## 6 Security Solutions
### Service Security
#### 6.3.4 Capability-Based Access Control  
**Centralized CapBAC:** [PERSON] et al. [136] proposed a CapBAC framework for IoT systems. The proposed framework introduces a cloud entity named Policy Decision Point (PDP) that manages the assignment of capability tokens to the service consumers, such  
Figure 20: Access-control approach. Policy Decision Point (PDP) is a service that makes authorization decisions. PDP is either offered by an external entity or embedded into an IoT device. as users and client IoT devices. The PDP also validates a capability token to determine whether a consumer is privileged to access certain IoT services. In the proposed system, an IoT device acts as a Policy Enforcement Point. A consumer makes a service request to a service provider and attaches its capability token with the request. The service provider (an IoT device) forwards the capability token to the PDP. The PDP evaluates the capability token against the access policies defined for the consumes and decides whether the consumer will be given access to the requested service. An assertion-based authorization framework was proposed in [137]. The proposed system utilizes XACML [165] and SAML [165] for authorization process and assertions, respectively. The SAML providers a large number of authorization features. The adoption of all the features can introduce communication overheads for delivering the assertions. To simplify the process for IoT devices, the framework defines a subset of the SAML standards and proposes message formats to encode assertions in JSON [166]. The evaluation of the XACML policies can be a resource-intensive task for IoT devices. Therefore, the proposed system outsources most of the tasks involved in making authorization decisions to a backend authorization servers and have end devices perform only the authorization enforcement. [PERSON] et al. [138] proposed an authorization framework based on Kerberos [167] and RADIUS [168]. In the proposed framework, a cloud service provides authentication, authorization, and account management for users and devices of an IoT system. However, the applicability of the proposed framework to IoT environments cannot be confirmed because the authors do not provide an evaluation of the framework in terms of resource efficiency. **Distributed CapBAC:** [PERSON] et al. [139] proposed a CapBAC framework based on the distributed PDP principle. The proposed framework considers a distributed approach without intervention of external entities, such as central authorization servers and services. The distributed architecture enables smart devices to be embedded with all the access-control logics. The authorization process is performed by an IoT device that evaluates the access-control logics defined for a requester and accepts or rejects a request based on the evaluation result. The proposed framework also provides support for authorization delegation and traceability of the access. The authorization scheme [140] is also based on the distributed CapBAC model. A user or client device requests a service and attaches an access ticket with the request. The user's ability to access the requested service is included in the access ticket. The ticket also includes a cryptographic message digest that is used determine the authenticity of the capabilities. In the proposed model, capabilities are stored in a smart device and the device performs the authorization process, such as policy evaluation and capability verification. To restrict communications to authorized users, a delegation-based authorization framework based on the CapBAC model is proposed in [141]. In the proposed framework, a Delegation Server, preferably an IoT Gateway, performs the authorization process for an IoT device. The Delegation Server detects a connection request from a remote user to an IoT device and authenticates the user. The access control policies for the user are defined in a database. After authentication, the Delegation Server checks the database and ensures that the user is authorized to make a request to the device.