## 1 Introduction  
Internet-based services have evolved fast in the last decade, encouraging the creation of new technologies and the development of existing ones. Furthermore, massive use of the Internet has resulted in an increased number of data generators and consumers, making it especially important to meet the challenges of protection and access control for these data [1]. Parallel to the growth of Internet-based services, the interconnection of devices, sensors, and other objects has resulted in the Internet of Things (IoT) paradigm [2]. Machine to Machine (M2M) protocols have arisen in order to meet the needs of interconnecting local environments, and have been used as the foundation of this new model. Initially, IoT protocols were used to collect data generated by autonomous devices (e.g., for storage), or to request simple actions to be performed. Therefore, the main design goal in this context has been keeping communications as lightweight as possible, given the constraints of the involved devices in terms of autonomy, memory, computational capabilities, etc., and of the underlying networks [3]. Because of this, these protocols prioritized characteristics such as simplicity or lightness versus other characteristics such as security. This has produced a slower evolution with respect to these issues compared to the Internet protocols. In this work, we propose modelling the main constituent elements of Internet communication protocols as resources that can be protected by using the access control schemes created for Internet-based services. To achieve this, after studying the main communications protocols, and the most important access control schemes which can be used in IoT environments, we have selected a schema based on the Open Authorization (OAuth) 2.0 profile called User-Managed Access (UMA) [4], designed mainly for Web-based services, which offers a great deal of granularity in access control. The OAuth 2.0 protocol [5] is a de facto standard to solve this situation, while offering a high level of granularity and ease of use. The main component in OAuth is the authorization server, which performs the access control tasks. Regarding communication protocols, we have chosen Message Queuing Telemetry Transport (MQTT) [6] because it is one of the most used communication protocols in IoT and uses a publish/subscribe pattern, which is different from the usual request/response scheme followed by Internet services. An initial proposal of this work was presented in the 5 th International Symposium on Sensor Science (IJS 2017) [7]. One of the main challenges of an authorization system for IoT is dealing with the complexity of this kind of environment. The main advantages of the unified authorization system that we present in this work are the easier management of resource protection and the ability to apply the same access control rules defined for Web Services to IoT elements. This paper contributes to this goal in the following ways:  
* We analyse the different protocol types used widely in these kinds of environments, and then the access control schemes proposed for them (Section 2). * We propose to model the main elements of an IoT communications system such as MQTT as resources that can be protected along with other Internet-based services using a unified authorization system (Section 3). * We propose the integration of an authorization layer, based on an OAuth 2.0 profile, into the chosen IoT communications protocol. This layer allows us to protect both Internet-based services and sensors/actuators through IoT devices. We describe the steps of each of the phases of the authorization system (Sections 3.1 and 3.2). * We define a series of experiments where we describe the entities of our proposal, the test set-up, and the effects, in time and electric consumption overhead of applying our proposal to the protocol (Section 4). After analysing the results obtained in Section 4.2, we conclude that our proposal is not only feasible but also shows a good performance in the evaluated fields.