, but does have control over the deployed applications and, in some cases, the application hosting environment configuration.

[0027] Infrastructure as a Service (IaaS): The capability provided to a customer is to provide processing, storage, networking, and other basic computing resources on which the customer can deploy and run any software, which may include operating systems and applications. The customer does not manage or control the underlying cloud infrastructure, but does have control over the operating systems, storage, deployed applications, and in some cases, limited control over selected networking components (e.g., host firewalls).

[0028] The deployment model is as follows:

[0029] Private Cloud: The cloud infrastructure is operated solely for the organization. The cloud infrastructure may be managed by the organization or a third party and may be on-site or off-site.

[0030] Community Cloud: Cloud infrastructure is shared by several organizations to support a particular community that has shared concerns (e.g., mission, security requirements, policies, and compliance considerations). The cloud infrastructure may be managed by the organization or a third party and may be on-site or off-site.

[0031] Public Cloud: Cloud infrastructure is made available to the general public or large industry entities and is owned by the organizations that sell cloud services.

[0032] Hybrid Cloud: The cloud infrastructure is a composite of two or more clouds (private, community, or public) that remain unique entities but are tied together by standard or proprietary technologies that enable data and application portability (e.g., cloud bursting for load balancing between clouds).

[0033] Cloud computing environments are service-oriented with a focus on statelessness, loose coupling, modularity, and semantic interoperability. At the heart of cloud computing is an infrastructure that includes a network of interconnected nodes.

[0034] Referring now to Figure 1, an example cloud computing node is shown generally. Cloud computing node 10 is only one example of a suitable cloud computing node and is not intended to suggest any limitation as to the scope of use or functionality of the embodiments of the invention described herein. In any event, cloud computing node 10 is capable of performing and / or implementing any of the functions described above.

[0035] Cloud computing node 10 includes computer system / server 12, which is operable in numerous other general purpose or special purpose computing system environments or configurations. Examples of well-known computing systems, environments, or configurations, or combinations thereof, that may be suitable for use with computer system / server 12 include, but are not limited to, personal computer systems, server computer systems, thin clients, thick clients, handheld or laptop devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputer systems, mainframe computer systems, and distributed cloud computing environments that include any of the above systems or devices, and the like.

[0036] The computer system / server 12 may be described in the general context of computer system executable instructions, such as program modules, executed by a computer system. Generally, program modules may include routines, programs, objects, components, logic, data structures, etc. that perform particular tasks or implement particular abstract data types. The computer system / server 12 may also be practiced in a distributed cloud computing environment where tasks are performed by remote processing devices that are linked through a communications network. In a distributed cloud computing environment, program modules may be located in both local and remote computer system storage media, including memory storage devices.

[0037] 1, computer system / server 12 in cloud computing node 10 is shown in the form of a general-purpose computing device. Components of computer system / server 12 may include, but are not limited to, one or more processors or processing units 16, system memory 28, and a bus 18 that couples various system components, including system memory 28, to processor 16.

[0038] Bus 18 represents one or more of any of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, and a processor or local bus using any of a variety of bus architectures. By way of example and not limitation, such architectures include Industry Standard Architecture (ISA) bus, Micro Channel Architecture (MCA) bus, Enhanced ISA (EISA) bus, Video Electronics Standards Association (VESA) local bus, and Peripheral Component Interconnect (PCI) bus.

[0039] Computer system / server 12 typically includes a variety of computer system readable media. Such media may be any available media that can be accessed by computer system / server 12 and includes both volatile and nonvolatile media, removable and non-removable media.

[0040] The system memory 28 may include computer system readable media in the form of volatile memory, such as random access memory (RAM) 30 and / or cache memory 32. The computer system / server 12 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, the storage system 34 may be provided for reading and writing a non-removable, non-volatile magnetic medium (not shown, but typically referred to as a "hard drive"). Although not shown, a magnetic disk drive may be provided for reading and writing a removable, non-volatile magnetic disk (e.g., a "floppy disk"), and an optical disk drive may be provided for reading and writing a removable, non-volatile optical disk, such as a CD-ROM, DVD-ROM, or other optical medium. In such an example, each may be connected to the bus 18 by one or more data media interfaces. As further depicted and explained below, the memory 28 may include at least one program product having a set (e.g., at least one) of program modules configured to perform the functions of an embodiment of the present invention.

[0041] The programs / utilities 40 have a set (at least one) of program modules 42, which may be stored in the memory 28, as well as, by way of example and not limitation, an operating system, one or more application programs, other program modules, and program data. Each of the operating system, one or more application programs, other program modules, and program data, or some combination thereof, may include an implementation of a networked environment. The program modules 42 generally perform the functions and / or methods of embodiments of the present invention as described herein.

[0042] The computer system / server 12 may also communicate with one or more external devices 14, such as a keyboard, pointing device, display 24, one or more devices that allow a user to interact with the computer system / server 12, or any device (e.g., network card, modem, etc.) that allows the computer system / server 12 to communicate with one or more other computing devices, or a combination thereof. Such communication may occur through an input / output (I / O) interface 22. Additionally, the computer system / server 12 may communicate with one or more networks, such as a local area network (LAN), a general wide area network (WAN), or a public network (e.g., the Internet), or a combination thereof, through a network adapter 20. As depicted, the network adapter 20 communicates with other components of the computer system / server 12 through a bus 18. Although not shown, it is understood that other hardware configurations and / or software components may be used with the computer system / server 12. Examples include, but are not limited to, microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data archive storage systems.

[0043] Now referring to FIG. 2, an illustrative cloud computing environment 50 is depicted. As shown, the cloud computing environment 50 includes one or more cloud computing nodes 10 with which local computing devices used by cloud users, such as, for example, a personal digital assistant (PDA) or cellular phone 54A, a desktop computer 54B, a laptop computer 54C, or an automobile computer system 54N, or combinations thereof, can communicate. The nodes 10 may communicate with each other. The nodes 10 may be physically or virtually grouped in one or more networks, such as a private, community, public, or hybrid cloud, or combinations thereof, as described above (not shown). This enables the cloud computing environment 50 to provide infrastructure, platform, and / or software as a service without the cloud user having to maintain resources on a local computing device. It will be understood that the types of computing devices 54A-N illustrated in FIG. 2 are intended to be illustrative only, and that the computing node 10 and cloud computing environment 50 are capable of communicating with any type of computerized device via any type of network and / or network-addressable connections (e.g., using a web browser).

[0044] Referring now to Figure 3, a set of functional abstraction layers provided by cloud computing environment 50 (Figure 2) is shown. It should be understood in advance that the components, layers, and functions shown in Figure 3 are intended to be merely exemplary, and embodiments of the present invention are not limited thereto. As depicted, the following layers and corresponding functions are provided:

[0045] Hardware and software layer 60 includes hardware and software components. Examples of hardware components include mainframes 61, RISC (reduced instruction set computing) architecture based servers 62, servers 63, blade servers 64, storage devices 65, and networks and networking components 66. In some embodiments, software components include network application server software 67 and database software 68.

[0046] The virtualization layer 70 provides an abstraction layer within which examples of virtual entities may be provided: virtual servers 71, virtual storage 72, virtual networks including virtual private networks 73, virtual applications and operating systems 74, and virtual clients 75.

[0047] In one example, the management layer 80 may provide the functions described below. Resource provisioning 81 provides dynamic procurement of computing and other resources utilized to perform tasks within the cloud computing environment. Metering and pricing 82 provides cost tracking as resources are utilized within the cloud computing environment and billing or invoicing for the usage of these resources. In one example, these resources may include application software licenses. Security provides identity verification of cloud consumers and tasks, and protection of data and other resources. User portal 83 provides consumers and system administrators with access to the cloud computing environment. Service level management 84 provides allocation and management of cloud computing resources such that required service levels are met. Service level agreement (SLA) planning and execution 85 provides pre-provisioning and procurement of cloud computing resources in anticipation of future requirements according to SLAs.

[0048] The workload tier 90 provides examples of functions for which a cloud computing environment may be utilized. Examples of workloads and functions that may be provided from this tier include mapping and navigation 91, software development and lifecycle management 92, virtual classroom instructional delivery 93, data analytics processing 94, transaction processing 95, and privilege management 96.

[0049] The Internet of Things (IoT) can attract many security issues due to the wide variety of insecure IoT devices. To address the security issues, several approaches have been developed with existing technologies. One such approach includes distributed one-way authentication, in which an IoT device authenticates itself to another device, typically to the edge node (or gateway) with which it is associated, but the other device does not need to authenticate the IoT device (or vice versa). The one-way approach simplifies the authentication process but is not secure enough. Another approach is distributed two-way authentication, which enhances distributed one-way authentication by forcing the IoT device and the other device to mutually authenticate each other, typically via the Transport Layer Security (TLS) protocol. A further enhancement to distributed two-way authentication is centralized three-way authentication, in which a central authority associated with and trusted by both the IoT device and the other device performs authentication of both the IoT device and the other device.

[0050] However, none of the above approaches address the security issue when a hacked thermometer device may report humidity data that may lead to unwanted actions. This is because a hacked IoT device can still authenticate itself with the IoT device's valid credentials in the existing approaches, and thus can still transmit malicious data after authentication (e.g., humidity data sent by the hacked thermometer device that may trigger unwanted actions). Therefore, there is a need for enhanced permission management in IoT networks.

[0051] Embodiments in the present disclosure provide enhanced permission management in an IoT network where unique permissions can be associated with corresponding resources that an IoT device is authorized to provide such that for each resource that an IoT device is authorized to provide, a corresponding unique permission can be assigned. Such a configuration can provide the ability to verify resources provided by an IoT device. If a resource provided by an IoT device is not verifiable, i.e., there is no corresponding permission associated with the resource, the resource will be considered invalid. Such fine-grained authorization ensures that only authorized resources can be provided by an IoT device.

[0052] To provide such capabilities as described above, embodiments of the present disclosure employ a mechanism called Non-Fungible Tokens (NFTs), where resources that an IoT device is authorized to provide may be associated with a corresponding unique authority implemented as an NFT, such that a unique NFT may be associated with each resource that an IoT device is authorized to provide. Each time an IoT device attempts to send data regarding a resource, the unique NFT associated with the resource may be embedded in the data, such that a party receiving the data can verify the received data based on the unique NFT, ensuring that only data for resources authorized by the IoT device (i.e., data verified by the receiving party using the unique NFT) is acceptable.

[0053] According to an embodiment of the present disclosure, an NFT is a token that can represent the ownership of a resource that an IoT device is authorized to provide. For example, if an IoT device is authorized to provide temperature and humidity, an NFT corresponding to the temperature of the IoT device and another NFT corresponding to the humidity of the IoT device may be assigned correspondingly. The purpose of the NFT is to uniquely identify an authority in an IoT network, that is, for each authorized resource in an IoT network, a corresponding NFT is assigned. In other words, even if two IoT devices can each be authorized to provide temperature, the corresponding temperatures provided by the two IoT devices should be assigned different NFTs.

[0054] The concept of NFTs develops with the development of blockchain technology. A blockchain is a growing list of records, called blocks, linked together using cryptography. Each block contains a cryptographic hash of the previous block, a timestamp, and the transaction data (commonly represented as a Merkle tree). The timestamp proves that the transaction data existed when the block was published to arrive at the block's hash. Since each block contains information about its previous block, they form a chain, with each additional block reinforcing the block before it. Thus, a blockchain is resistant to modification of its data, since once recorded, it is impossible for the data in any given block to be retroactively altered without altering all subsequent blocks. A blockchain is essentially a digital ledger of transactions that is replicated and distributed across a network of computer systems on the blockchain. Each block in the chain contains several transactions, and whenever a new transaction occurs on the blockchain, a record of this transaction is added to each participant's ledger. A decentralized database managed by multiple participants is known as a distributed ledger technology (DLT).

[0055] In a nutshell, a blockchain is a decentralized, distributed, and often public, digital ledger consisting of records called blocks used to record transactions across many computers, so that no block it contains can be retroactively altered without altering all subsequent blocks. This allows participants to verify and validate transactions independently and relatively inexpensively. Blockchain databases are autonomously managed using peer-to-peer networks and distributed timestamp servers. These are authenticated by a large amount of collaboration driven by collective self-interest. Such a design facilitates a robust workflow with little uncertainty for participants regarding data security. The use of blockchain removes the property of infinite repeatability from digital assets. The use of blockchain ensures that every unit of value has been transferred exactly once, solving the long-standing double-spending problem. Blockchain has been described as a value exchange protocol. When properly set up to detail exchange agreements, blockchain is capable of maintaining title rights as the blockchain provides a record that enforces offers and acceptances.

[0056] NFTs are unique and non-fungible units of data stored in a digital ledger and were originally developed to represent ownership of unique items. For example, NFTs can be associated with easily reproducible items such as photos, videos, audio, and other types of digital files as unique items (similar to a proof of authenticity), and blockchain technology is used to give the NFT a public proof of ownership. With NFTs, the ownership of each such easily reproducible item is uniquely identifiable. An embodiment of the present invention borrows the concept of NFTs, where each NFT can uniquely represent an authorized resource in an IoT network, i.e., each authorized resource in an IoT network is assigned a corresponding NFT. In other words, two authorized resources of the same type provided by two different IoT devices will be assigned different NFTs.

[0057] Considering the properties of blockchain technology (immutability, decentralization, enhanced security, distributed ledger, consensus, etc.), an NFT mechanism based on blockchain technology inherits all these properties mentioned above and further provides the ability of proof of ownership embedded with all these properties, and is therefore beneficial for the embodiments in the present disclosure described herein in relation to Figures 4 to 6.

[0058] Reference is now made to FIG. 4, which illustrates an example system architecture according to some embodiments of the present disclosure. The example system architecture may be an example IoT network in which multiple IoT devices 401-1-1, ..., 401-2-1, ..., 402-N-1 (not shown) are associated with multiple edge nodes 402-1, 402-2, ..., 402-N, respectively. The multiple edge nodes 402-1, 402-2, ..., 402-N may be associated with multiple central nodes 403. The multiple edge nodes 402-1, 402-2, ..., 402-N may each receive resource-related data (e.g., measurements from sensors of the multiple IoT devices) from their associated IoT devices 401-1-1, ..., 401-2-1, ..., 402-N-1 (not shown), ... and forward the received resource-related data to one of the multiple central nodes 403, which may further convey the received resource-related data to upper layer applications for performing certain actions based on the received measurements.

[0059] According to some embodiments of the present disclosure, multiple edge nodes 402-1, 402-2, ..., 402-N and multiple core nodes 403 may construct a federated blockchain 404, and an IoT device may register itself in the blockchain through a blockchain transaction. An IoT device may register itself using its device identifier, such as an associated Universally Unique Identifier (UUID) that uniquely identifies the device.

[0060] Once registered, the IoT device may further register a list of resources that it is authorized to provide (authorized resources), identified by a list of corresponding resource identifiers. According to some embodiments of the present disclosure, multiple corresponding NFTs may be created for multiple authorized resources in the IoT network, e.g., by a resource manager managing authorization in the IoT network, as shown in FIG. 5 and described later. With the NFT mechanism proposed in the present disclosure, a corresponding unique NFT may be assigned for each authorized resource, such that two authorized resources of the same type provided by two different IoT devices will be assigned different NFTs.

[0061] According to some embodiments of the present disclosure, each time an IoT device registers itself with an IoT network, for example by associating itself with an edge node, the IoT device may register the IoT device using its device identifier and the resources that the IoT device is authorized to provide by injecting one or more transactions into the federated blockchain. A corresponding NFT may then be assigned to the resources that the IoT device is authorized to provide by further injecting a corresponding transaction into the federated blockchain, for example via the resource manager shown in FIG. 5. The registration of the IoT device is finalized after the injecting transaction that registers the IoT device and the transaction that assigns the corresponding NFT to the resource is confirmed through consensus. After registration, the IoT device may be set as the owner of the assigned NFT, which may be stored as a smart contract in the blockchain. According to some embodiments of the present disclosure, all IoT devices associated with an IoT network must go through the registration process discussed above, and thus, each authorized resource in the IoT network may be assigned a unique NFT.

[0062] Every time a registered IoT device tries to send data about a resource, it may check if there is a corresponding NFT assigned to the resource, and if so, the corresponding NFT may be embedded in the data. The edge node receiving the data may extract the NFT and verify the received data based on the extracted NFT. However, if it is found that there is no corresponding NFT assigned to the resource, e.g., if the IoT device is hacked after registration and starts sending data about unauthorized resources (as discussed above, a hacked thermometer sends humidity data), the IoT device may still send such data without such an NFT embedded. As mentioned before, after registration, all authorized resources are assigned their respective NFTs, and resources without assigned NFTs will be considered unauthorized, and data about unauthorized resources cannot be verified since the NFT cannot be extracted from the data.

[0063] According to some embodiments of the present disclosure, a module configured to receive and store the corresponding assigned NFT may be deployed in the IoT device after successful registration of the IoT device. The module may also be configured to force the registered IoT device to check the NFT before sending any data related to the resource. The module may also be configured to embed the corresponding NFT in the data related to the authorized resource. According to some embodiments of the present disclosure, the module may be a sandbox program running in the operating system of the IoT device, deployed, for example, through extended Berkley Packet Filter (eBPF) technology, after the IoT device is successfully registered in the IoT network.

[0064] According to some embodiments of the present disclosure, instead of introducing the above-mentioned modules, the receiving and storing of the corresponding assigned NFT may utilize a Trusted Platform Module (TPM) of the registered IoT device, if present, which may be further configured to check the NFT before sending any data related to the resource and embed the corresponding NFT in the data related to the authorized resource.

[0065] Utilizing an installed module or TPM ensures that the NFT can only be read from the installed module or TPM, ensuring that no one can modify the NFT once it is stored.

[0066] It should be pointed out that once the registration of an IoT device is completed, such a process of further registration for the same IoT device is not acceptable. This ensures that the registration of an IoT device can only happen once. If a clone IoT device attempts to register itself in the IoT network, the clone IoT device will be rejected. Registration may utilize one-way authentication, two-way authentication, or centralized three-way authentication as described above, with the difference being that a corresponding NFT is created and assigned for each authorized resource in the IoT network.

[0067] Turning now to FIG. 5, FIG. 5 illustrates an example flow of the example system of FIG. 4 according to some embodiments of the present disclosure. The example flow illustrated in FIG. 5 illustrates an associated blockchain transaction for NFT according to some embodiments of the present disclosure. FIG. 5 illustrates a resource manager configured to manage authority in an IoT network. The resource manager may be distributed and resident in multiple central nodes 403 of FIG. 4. The device illustrated in FIG. 5 may be any IoT device 401-1-1, ..., 401-2-1, ... illustrated in FIG. 4. The blockchain illustrated in FIG. 5 corresponds to the federated blockchain 404 illustrated in FIG. 4. FIG. 5 illustrates the overall process of NFT-related transactions of the example system of FIG. 4.

[0068] As discussed above, during the registration phase of the IoT device, an IoT device may register a list of resources that the IoT device is authorized to provide. The list of authorized resources may be identified by corresponding resource identifiers. According to some embodiments of the present disclosure, the resource identifiers may be managed by a resource manager and may be common across the IoT network, i.e., resources of the same type may be associated with the same resource identifier (e.g., temperatures provided by different IoT devices may be associated with the same resource identifier indicating that the resource is a temperature), while resources of different types may be associated with different resource identifiers (e.g., temperatures may be associated with a resource identifier indicating that the resource is a temperature, while humidity may be associated with another different resource identifier indicating that the resource is humidity).

[0069] As shown in FIG. 5, a resource manager of an IoT network may register a list of resources in a blockchain (federated blockchain 404) via a blockchain transaction using corresponding resource identifiers, for example, shown as blockchain transaction 501 in FIG. 5. As discussed above, the number of types of resources registered by a resource manager may be finite, since the resource identifiers may be common across the entire IoT network. This may allow for better management of resources compared to an approach in which a unique resource identifier is associated with each authorized resource provided by each IoT device in an IoT network, due to the fact that there may be thousands of IoT devices in an IoT network. Such an approach may also reduce the complexity of the blockchain.

[0070] As further shown in Figure 5, a device may register itself with a blockchain (federated blockchain 404) via a blockchain transaction, for example, using the device's device identifier, shown in Figure 5 as blockchain transaction 502. According to some embodiments of the present disclosure, the device identifier of an IoT device may be a universally unique identifier (UUID). The UUID of an IoT device may be assigned by the IoT network upon registration of the device and stored in a module deployed on the device or alternatively in the device's TPM.

[0071] The resource manager may also be configured to create a corresponding NFT for each authorized resource provided by the device to uniquely represent the corresponding authorization associated with the device. For example, if a device is authorized to provide temperature and humidity, an NFT corresponding to the temperature provided by the device and an NFT corresponding to the humidity provided by the device may be generated, respectively. A corresponding NFT may be created for each authorized resource in the IoT network, meaning that two corresponding NFTs are created for two resources of the same type but provided by two different devices.

[0072] There are various ways to create a corresponding NFT for an authorized resource in an IoT network. According to some embodiments of the present disclosure, the NFT may be created using a predefined algorithm, and a mapping between the created NFT and the authorized resource in the IoT network (i.e., a mapping between the resource that the IoT device is authorized to provide and the corresponding created NFT) may be stored. According to some embodiments of the present disclosure, the NFT may be created using i) a device identifier of the device, such as a UUID assigned to the device by the IoT network, and ii) a resource identifier of the resource, such as a resource identifier for temperature. The combination of the device identifier and the resource identifier can uniquely identify which resource is received from which device, and therefore there is no need to store a mapping between the created NFT and the authorized resource in the IoT network. FIG. 5 shows such an approach as an example illustration, where an NFT is created using a combination of a resource identifier (resource information) and a device identifier (device information).

[0073] During registration, and after a corresponding NFT has been created for each resource the device is authorized to provide, the resource manager may issue the corresponding NFT via a blockchain transaction, shown as blockchain transaction 503 in Figure 5. The issued NFT may be further stored in a module deployed on the device, or alternatively in the device's TPM. The issuance of NFTs may be stored on the blockchain, as these are also blockchain transactions.

[0074] After successful registration of the device, for each resource the device is authorized to provide, a corresponding NFT may be received from the IoT network and stored in a module deployed in the device or, alternatively, in the TPM of the device. Each time the device attempts to send data regarding a resource, the device may check, for example, by the deployed module or the TPM of the device, whether there is a corresponding NFT assigned to the resource. In response to the check indicating that there is a corresponding NFT assigned to the resource, the corresponding NFT may be embedded in the data. According to some embodiments of the present disclosure, the corresponding NFT may be embedded in a packet header of a layer 3 data packet, for example, in a protected field of a Transport Control Protocol (TCP) packet header or a User Data Protocol (UDP) packet header. The TCP / UDP specification provides such a capability. To further enhance security, the corresponding NFT may be embedded in the protected field after first being encoded using a base 64 encoding scheme, such that the corresponding NFT cannot be obtained even if the contents of the protected field are extracted.

[0075] According to some embodiments of the present disclosure, with the help of the TPM, the data with the embedded NFT is further signed using a private key stored in the TPM for additional security before being sent to the IoT network. The party receiving the data can use the public key to decrypt the data and extract the embedded NFT.

[0076] As shown in Figure 5, the transmission of the data with the embedded NFT is not a blockchain transaction and is shown in Figure 5 as off-chain 504.

[0077] According to some embodiments of the present disclosure, in response to de-registration of a device, the corresponding NFTs created for the resources the device is authorized to provide may be destroyed via a blockchain transaction, shown as blockchain transaction 505 in Figure 5. According to some embodiments of the present disclosure, when the device re-registers itself on the IoT network, the same device identifier and the same resource identifiers may be associated with the device and registered back on the blockchain via a blockchain transaction.

[0078] Reference is now made to Figure 6, which illustrates an example flow diagram according to some embodiments of the present disclosure. The example flow shown in Figure 6 illustrates an example approach 600 of a device authority management process in an IoT network according to some embodiments of the present disclosure. The example approach of device authority management may be implemented at edge nodes, such as multiple edge nodes 402-1, 402-2, ..., 402-N of Figure 4.

[0079] An example approach 600 for device authority management in an IoT network may begin at step 602, where the authority management process receives, at an edge node, a message from an IoT device associated with the edge node. According to some embodiments of the present disclosure, the received message may have at least one NFT embedded therein, each of the at least one NFT representing a corresponding authority associated with the IoT device.

[0080] According to some embodiments of the present disclosure, the received message may be in the form of a plurality of Layer 3 data packets, such as TCP / UDP data packets. According to some embodiments of the present disclosure, the at least one NFT may be embedded in a packet header of the Layer 3 data packets. According to some embodiments of the present disclosure, the at least one NFT may be embedded in a protected field of a packet header of the Layer 3 data packets.

[0081] According to some embodiments of the present disclosure, at least one NFT may be provided to an IoT device during the registration phase of the IoT device to the IoT network. According to some embodiments of the present disclosure, at least one NFT may be associated with a unique identifier of the IoT device. According to some embodiments of the present disclosure, for each authorized resource in the IoT network, a corresponding NFT is assigned.

[0082] According to some embodiments of the present disclosure, the authorization includes information about resources that the IoT device is authorized to provide. According to some embodiments of the present disclosure, the IoT device may register the resources that the IoT device is authorized to provide (authorized resources) during the registration phase of the IoT device to the IoT network. According to some embodiments of the present disclosure, the authorized resources may be identified by corresponding resource identifiers. According to some embodiments of the present disclosure, the resource identifiers may be managed by a resource manager and may be common across the entire IoT network.

[0083] According to some embodiments of the present disclosure, the at least one NFT may be stored in a blockchain. According to some embodiments of the present disclosure, the blockchain may be constructed by all edge nodes and all central nodes of the IoT network. According to some embodiments of the present disclosure, the at least one NFT may be created using a device identifier of the IoT device and a resource identifier of a resource that the IoT device is authorized to provide. According to some embodiments of the present disclosure, the device identifier may be assigned to the IoT device by the IoT network during the registration phase of the IoT device. According to some embodiments of the present disclosure, the resource identifier may be managed by a resource manager and may be common across the entire IoT network.

[0084] According to some embodiments of the present disclosure, a device identifier of the IoT device may be registered on the blockchain via a corresponding blockchain transaction. According to some embodiments of the present disclosure, a resource identifier may be registered on the blockchain via a corresponding blockchain transaction. According to some embodiments of the present disclosure, at least one NFT may be issued to the IoT device via a corresponding blockchain transaction.

[0085] According to some embodiments of the present disclosure, the received message may be signed by the TPM of the IoT device using a private key. According to some embodiments of the present disclosure, at least one NFT may be embedded in the message after being encoded using a base 64 scheme.

[0086] Then, in step 604, the authority management process may retrieve at least one NFT from the received message at the edge node receiving the message. According to some embodiments of the present disclosure, the edge node receiving the message may use a public key to decrypt the received message and retrieve the at least one NFT if the received message was signed by the TPM of the IoT device. According to some embodiments of the present disclosure, the edge node receiving the message may extract the at least one NFT from a packet header of the Layer 3 data packet. According to some embodiments of the present disclosure, the edge node receiving the message may extract the at least one NFT from a protected field of the packet header of the Layer 3 data packet. According to some embodiments of the present disclosure, if the at least one NFT was encoded using a base 64 scheme, the edge node receiving the message may decode the extracted encoded NFT using the same base 64 scheme and retrieve the at least one NFT.

[0087] In step 606, an authority management process may validate the received message based on the retrieved at least one NFT at the edge node receiving the message. In step 608, if the validation indicates that the received message matches the corresponding authority of the retrieved at least one NFT, the authority management process may forward the received message via the edge node to a core node associated with the edge node.

[0088] According to some embodiments of the present disclosure, whether the received message matches the corresponding authority of the retrieved at least one NFT may be confirmed based on the at least one NFT using the blockchain. According to some embodiments of the present disclosure, the retrieved at least one NFT may be compared to the NFT stored in the blockchain to verify whether the retrieved at least one NFT is valid, i.e., whether the retrieved at least one NFT matches any NFT stored in the blockchain. According to some embodiments of the present disclosure, if the authority management process determines that the corresponding NFT matches the retrieved at least one NFT, the authority management process may determine that the retrieved at least one NFT is valid. In response to determining that the retrieved at least one NFT is valid, the authority management process may determine that the received message matches the corresponding authority of the retrieved at least one NFT. As long as a corresponding NFT is created for each authorized resource in the IoT network and the retrieved at least one NFT matches the NFT stored in the blockchain, the authority management process may determine that the received message matches the corresponding authority of the retrieved at least one NFT. This is because the NFT is created using a device identifier and resource identifier associated with the IoT device, i.e., a valid NFT indicates that the IoT device has successfully registered the corresponding resource that the IoT device (identified by the NFT, i.e., the combination of device identifier and resource identifier associated with the IoT device) is authorized to provide, and the message in which the NFT is embedded can be determined to conform to the corresponding permissions of the NFT.

[0089] According to some embodiments of the present disclosure, if the NFT is created using a predefined algorithm, a mapping between the created NFT and authorized resources in the IoT network may be checked. If the authority management process determines based on the mapping that the retrieved NFT corresponds to a resource that the IoT device is authorized to provide, the authority management process may determine that the received message matches the corresponding authority of the retrieved at least one NFT.

[0090] According to some embodiments of the present disclosure, however, if the authority management process determines that the received message does not match the corresponding authority of the at least one retrieved NFT, the authority management process may discard the message at step 612. In response to determining that an NFT is not retrievable from the received message or that the at least one retrieved NFT is invalid (i.e., there is no match in the blockchain), it may be determined that the received message does not match the corresponding authority of the at least one retrieved NFT. According to some embodiments of the present disclosure, at step 612, the authority management process may report an error (i.e., the received message does not match the corresponding authority of the at least one retrieved NFT) to the IoT network.

[0091] Adopting the NFT mechanism proposed and discussed in this disclosure can enable more fine-grained authorization in IoT networks. The mentioned problem that a hacked thermometer device may report humidity data that may lead to unwanted actions can be solved.

[0092] The use of blockchain can also bring further benefits, for example, if a takeover occurs at an edge node or a central node, the altered data can also be detected since all edge nodes and central nodes together build a federated blockchain.

[0093] The embodiment of the present disclosure has been described above. It should be noted that the authentication management according to the embodiment of the present disclosure can be implemented by the computer system / server 12 of FIG.

[0094] The present invention may be a system, method, or computer program product, or combination thereof, at any possible level of technical detail of integration. The computer program product may include a computer-readable storage medium (or media) having computer-readable program instructions for causing a processor to carry out aspects of the present invention.

[0095] A computer readable storage medium can be a tangible device capable of holding and storing instructions for use by an instruction execution device. A computer readable storage medium can be, for example, but not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of computer readable storage media includes portable computer diskettes, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROMs or flash memories), static random access memories (SRAMs), portable compact disk read-only memories (CD-ROMs), digital versatile disks (DVDs), memory sticks, floppy disks, mechanically encoded devices such as punch cards or ridge-in-groove structures having instructions recorded thereon, and any suitable combination of the foregoing. Computer-readable storage media as used herein should not be construed as being inherently transitory signals, such as electric waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission medium (e.g., light pulses passing through a fiber optic cable), or electrical signals transmitted through wires.

[0096] The computer readable program instructions described herein can be downloaded from the computer readable storage medium to the respective computing / processing device or to an external computer or external storage device over a network, such as the Internet, a local area network, a wide area network, or a wireless network, or a combination thereof. The network may comprise copper transmission cables, optical transmission fiber, wireless transmission, routers, firewalls, switches, gateway computers, or edge servers, or a combination thereof. A network adapter card or network interface for each computing / processing device receives the computer readable program instructions from the network and forwards the computer readable program instructions for storage on the computer readable storage medium within the respective computing / processing device.

[0097] The computer readable program instructions for carrying out the operations of the present invention may be source or object code written in any combination of one or more programming languages, including assembler instructions, instruction set architecture (ISA) instructions, machine language instructions, machine dependent instructions, microcode, firmware instructions, state setting data, configuration data for integrated circuit devices, or object oriented programming languages ​​such as Smalltalk®, C++, or the like, and procedural programming languages ​​such as the “C” programming language or similar programming languages. The computer readable program instructions may run entirely on the user's computer, or partially on the user's computer, as a stand-alone software package, or partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection may be made to an external computer (e.g., through the Internet using an Internet Service Provider). In some embodiments, electronic circuitry including programmable logic devices, field programmable gate arrays (FPGAs), or programmable logic arrays (PLAs) may execute computer readable program instructions by utilizing state information of the computer readable program instructions to individualize the electronic circuitry to perform aspects of the present invention.

[0098] Aspects of the present invention are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer readable program instructions.

[0099] These computer readable program instructions may be provided to a processor of a computer or other programmable data processing apparatus to produce a machine, the instructions executing on the processor of the computer or other programmable data processing apparatus to produce means for performing the functions / acts specified in one or more blocks of the flowchart illustrations and / or block diagrams. These computer readable program instructions may also be stored on a computer readable storage medium such that the computer readable storage medium having stored thereon an article of manufacture including instructions for performing aspects of the functions / acts specified in one or more blocks of the flowchart illustrations and / or block diagrams, capable of directing a computer, programmable data processing apparatus, or other device, or combination thereof, to function in a particular manner.

[0100] The computer readable program instructions may also be loaded into a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable apparatus, or other device to produce a computer-executed process to perform the functions / acts specified in one or more blocks of the flowchart illustrations and / or block diagrams.

[0101] The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in the flowcharts or block diagrams may represent a module, segment, or portion of instructions, including one or more executable instructions for implementing a specified logical function. In some alternative implementations, the functions noted in the blocks may be performed out of the order noted in the figures. For example, two blocks shown in succession may in fact be performed as one step performed simultaneously, substantially simultaneously, in a partially or fully time-overlapping manner, or the blocks may sometimes be performed in reverse order depending on the functionality involved. It is also noted that each block in the block diagrams and / or flowchart illustrations, and combinations of blocks in the block diagrams and / or flowchart illustrations, may be executed by a special-purpose hardware-based system that performs the specified functions or acts or executes a combination of special-purpose hardware and computer instructions.

[0102] The description of various embodiments of the present invention has been presented for illustrative purposes, but is not intended to be exhaustive or limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the present invention. The terminology used herein has been selected to best explain the principles of the embodiments, practical applications, or technical improvements over the art found in the marketplace, or to enable those skilled in the art to understand the embodiments disclosed herein.

Claims

1. 1. A computer-implemented method comprising: receiving, at an edge node, a message from an IoT device associated with the edge node, the message having at least one non-fungible token (NFT) embedded therein, each of the at least one NFT representing a corresponding authority associated with the IoT device; extracting, at the edge node, the at least one NFT from the received message; validating the received message at the edge node based on the retrieved at least one NFT; in response to verifying the received message, forwarding, by the edge node, the received message to a core node associated with the edge node; 4. A computer-implemented method comprising:

2. The computer-implemented method of claim 1 , wherein the at least one NFT is stored on a blockchain.

3. The computer-implemented method of claim 1 or 2, wherein the at least one NFT is provided to the IoT device during a registration phase of the IoT device.

4. The computer-implemented method of claim 1 , wherein the at least one NFT is associated with a unique identifier of the IoT device.

5. The computer-implemented method of claim 1 , wherein the corresponding authorities include information about resources the IoT device is authorized to provide.

6. The computer-implemented method of claim 5 , wherein for each authorized resource in an IoT network, a corresponding NFT is assigned.

7. The message is further signed with a private key associated with the IoT device, and verifying the received message. and validating, at the edge node, the received message further based on a public key corresponding to the private key associated with the IoT device.

7. The computer-implemented method of claim 1, further comprising:

8. 1. A computer program product comprising: One or more computer readable storage media and program instructions collectively stored on said one or more computer readable storage media wherein the program instructions include: and program instructions, at an edge node, for receiving a message from an IoT device associated with the edge node, the message having embedded therein at least one non-fungible token (NFT), each of the at least one NFT representing a corresponding authority associated with the IoT device; program instructions for extracting, at the edge node, the at least one NFT from the received message; program instructions at the edge node for validating the received message based on the retrieved at least one NFT; program instructions for forwarding, by the edge node, in response to verifying the received message, the received message to a core node associated with the edge node; A computer program product comprising:

9. 10. The computer program product of claim 8, wherein the at least one NFT is stored on a blockchain.

10. 10. The computer program product of claim 8 or 9, wherein the at least one NFT is provided to the IoT device during a registration phase of the IoT device.

11. 11. The computer program product of claim 8, wherein the at least one NFT is associated with a unique identifier of the IoT device.

12. 11. The computer program product of claim 8, wherein the corresponding authorization comprises information about resources the IoT device is authorized to provide.

13. 13. The computer program product of claim 12, wherein for each authorized resource in an IoT network, a corresponding NFT is assigned.

14. The message is further signed with a private key associated with the IoT device, and verifying the received message. and program instructions for validating, at the edge node, the received message further based on a public key corresponding to the private key associated with the IoT device.

14. A computer program product according to any one of claims 8 to 13, further comprising:

15. 1. A computer system comprising: One or more computer processors, one or more computer readable storage media, and program instructions collectively stored on the one or more computer readable storage media for execution by at least one of the one or more computer processors. wherein the program instructions include: and program instructions, at an edge node, for receiving a message from an IoT device associated with the edge node, the message having embedded therein at least one non-fungible token (NFT), each of the at least one NFT representing a corresponding authority associated with the IoT device; program instructions for extracting, at the edge node, the at least one NFT from the received message; program instructions at the edge node for validating the received message based on the retrieved at least one NFT; program instructions for forwarding, by the edge node, in response to verifying the received message, the received message to a core node associated with the edge node; A computer system comprising:

16. 16. The computer system of claim 15, wherein the at least one NFT is stored on a blockchain.

17. 17. The computer system of claim 15 or 16, wherein the at least one NFT is provided to the IoT device during a registration phase of the IoT device.

18. 18. The computer system of claim 15, wherein the at least one NFT is associated with a unique identifier of the IoT device.

19. 19. The computer system of claim 15, wherein the corresponding authorization includes information about resources the IoT device is authorized to provide.

20. 20. The computer system of claim 19, wherein for each authorized resource in the IoT network, a corresponding NFT is assigned.

21. A computer program comprising program code means adapted to carry out the method according to any of claims 1 to 7, when said program is run on a computer.

Images