# Towards Flexible Integration of 5G and IIoT Technologies in Industry 4.0: A Practical Use Case
## 3 Building Technologies
### Hidra  
As previously mentioned, in the IoT scenarios designed for Industry 4.0, the sensors behave as small servers, and the users establish a secure E2E connection with them to either receive data or configure some parameters. In this context, strong access control mechanisms must be implemented, in order to guarantee that only authorized users can establish a connection with the devices. Moreover, due to the dynamic nature of the IIoT applications, these access control mechanisms should be flexible and expressive, so that they permit or deny the access to the users based not only on the permissions but also on the local context conditions. Figure 3: Traditional network versus software defined network. Hidra [36] is a security protocol that guarantees both authentication and authorization of a remote subject wanting to establish an E2E connection with a CDS. The aim of Hidra is to offer a strong and dynamic access control solution that can be implemented even in the most constrained devices. To provide expressiveness to the access control procedure, this protocol combines the centralized and distributed architectures, performing the authorization in two steps. On the one hand, the centralized server named Access Control Server (ACS) performs the authentication and preliminary authorization of the requesting subjects, discarding most unauthorized requests and hence avoiding unnecessary messages with the CDSs. On the other hand, to enable expressive context-based access control, each CDS is a distributed control point that performs the local authorization. This authorization is performed based on local context conditions such as the battery level of the sensor or the environmental parameters. The access decision is made after applying a very expressive security policy. Figure 4 shows the detailed operation of Hidra. First, in Phase 1, the Delegated Authentication of the user is performed, where the user authenticates to the ACS and requests a Ticket Granting Ticket (TGT). In the case of successful authentication, the ticket is sent to the user. In Phase 2, the Preliminary Authorization is performed in the ACS, based on the attributes of the user, on the resource, and on the expected actions. The subject uses the TGT to demonstrate that it is an already authenticated entity and obtain the resource tickets required to access any resource on the CDSs. The Credential Manager (CM) of the ACS checks if the user has the proper permissions, and if so, it sends a message to the CDS containing the security policy to be applied. Besides, this message also contains a session key to be checked by the CDS in order to guarantee the freshness of the message. If Phase 2 has proved successful, as the user has already the ticket to access the CDS, in Phase 3, the Locally Authorized Security Association is performed in the CDS. When the user sends a message containing the ticket, the CDS applies the security policy previously received in order to make an access decision. The application of this expressive policy means that the access decision is made based on current local context conditions for every access attempt. If the CDS decides to permit the access, an E2E security connection is established between the subject and the CDS. Finally, in Phase 4, the Access Notification is performed, where the sensor sends to the ACS the details of the access attempt, both permitted and denied, for logging and accounting procedures. The use of the aforementioned expressive security policies requires the definition of a proper policy language. The policy language defined for Hidra consists of different structs, some optional and some mandatory, enabling the reduction of the policy length when simple policies are needed. These structs go nested one inside another starting from a basic \"Policy\" struct, as shown in Figure 5, and the  
Figure 4: Hidra operation. order is crucial so that the meaning of the policy does not change.