# Feasibility Assessment of a Fine-Grained Access Control Model on Resource Constrained Sensors
## 3 Access Control Model
### Authorization Policy Language and Codification
#### 3.2.2 Measurable Policy Instance Examples
IPv6 connectivity is depicted in Figure 5, which shows implemented protocol and software stacks in all entities involved in the performance evaluation scenario. The implemented network enables E2E IPv6 connectivity through a multi-hop IEEE 802.15.4 sensor network. It is straightforward in the workstations, and the border router, whereas the border routing sensor, the coordinator node and the endpoint CDS node require the proper installation and configuration of such IPv6 routing. Note that IPv6 Routing Protocol for Low-Power and Lossy Networks (RPL) [38] is configured in the sensor nodes to set a multi-hop hierarchical node network with neighbor discovery functionalities within the IEEE 802.15.4 network. The three different modules of the Hidra software described herein and their interactions are depicted in Figure 6, which notes main entities such as tickets, keys, session authenticator blocks as well as message authentication codes. Certain details, such as lifetimes, nonces, and IDs, are not represented for clarity purposes. * Hidra in the ACS side (_HidraACS_) is similar to the Key Distribution Center (KDC) in Kerberos, and it is made by different sub-modules listening in particular UDP ports: ANS, CM1, CM2 and LOG. Additionally, four different repositories are distinguished to support the management of identities, credentials, policies, active connections and logs. * The ANS module (_HidraACS.ANS_) is the authentication server in the ACS. For this purpose, an UDP socket is open at port 8888. Upon reception of every authentication request message, first, it checks if the message is for the ANS; then, it checks the identity of the subject on the repository, as shown in Listing 5. In the positive case, it generates a long-term ticket granting ticket (TGT) ciphered with the CM's secret key \(K_{CM}\). It also cyphers with the subject's secret key \(K_{S}\) a data block containing the shared key \(K_{S,CM}\) and a set of nonces for further sequence validation. It also records such a TGT in the active connection repository with a \(Nonce_{S,CM}\) and the corresponding lifetime. * The CM1 (_HidraACS.CM_) module is the credential manager. For this purpose, a UDP socket is open at port 8899. When this sub-module receives a subject's request to access a resource on the CDS, first, it checks the validity of the addressed CDS, as shown in Listing 6. Then, it deciphers the TGT and checks the validity of the request checking the \(Nonce_{S,CM}\). Then, it enforces the preliminary authorization supported by the authorization server AZS. In the positive case, it fetches and codifies the proper policy instance to be sent to the CDS in an indicative message \(HID\_CM\_IND\). In this indicative message, to assure its freshness, a new key value \(K^{i}_{S,CM}\) from a previously existing or just initiated one-way key chain \([K^{1}_{S,CM}....K^{N}_{S,CM}]\) is enclosed. It also responds to the subject with another message enclosing an encrypted service ticket only readable by the CDS. It finally records such a service ticket in the active session repository. * The CM2 module (_HidraACS.CM2_) is an auxiliary module of the CM1. It manages a key sequence for the assurance of the freshness of the policy provisioning message to avoid repetition attacks, as shown in Listing 7. For this purpose, a UDP socket is open at port 8866. It receives requests from the CDS when, after a parametrized set of trials of one-way functions over an initialized key, the CDS cannot properly validate the freshness of an indicative message \(HID\_CM\_IND\) from CM1. Therefore, once the validity of the request through the received MAC is checked, it sends back a new initial key value \(K_{S,CM}^{i+1}\) and the MAC for validation in a responsive message \(HID\_CM\_IND\_REP\). * The LOG module (_HidraACS.LOG_) implements the reception of the log messages coming from the CDS, as shown in Listing 8. For this purpose, a UDP socket is open at port 8869.