Stateful Access Control Logic for IoT Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing IoT systems face challenges in efficiently managing access control for IoT devices, as system behavior objectives change based on device states, leading to errors in applying control data without explicit state information.
Innovation Solution
Incorporating explicit state information into control data, such as access control lists (ACLs), to ensure deterministic application of security policies, using state flags to filter requests and optimize for performance and power consumption, and storing only relevant ACLs locally while storing others remotely for efficient access control.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If control data is applied without explicit state information, then application speed is fast, but errors occur in applying security policies
Solution Approach 1:
The patent applies preliminary action by embedding device state information into control data structures before they are applied. Access control lists and other control data include state fields that specify the device state conditions under which they should be applied, allowing the system to pre-determine applicability without complex runtime analysis
Solution Approach 2:
The patent segments control data into multiple parts including control instructions and associated device state information. This segmentation allows the system to process and evaluate state conditions separately from the control actions, improving both accuracy and efficiency in policy application
2Productivity
If all access control lists are stored locally, then access control speed is fast, but device memory consumption increases
Solution Approach 1:
The patent segments the storage of access control lists between local and remote locations. Frequently accessed or critical ACLs are stored locally for fast processing, while less frequently accessed ACLs are stored remotely. This segmentation optimizes both access speed and memory utilization
Solution Approach 2:
The system implements a hybrid storage architecture where the same access control mechanism can operate with locally cached ACLs for speed-critical operations and remotely stored ACLs for memory-constrained scenarios, making the system adaptable to different performance and resource requirements
3Reliability
If device state information is not included in control data, then control data authoring is simple, but system behavior objectives change with device states leading to errors
Solution Approach 1:
The patent applies preliminary action by having control data authors pre-specify device state conditions when creating access control lists. State fields are embedded in the control data during the authoring phase, allowing the system to automatically determine applicability without requiring complex runtime state analysis or post-deployment configuration
Data Source
Figure 1
Figure 2A~2C
Figure 3
AI summary
In one embodiment, a system includes a processor having a first logic to execute in a trusted execution environment, and a storage to store a plurality of access control policies, each of the plurality of access control policies associated with a composite device state of the system and including an access policy for a resource to be protected by the first logic, where the first logic is to apply one or more of the plurality of access control policies to a request for access to the resource, responsive to a matching of the associated composite device state of the one or more access control policies with a current composite device state of the system. Other embodiments are described and claimed.