# Feasibility Assessment of a Fine-Grained Access Control Model on Resource Constrained Sensors
## 2 State of the Art  
In the last several years, the research area related to security in IoT has received significant attention, therein addressing the design of different architectures, security protocols and policy models. However, security in general and access control in particular remain the main obstacle in the development of innovative and valuable services [10]. Traditional security countermeasures cannot be applied directly to CDSs in IoT scenarios because they are too resource consumptive and not optimized for resource-constrained devices. Specifically, current feasible E2E access control approaches do not implement an expressive and therefore fine-grained and tight security policy enforcement [5]. For feasibility reasons, a centralized architecture based on traditional standards and protocols, where a central access control server (ACS) with no resource constraints makes authorization decisions for each access request, could initially be a possible option. However, this approach does not consider local context conditions in CDSs, and it implies high energy consumption as well as network overhead due to continuous communications between the CDSs and the ACS. A recent alternative approach is the distributed capability-based access control (DcapBAC) [18], where an unforgeable token exchangeable as a capability grants access to its holder in a more agile manner. However, the token is designed in an XML schema and has not been validated in resource-constrained devices. Regardless, this approach has been adopted by other designs involving technologies specifically defined for IoT, which enable CDSs to make local authorization decisions based also on local conditions [19], since the capabilities might include conditions represented as tuples (type, name, value). On the other hand, this approach is based on public key cryptography (PKC), which is more expensive than symmetric key cryptography (SKC) in terms of resource consumption. Additionally, the conditions are limited to simple matching because the approach does not support expressions. Moreover, its syntax is not optimized in terms of codification since it uses JSON; it does not support the enforcement of additional obligations, and it has been validated in not-so-constrained C2 devices. Along this line, the delegated CoAP [20] authentication and authorization framework (DCAF) [21] defines a token to distribute pre-shared keys, and if authorized, a handshake is performed to establish a DTLS channel. Local authorization policies are specified as conditions serialized in a concise binary object representation (CBOR), instead of JSON, aiming at compacted payloads in the CoAP protocol. However, CBOR is a general-purpose serialization solution [22], and the resulting compression is not sufficiently optimized for security policies in very constrained C0 and C1 devices, where fine-grained access control is achieved through a higher but feasible policy language expressiveness, beyond conditions consisting of the simple constant matching of existing local attributes. Along the other line, the usage control model and the attribute-based policy schema [23] extend traditional access control systems to a continuous protection of resources during access by the definition of obligations to enforce usage control. However, there are no approaches addressing the feasibility in CDSs. Finally, concerning protocols specifically optimized for mutual authentication during the E2E security association in a secure session, Ladon [24], which is inspired in Kerberos, has demonstrated its feasibility and security for very-constrained devices C0 and C1 CDSs. All these aforementioned proposals fail in the expressiveness of the policy because of the infeasibility in the C0 and C1 CDSs. In fact, the challenge of any expressive policy language is to overcome the resource constraints of the CDSs when enabling the definition of fine-grained policies to be provisioned and enforced in the CDS to comply with the least privilege principle.