# Blockchain-Based Secured Access Control in an IoT System
## 4 Related Work  
The related work in this paper can be classified into three main categories, with slight overlap between them: current security control solutions in IoT [1; 2; 5; 13; 14; 15; 16; 17; 18; 19; 20; 21; 22; 23; 24; 25; 26]; multi-agent systems for access control [27]; and blockchain-based access control for IoT [3; 7; 8; 9; 10; 11; 12]. [PERSON] et al. [1] presented a comprehensive review of the current access control solutions in IoT based on Objectives, Models, Architecture and Mechanisms (OM-AM). Moreover, the paper proposed a taxonomy based on the authors' comprehensive review. The paper analyzed the strengths and weaknesses of access control models and protocols regarding the IoT environment. Furthermore, they presented a decentralized access control framework called FairAccess [10] for IoT, based on a blockchain. The framework used the Pseudonymous technique to ensure the privacy of the users. They proposed a new type of transaction that is used to grant, obtain, delegate and revoke access based on access tokens. This is based on an Attribute-Based Access Control model. The authorization mechanism of FairAccess is based on authorization tokens, which provide access rights to a specific resource, identified based on its address and smart contract expressing its access control policies, to the requester or receiver. Nevertheless, this framework may cause a delay due to owner communication, authorization through tokenization only and terminating a token or requesting new access from the owner. [PERSON] [8] proposed scalable decentralized access management based on blockchain technology for IoT devices. The architecture excluded IoT devices from the blockchain network in order to overcome network overheads. The system has several advantages in relation to access control in IoT, namely mobility, accessibility, concurrency, lightweight architecture, scalability and transparency. This framework has managers that enable the registering of IoT devices and their verification. Even though this solution gains scalability as a result of distributing query permissions via management hubs, it could encounter security threats if the manager is malicious. [PERSON] et al. [12] proposed a lightweight architecture for securing IoT using private blockchain technology. The proposed solution uses an access control list for ensuring authorization and their architecture encompasses three main models, namely smart homes, an overlay network and cloud storage. This solution stores the access control policies in the policy header of a local blockchain and does not use a Proof of Work (PoW) consensus to validate blocks as all IoT devices in the smart home tier are controlled by the miner. They argued that the overheads of the solution are insignificant compared to its security gains. However, the proposed architecture is a smart home application-based solution, which is not a generic solution and may not apply to other IoT domains. Moreover, this mechanism does not support self-enforced access control policies. [PERSON] et al. [27] proposed a framework based on a multi-agent system for access control in the cloud and bring your own devices (BYODs) environments by addressing several security and privacy issues related to BYODs, such as the leakage of sensitive information and unauthorized policy changes. They proposed an architecture to address security and privacy issues by incorporating Mandatory Access Control policies in the cloud and BYOD environments delicately and securely with an independent platform. [PERSON] et al. [13] proposed an authentication and access control mechanism for an IoT infrastructure by establishing an ECC (Elliptic Curve Cryptosystem)--based security key and using an RBAC authorization method based on the user's role. The proposed solution is not scalable in an IoT environment due to the large number of users and the inability of RBAC to assign permission in advance. The proposed protocol requires frequent message exchanges and the security assessment is not strong. [PERSON] et al.