# Feasibility Assessment of a Fine-Grained Access Control Model on Resource Constrained Sensors
## 1 Introduction  
The Internet of Things (IoT) concept embraces an interconnected network of things, the smarter the better, contributing to a higher awareness, enhanced decision making, and more adaptive behavior of systems supporting any business process, integrating pervasive and ubiquitous information and communication technologies. IoT also implies a massive deployment of sensors and actuators, which, with the goal of being inexpensive, are implemented in a range of constrained devices, constrained device sensors (CDSs) herein, classified according to IETF [1], from severely constrained C0 to less constrained C2. Specifically, the IETF defines a range of CDSs from class 0 (C0, less than 10 kB of data and less than 100 kB of code), class 1 (C1, approximately 10 kB data and 100 kB code), to class 2 (C2, 50 kB data and 250 kB code), with different purposes and different features, where [PERSON]'s law [2] is expected to move more slowly and will have a greater impact on price than on capacity [3; 4]. Moreover, depending on the use case and location, they may require power autonomy and, therefore, low-power-consumption mechanisms. In such IoT applications, security needs to tackle the large scale exposure of sensitive information and functionality, and access control, in particular, remains an insufficiently solved problem since current approaches are challenged by divergent properties such as tightness and feasibility. Precisely, traditional security countermeasures cannot be applied directly to CDSs in IoT scenarios because they are too resource consumptive and not optimized for resource-constrained devices. Besides, currentfeasible E2E access control approaches do not implement an expressive and therefore fine-grained and tight security policy enforcement [5]. In 2016, the Dyn cyberattack [6] caused multiple DDoS attacks to many services originating from devices connected to the Internet such as printers, cameras, etc. This attack is a representative case that demonstrates the insufficiency of the currently implemented security mechanisms in many IP things and the potential impact. Vendors and manufacturers are not paying enough attention to security. In this paper, we propose the experimental feasibility assessment of an innovative approach proposing an optimized access control model based on an expressive policy language enabling tight enforcement in CDSs, which is fully specified in [7]. This access control model includes a protocol named Hidra that enables secure provisioning and enforcement of dynamic security policies as well as an audit trail, and this protocol is the subject of a performance evaluation driven by a prototype implementation described in this paper. This paper is an extension of a previous paper entitled \"Feasibility assessment of a fine-grained access control model on resource constrained sensors\" [8] published in the Spanish Telematic Engineering Conference 2017 (JITEL 2017, 27-29 September 2017, Valencia, Spain). Concretely, in this extension, a full range of policy instances (beyond a unique exemplary one) and derived lengths have been specified to support a more complete impact analysis on the performance of the expressiveness and, therefore, the tightness of the policy to be enforced. The exhaustive policy spectrum used in the trials allows assessing the feasibility of the analyzed access control model in the whole set of envisioned use-cases and scenarios ranging in tightness from the simplest to the most thorough policy enforcement. Additionally, the effectiveness of the proposed policy codification is analyzed. Finally, the details of the Hidra test-bed implementation and the testing model are conveyed, which in the absence of any similar documented experimental analysis, might be used for further empirical performance analysis and benchmarking from now on. Figure 1 shows an IoT schema that conveys different roles in various domains, therein operating, monitoring and controlling related business processes through applications.