A Novel Scheme for Access Control Policy Generating and Evaluating in IoT Based on Machine Learning.

Yinyan Zhao,Mang Su,Jie Wan,Jinpeng Hou,Dong Mei

DOI: https://doi.org/10.1109/ithings-greencom-cpscom-smartdata-cybermatics50389.2020.00079

2020-01-01

Abstract:The ever-increasing demand for data exchanges has boosted the development of the Internet of Things (IoT). IoT has brought a new revolution to a variety of industries by integrating smart devices as well as information and communication technologies into traditional systems. However, due to the dynamic and heterogeneous structure of IoT, unauthorized access and data leakage may be much easier. Attribute-based access control (ABAC) is suitable for complex and changeable access control environments due to its flexibility and universality in capturing authorizations in terms of the attributes of users and resources. However, the dynamic nature of IoT bring new challenges to access control. On the one hand, new services and applications continue to be deployed, administrators need to formulate new policies for those services and applications. Therefore, manual development of ABAC polices in IoT environment is time consuming and expensive. On the other hand, because the access environment is constantly changing, access control policies may become unsuitable for current environment. Manual identification of these low-quality rules is often after they cause severe consequences. To address the above two problems, we propose a scheme for generating and evaluating polices in IoT based on machine learning. This scheme referred to as PGEML, contains two module, policy generalization (PG) and policy evaluation (PE). In the PG module, we define a novel measure, resource similarity, and integrate it into policy mining so that policies could generalize among related resources. In the PE module, we introduce a quantitative method to assess rules and prune rules of low-quality. We conduct our experiments on a real-world enterprise access logs from Amazon. The experimental results has qualitatively and quantitatively showed the effectiveness of our proposed scheme.