# Feasibility Assessment of a Fine-Grained Access Control Model on Resource Constrained Sensors
## 3 Access Control Model
### Authorization Policy Language and Codification
#### 3.2.2 Measurable Policy Instance Examples
51 'eucitate'. 52 'eucitate'. 53 'eucitate'. 54 'eucitate'. 55 'eucitate'. 56 'eucitate'. 57 ]. 58 ]. 59 ]. 60 {
61 'function': 'iCrea'. 62 'impus': [
63 'type':'mRemnant'. 64 'eucitate'. 65 'eucitate'. 66 'eucitate'. 67 'eucitate'. 68 'eucitate'. 69 'eucitate'. 70 ]. 71 'eucitate'. 72 'eucitate'. 73 'eucitate'. 74 ]. 75 ]. 76 ]. 77 ]. 78 ]. Such a policy instance shown as a JSON text file (798 bytes) is shorter in a minimized JSON format and can be made even shorter if it is pre-processed by applying some semantic codes, as shown in earlier examples. Thus, the length of the resulting optimized JSON file (JSON') is 554 bytes, which is significantly shorter. The codification of such a policy instance results in a bit stream of 258 bits packed in 32 bytes. This example is illustrative of the incremental effectiveness of the proposed codification. The length of the policy instances grows significantly with the tightness of the enforcement. Table 3 shows the detailed lengths of the four examples of sample instances previously presented (\(IS_{i}\)) and their expressiveness in terms of enclosed constructs. To assess the compression factor of the proposed codification, it is also pertinent to compare the resulting lengths with the existing representations and serializations of the policy instances. The exemplary sample instances (\(IS_{i}\)) as represented in JSON and CBOR result in the lengths shown in Table 4, where the authorization policy binary representation proposed in the access control model under the feasibility assessment is denoted by the Authorization Policy Binary Representation (APBR). According to the resulting lengths shown in Table 4, the JSON format policy instances, which are the de-facto standard adopted in CoAP, are excessively long in comparison. Furthermore, after pre-processing the JSON representation with identifiers and PDM-related semantic conventions, \begin{table}
\begin{tabular}{c c c c c c} \hline \hline \multirow{2}{*}{**Representation**} & \multirow{2}{*}{**Nature**} & \multicolumn{4}{c}{**Length (Bytes)**} \\ \cline{3-6}  & & \(IS_{1}\) & \(IS_{2}\) & \(IS_{3}\) & \(IS_{4}\) \\ \hline JSON & Human-readable text & 30 & 164 & 236 & 798 \\ \hline JSON’ & Pre-processed text & 23 & 118 & 174 & 554 \\ \hline CBOR & Binary stream & 14 & 81 & 123 & 391 \\ \hline APBR & Optimized binary stream & 2 & 7 & 9 & 32 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Length comparison for different representations of four examples of sample instances. \begin{table}
\begin{tabular}{c c c c c c c c} \hline \hline \multirow{2}{*}{**Sample**} & \multirow{2}{*}{**Rules**} & \multirow{2}{*}{**Conditions**} & \multirow{2}{*}{**Inputs**} & \multirow{2}{*}{**Obligations**} & \multirow{2}{*}{**Re-Evaluation**} & \multirow{2}{*}{**Length (Bits)**} & \multirow{2}{*}{**Length (Bytes)**} \\ \hline \(IS_{1}\) & 0 & 0 & 0 & 0 & no & 10 & 2 \\ \(IS_{2}\) & 1 & 1 & 1 & 0 & no & 53 & 7 \\ \(IS_{3}\) & 1 & 1 & 1 & 1 & no & 67 & 9 \\ \(IS_{4}\) & 2 & \(3+3\) & \(1+1\) & \(1+1\) & yes & 258 & 32 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Examples of policy instance samples. the resulting lengths are still excessive. The CBOR format results in shorter lengths than JSON, but they are still longer than the proposed approach because they are not optimized for policy specification and interpretation purposes. Consequently, the proposed policy codification, APBR, achieves the best compression factor. APBR is the shortest; therefore, it can be anticipated to produce the smallest impact on storage, transmission and processing. ### Hidra Messaging Protocol

To efficiently convey the presented access control policies to the CDSs, the Hidra protocol is considered. Hidra, depicted in Figure 4, is based on a three-party architecture and provides authentication and authorization in two steps: dynamic policy provisioning and accounting.