# SoK: Delegated Security in the Internet of Things
## 5 Security Evaluation of Existing Protocols
### Process and Results of Security Evaluation
#### 5.2.3 Rights Delegation  
In this domain, the delegation of rights in IoT based on Blockchain technology [23] (see Section 2.3, Figure 5) is discussed. Following Definition 5, \(\mathcal{A}_{weak}\) initially receives as an input list \(F\) identified parties which are remotely reachable by \(\mathcal{A}_{weak}\). \(\mathcal{A}_{middle}\) and \(\mathcal{A}_{strong}\) receive as input the access matrix \(M\); hence, they are aware of all participants of the system, and their legitimate access. Also, they all can query ThP. In this application domain, \(\mathcal{A}_{weak}\) has access to two oracles (Del, ThP). The absence of corruption capability leads to the impossibility of \(\mathcal{A}_{weak}\) to obtain any secrets. For example, an attempt to request \(\mathcal{RP}\) for \(\mathcal{R}\) cannot be successful for unauthenticated \(\mathcal{A}_{weak}\), because of recurring validations within the blockchain. Therefore, if \(\mathcal{A}_{weak}\) queries the resource manager acting as \(\mathcal{TP}\) via ThP without a valid \(\mathcal{RP}\), ThP will return \(\bot\). Also, \(\mathcal{A}_{weak}\) cannot compromise parties and manipulate available data; hence, the integrity of the data is ensured. In order to violate the availability of the system, \(\mathcal{A}_{weak}\) can perform DoS attacks against the resource manager by requesting access to \(\mathcal{R}\); however, first, recurring validation of a user prevents illegitimate items from making several requests; second, suspicious amount of requests leads to restrictions of suspicious items. DoS attacks against the buyer acting as \(\mathcal{D}\) do not influence system functionality, since \(\mathcal{A}_{weak}\) is only able to run attacks during \(C\) time, so the buyer can continue its operations after a DoS attack is finished. Summarising the above, it can be concluded that this system is completely secure from \(\mathcal{A}_{weak}\) with respect to all three security goals.  
Since \(\mathcal{A}_{middle}\) can query Obs and hence can observe communication. However, a blockchain-based network and smart contracts prevent the violation of data confidentiality and integrity. Considering the \(Ex^{+}\) relation to the system of \(\mathcal{A}_{middle}\), they can have accomplices within the system, e.g., the resource manager. Hence, \(\mathcal{A}_{middle}\) can compromise resource \(\mathcal{R}\) and retrieve some information about the buyer or broker or tamper with their data. Also, corruption of the resource manager and its \(\mathcal{R}\) leads to possible incorrect system behaviour, when the legitimate buyer with valid \(\mathcal{RP}\) does not have access to the desired \(\mathcal{R}\), for instance, if the list of approved users is modified. Therefore, this system is not secure against \(\mathcal{A}_{middle}\) regarding all CIA-Triad.  
Despite \(\mathcal{A}_{strong}\) has more resources and capabilities than \(\mathcal{A}_{weak}\) and \(\mathcal{A}_{middle}\), it does not give \(\mathcal{A}_{strong}\) a significant advantage in the results they can achieve by attacking this system in comparison with others. In order to obtain or manipulate information during the transfer of the right, \(\mathcal{A}_{strong}\) should compromise the majority of nodes, which we assume is not possible even considering available \(It\) time. Therefore, \(\mathcal{A}_{strong}\) can perform similar attacks to \(\mathcal{A}_{middle}\), and the system is secure against \(\mathcal{A}_{strong}\) with respect to all three security properties.