# Blockchain-Based Secured Access Control in an IoT System
## 4 Related Work
[14] improved the efficiency at a minimal communication cost by incorporating secure session key establishment, maintaining user anonymity and mutual authentication. However, this solution is lacking in terms of its protection of the integrity of the transmitted messages. Both role- and credential-based access control models cannot be directly applied to IoT due to their inherited disadvantages, as discussed before. However, using the strengths of these models and combining them with other models can overcome theirweaknesses. Moreover, [PERSON] et al. [15] proposed a hybrid role- and Attribute-Based Access Control model to target large-scale dynamic users by keeping policy integrity intact. They also proposed a mechanism to resolve policy conflicts and redundancy. Granting permissions and role management are still the responsibilities of the administrator in the proposed model. [PERSON] et al. [16] proposed an activity control mechanism (a generalized version of context-aware access control) by focusing on user and system preferences to grant or deny access. They used Ciphertext-Policy Attribute-Based Encryption (CP-ABE) and a finite state machine for dynamic access policy adaptation. [PERSON] et al. [17] also targeted the key/attribute revocation problem by proposing a Batch-Based CP-ABE method. The proposed mechanism does not require extra nodes for processing and reduces the overall complexity and overheads. The Cap-BAC model is based on the least privileged principle for access service management. The service provider requires an authorization certificate from the user to give access to the required resources. [PERSON] et al. [18] proposed a Unified Modeling Language (UML) conceptual model to define privacy policy definitions and data quality assessment in order to lay the foundation for the development of a secure and private IoT-based environment. Moreover, [PERSON] et al. [19] proposed a secure architecture to establish and manage medical prescriptions in a mobility context by using Radio Frequency Identification (RFID) technology. [PERSON] et al. [20] proposed a capability-based approach to address IoT access control issues with low computation and storage capabilities, which requires lightweight secure control access policies. Moreover, [PERSON] et al. [21] proposed a trust-aware lightweight access control mechanism to provide a reliable and secure link between connected devices in an IoT environment. They proposed a novel trust model based on the trust values accumulated from Quality of Service (QoS), security measures and reputation. As the identities of devices are not known in a distributed and decentralized IoT environment, this makes trust management a core issue to address. [PERSON] et al. [22] proposed an energy-efficient trust-based dynamic access control framework by capitalizing on the fuzzy approach to trust calculation from linguistic information gained from IoT devices. In Mandatory Access Control (MAC), an individual or a group with the authority to grant access rights to a resource grants access control. This is mostly implemented in government organizations and access is granted based on the sensitivity label associated with that particular resource. Nippon Telegraph and Telephone (NTT) Innovation Institute [23] proposed a Mandatory Access Control mechanism for securing an IoT framework and hosting policy administration points by forcing unauthorized communications to shut down. They eased the administration of policies by incorporating attribute-based control policies. [PERSON] et al. [24] proposed a distributed authorization framework by keeping the number of messages exchanged between resource-constrained devices to a minimum. [PERSON] et al. [25] proposed a public key-based protocol to gain secure access and communication between embedded devices by specifying numerous authentication and access control policies. The proposed protocol requires frequent message exchange to make a secure connection and it does not conform to industry standards.