Distributed Access Policies for IoT Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Resource-constrained computing devices, such as those used in IoT applications, face challenges in implementing and managing access policies due to limited resources, leading to inefficiencies and potential inability to process access requests effectively as policies grow or load increases.
Innovation Solution
Implementing distributed access policies across multiple computing devices, where a first device with sufficient resources governs access for others, allowing for efficient authentication and authorization decisions to be made and communicated, thereby reducing the computational burden on individual devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If access policies are implemented on resource-constrained computing devices, then security and access control are improved, but device performance and operational efficiency deteriorate due to limited computational resources
Solution Approach 1:
The system segments the access policy management function from the resource-constrained computing devices and assigns it to a dedicated access policy computing device with sufficient computational resources. This segmentation allows the IoT devices to maintain security through policy enforcement while preserving their primary operational performance, as they no longer bear the computational burden of policy processing.
2Adaptability or versatility
If access policies are implemented on resource-constrained computing devices, then access control capability is improved, but device complexity increases beyond what the devices can effectively manage
Solution Approach 1:
The patent extracts the complex access policy management functionality from the resource-constrained computing devices and relocates it to a dedicated access policy computing device. This extraction enables the IoT devices to gain sophisticated access control capabilities without inheriting the complexity of policy management, as that function now resides externally on a more powerful system.
3Device complexity
If access policies are centralized on a single computing device, then policy management is simplified, but the system becomes vulnerable to single points of failure and performance bottlenecks
Solution Approach 1:
The patent transitions from a single-dimensional centralized policy management model to a multi-dimensional distributed architecture. The access policy computing device can operate in multiple modes: centrally managing policies for multiple IoT devices, or distributing policy processing to specific IoT devices based on their capabilities and the nature of access requests. This dimensional flexibility enhances system reliability by eliminating single points of failure while maintaining simplified policy management through coordinated control.
Data Source
AI summary
A first computing device of a plurality of computing devices in communication with one another via a communications channel receives, from a requesting computing device, an access request that identifies a subject, a resource identifier that identifies a resource, and an action, the first computing device having a set of access policies, each access policy corresponding to a particular resource of a plurality of resources. The first computing device determines that the resource identifier identifies a resource that is not governed by an access policy in the set of access policies. The first computing device sends, to the communications channel, the access request. The first computing device receives an access request decision from a second computing device of the plurality of computing devices, and the first computing device grants or denies access to the resource by the user based on the access request decision.