A Unified Access Control Model for Calibration Traceability in Safety-Critical IoT

TL;DR

This paper introduces a new unified access control model tailored for calibration traceability in safety-critical IoT, addressing confidentiality and operational requirements unmet by classical models.

Contribution

It proposes a novel unification of BIBA, BLP, and Chinese Walls models, and develops an XACML-based framework to enforce this model in calibration ecosystems.

Findings

The unified model outperforms simple conjunctions of existing models.

It effectively manages complex information flow requirements in calibration processes.

The framework enhances confidentiality and operational security in safety-critical IoT.

Abstract

Calibration plays an important role in ensuring device accuracy within safety-critical IoT deployments. The process of calibration involves a number of parties which must collaborate to support calibration. Calibration checks often precede safety-critical operations such as preparing a robot for surgery, requiring inter-party interaction to complete checks. At the same time, the parties involved in a calibration ecosystem may share an adversarial relationship with a subset of other parties. For instance, a surgical robot manufacturer may wish to hide the identities of third-parties from the operator (hospital), in order to maintain confidentiality of business relationships around its robot products. Thus, information flows that reveal who-calibrates-for-whom need to be managed to ensure confidentiality. Similarly, information about what-is-being-calibrated and how-often-it-is-calibrated may compromise operational confidentiality. For example, calibration-verification of connected medical devices may reveal the timing of surgical procedures and compromise PII when combined with other meta information. We show that the challenge of managing information flows between the parties involved in calibration cannot be met by any of the classical access control models, as any one of them or a simple conjunction of a subset such as the lattice model fails to meet the desired access control requirements. We demonstrate that a new unified access control model that combines BIBA, BLP, and Chinese Walls holds rich promise. We study the case for unification, system properties, and develop an XACML-based authorisation framework which enforces the unified model. Upon evaluation against a baseline simple conjunction of the three models individually, our unified model outperforms this, demonstrating it is capable of solving the novel access control challenges thrown up by digital-calibration supply chains.

Full text

1 Introduction

Many safety-critical IoT (SC-IoT) systems, such as surgical robots, are employed to address the need for higher levels of accuracy and precision. For example, the Robodoc surgical robot has shown a decrease in the number of complications in hip surgeries by providing higher accuracy for implant sizing and positioning within the bone compared to traditional surgery [5]; and in autonomous vehicles, a variety of sensor devices are heavily relied on to provide assistance for real-time decision making [27]. This has led to an increased desire in the adoption of such systems in high-assurance environments, where the system can outperform relative traditional methods with lowered risk of complications.

While IoT device security and privacy has received a lot of attention [16, 1, 10], the security of calibration has received little attention. Calibration processes involve many parties. These parties form a hierarchy of other calibrated devices within which they interact (Figure 1). First, at the field level we have device operators who control, interact with and maintain the system and its components. Second, we have one or more intermediary calibration facilities who employ technicians which interact with other calibrated devices within the hierarchy. Finally, we have National Measurement Institutes (NMIs) at the highest level, such as NIST (USA) and NPL (UK), who maintain homeostatic control within the hierarchy.

While many of these parties do cooperate in harmony, for example NMIs who manage publicly available calibration information and act as the root of trust, a subset of them may share an adversarial relationship (in direct competition with one another). For example, Uber holds a fleet of autonomous cars which employ a number of sensors (i.e. LIDAR, infrared (IR), RADAR, etc.) that require calibration to make sure that all sensed data is accurate and reliable. Some of these devices may be calibrated by a third-party calibration service provider (i.e. an intermediary facility) who they may wish to remain confidential to show other parties (i.e. business partners) that they are responsible for their own calibration, helping to maintain the business relationships surrounding its autonomous fleet. By revealing this information to parties in competition, the confidentiality surrounding among the participants (who-calibrates-for-whom) would be compromised. Furthermore, although protecting the confidentiality of business relationships surrounding parties with conflicts-of-interest, the information regarding what devices are calibrated and how frequent these calibration processes are carried out can also compromise the operational confidentiality of SC-IoT deployments. For instance, if we consider a technician from a third-party calibration facility who calibrates for Uber, to calibrate devices for autonomous vehicles at another organisation (i.e. Lyft), information about what devices are being calibrated at Uber and internal calibration processes could be leaked to them. Similarly, by monitoring the calibration processes for sensors in autonomous vehicles, it is possible to map the operational usage of these components. For instance, by monitoring calibration-verification of LIDAR sensors, collecting the calibration offsets and other meta-data, it is possible to reveal how these sensors are used.

Ultimately, we observe that the potential compromise of calibration integrity and confidentiality, and the adversarial relationships (conflict) between interacting parties in the calibration ecosystem, present us with a unique set of information flows where meta-information such as what is calibrated, how often it is calibrated and who calibrates for who, need to be managed. Importantly, a solution that can manage these information flows requires all stakeholders to work together, presenting us with an interesting access control challenge. While existing access control models such as Chinese Walls may provide some benefit, we note that individual models or a combination of such would fail to control the information flows. Therefore, an effective solution to address this should satisfy the following requirements:

1. ($R_{1}$)

How can we manage the adversarial relationships between a subset of interacting parties in the calibration ecosystem, to avoid unintended disclosure of information? 2. ($R_{2}$)

How can we protect the confidentiality of business relationships (who-calibrates-for-whom) whilst providing transparency for calibration processes? 3. ($R_{3}$)

How can we ensure operational confidentiality of SC-IoT deployments by protecting what-is-being-calibrated and how-often-it-is-calibrated? 4. ($R_{4}$)

As many SC-IoT systems are time-critical, how can we support calibration processes to be carried out efficiently (on-the-fly) whilst ensuring $R_{1}$–$R_{3}$?

In this paper, we propose an access control model that unifies the BIBA, BLP and Chinese Walls models which satisfies the above requirements. The rest of the paper is organised as follows. In Section 2, we further detail the inadequacies of the current state-of-the-art in calibration and access control, and discuss the observed information flow constraints which demands a novel unification of BIBA, BLP and Chinese Walls. Following this, we detail our unified access control model in Section 3 and practically evaluate its performance using an attribute-based authorisation mechanism in Section 4. In Section 5, we provide a discussion of the presented work, provide related work in Section 6 and conclude in Section 7.

2 Calibration Traceability and Access Control: A Case for Unification

A key requirement for SC-IoT systems is to ensure that all components that make up such a system are highly accurate, with very low margin for error. While all aspects of security regarding SC-IoT is important, such as communication and control plane security [26, 13], the importance of calibration has been misunderstood.

Calibration is a key factor which contributes to the accuracy and reliability of our devices, such as the readings produced from sensing equipment. Simply put, the process of calibration is a comparison of a given device, such as a sensor in an SC-IoT system, with a more accurate (parent) device. Specifically, the accuracy and reliability of our device’s output is derived from its parent. However, while having our devices being calibrated is important, the validity of its calibration is key. An important requirement for valid calibration is having an unbroken chain of traceable calibration to national standards [25, 6] (Figure 2). This means that valid calibration requires a complete trace of calibration, starting with a comparison between our device and a more accurate parent device, who will then be compared against an even more accurate device, and so forth until we compare against a device that is as accurate as possible (where the accuracy and uncertainty of output is level with national standards).

With the considerations of SC-IoT systems, we observe several inadequacies with the current state-of-the-art in calibration traceability.

First, current calibration traceability processes are inefficient. As an output of calibration, a report (hereafter refered to as a calibration report) is produced, which details the information used in traceability verification (such as calibration offsets, uncertainty measurements, operating ranges, etc.). Furthermore, these are stored centrally within the organisation who carried out the calibration of the associated device. For example, a device calibrated by a technician at some intermediary calibration facility will typically have its report stored locally. To carry out verification checks (Figure 2), a subject (device owner, technician performing calibration, etc.) must first request the device’s report from the holding organisation. Once access is granted, the parent units of the device can be identified from the report and the reports for these devices must also be accessed, and so forth to national standards. While the process is relatively trivial to conduct, many SC-IoT systems are comprised of large numbers of devices, each of them having their own individual traceability chains. With this in mind, a verification process which ensures there is a complete chain of calibration for a single device could take a few hours but for an entire SC-IoT system, verification time would increase significantly.

Second, given that calibration reports are stored in different organisations for a single device’s traceability chain, each organisation could have their own security requirements to grant access to reading a report. For example, test and measurement devices used to calibrate military equipment could have their reports classed as confidential, or perhaps the organisation who owns the equipment wishes to remain secret to outsiders). Therefore, by verifying calibration along each step in a device’s chain could leak confidential information about how the device is used.

Third, while nonsensical, it is entirely possible that a technician at the field level in the chain could fabricate reports for (potentially non-existent) devices further up the chain, such as for intermediary calibration facilities or National Measurement Institutes (NMIs). As the calibration status of downstream equipment is dependent on upper levels, the integrity of calibration traceability and ultimately the device itself could be compromised. Furthermore, it is important to allow subjects conducting traceability verification checks at lower levels (i.e. the field level) to access reports at each upper level for completeness, while disallowing those operating at the field level to write reports for upper levels, and vice-versa.

Finally, the potential for conflicts of interest between competing calibration facilities arise. For example, a calibration technician who calibrates devices for one organisation, should not be allowed to calibrate devices for another, to avoid leaking potentially sensitive information about the device and the organisation’s internal calibration processes.

Upon observation of the problem space surrounding the current state-of-the-art, and the considerations surrounding SC-IoT, we can see that the key failures are provoked by varying access and security requirements for verifying calibration traceability within a multi-level hierarchy. Therefore, it is important to devise an appropriate solution that is not only highly efficient, but also robust to adversaries who target the confidentiality and integrity of such systems from the calibration attack vector, and the competitive nature of actors within the calibration ecosystem.

2.1 Information Flow Constraints

An important requirement for designing an effective solution that meets our requirements is to define the information flow constraints which should be enforced. If we design the solution well, coinciding with the multi-level hierarchy that is natural to traceability chains, we can ultimately reduce the number of critical components by an order of magnitude. For subsequent discussion, we refer to the information flow model depicted in Figure 3.

2.1.1 Multi-Level Integrity

Our first requirement is to maintain the integrity of calibration. By maintaining the integrity of calibration reports at the root level, we can reduce the damage inflicted to intermediate levels between the root level and the components which make up a safety-critical system. As a reminder, if compromise occurs at the root level in a traceability chain, then the validity of all subsequent levels towards the field level is put into question. By maintaining the integrity of calibration, we can limit any damage to its immediate locality, as opposed to inflicting widespread damage.

Overall, we observe that with respect to traceability, information flows from a high integrity source (the root calibration units at NMIs) to a low integrity destination (the components at the field level).

2.1.2 Multi-Level Confidentiality

The second of our requirements is to maintain confidentiality among participants whilst enabling transparency in traceability chains. Interestingly, we observed that it is relatively trivial to map components in traceability chains to real actors. For example, a component’s calibration report could reveal the facility at which calibration was carried out, as well as information that denotes a facility’s internal calibration processes. With consideration to NMIs, the information is globally available, so in this case the mapping of equipment here does not succumb to confidentiality concerns. However, in the case of intermediate levels, who do not wish to reveal information to other levels above or below them, the possibility of such a mapping becomes of real concern.

Furthermore, the timing of traceability verification checks could reveal information about system operations. For example, in the context of surgical robots, the timing of surgical procedures could be leaked as a result of monitoring verification checks and when combined with other sources of information such as patient admission and exit times, a violation of patient confidentiality is possible. As well as this, the verification process should not reveal information about the deployment to intermediaries involved between the deployed system and the public-facing NMI at the highest level. The reason for this is simple

• calibration traffic could leak information to parties further down the chain. For example, a device manufacturer may employ the services of a third-party calibration facility to calibrate the system’s sensors, but may not want to reveal who the third party is. Thus, the traceability chain should be verifiable in a manner, such that information about the setting where the system is deployed is not leaked to other facilities, and likewise from these facilities to the NMIs.

Overall, we note that the field level where systems are deployed must retain the highest level of confidentiality, whilst calibration present at the public-facing root level have the lowest confidentiality requirements.

2.1.3 Conflicts of Interest

Finally, the last requirement for an appropriate solution is to prevent unintended disclosure of information, specifically relating to the nature of conflicts between calibration providers and organisations that manage the systems. For example, Uber may wish to hide the identity of the service provider that calibrates their LIDAR sensors for their driverless fleet. A technician from this company should not be allowed to calibrate for other providers of driverless vehicles, to avoid the leakage of sensitive business information to competitors. As such, it is vital that we compartmentalise those in competition into conflict of interest sets, such that this sensitive information cannot flow between them.

3 A Unified Access Control Model for Calibration Traceability

Upon review of the information flow constraints related to calibration traceability, we note this presents us with a novel access control challenge to which the unification of the BLP, BIBA and Chinese Wall models fits well. However, the constraints assigned to information flow defined by BIBA and BLP contradict each other. Fortunately, by taking Sandhu’s observation [23] that BLP and BIBA are in fact the same model, we can see that our information flow (Figure 3) is an instance of this observation and by reversing BIBA, we can relieve this contradiction.

In current calibration-related business practices, we identified that these models are manually implemented. Within calibration facilities, the BLP model is exercised on calibration reports. Specifically, some calibration reports may have a degree of confidentiality, or the technicians calibrating equipment may do so under a non-disclosure agreement, and it is likely that internal systems and individuals maintain these levels of confidentiality. As for the notions of integrity handles by BIBA is inherent to the calibration ecosystem, but is not rigorously enforced. Instead, it is implied that integrity must be maintained at all levels, specifically at the root level, but any problems are not uncovered until the annual cycle of traceability verification, at which point the liabilities that arise due to invalid calibration may not be settled as easily.

For subsequent discussion of the unification of the three models, we define the terminology using notation based on the work of Sandhu [23].

(Definition) Conflict of Interest Set A Conflict of Interest (COI) set is defined as the set of subsets, where each subset corresponds to the calibration providers in who have a direct conflict of interest with each other. Following standard notation, we denote the set of $n$ COI sets as $\{COI_{1},COI_{2},\ldots,COI_{n}\}$, where each set $COI_{i}=\{1,2,\ldots,m\}$ contains the set of $m$ technicians in conflict.

(Definition) Set of Integrity Labels The set of integrity labels is denoted as $\Omega=\{\omega_{1},\omega_{2},\ldots,\omega_{q}\}$, where each label corresponds to a unique integrity level. Since we reverse BIBA to match the information flow of BLP, each integrity level also corresponds to a unique confidentiality level.

(Definition) Security Label A security label is defined as a set of two n-sized vectors $\{[i_{1},i_{2},\ldots,i_{n}],[p_{1},p_{2},\ldots,p_{n}]\}$, where $i_{j}\in\{COI_{j}\cup\perp\cup T\}$, $p_{j}\in\Omega$ and $1\leq j\leq n$.

• •

Where $i_{j}=\perp$, the calibration traceability chain does not contain information from any provider in $COI_{j}$.

• •

Where $i_{j}=T$, the calibration traffic contains information from at least two facilities who are in a conflict of interest set $COI_{j}$.

• •

Where $i_{j}\in COI_{j}$, the calibration traffic contains information from the corresponding calibration facility in $COI_{j}$.

(Definition) Dominance Relations We define the (transitive) dominance relations between security labels as follows, where the notation $l_{j}[i_{k}]$ denotes the $i^{th}_{k}$ element of the label $l_{j}$. We say that a security label $l_{1}$ dominates a label $l_{2}$, denoted by $l_{1}\geq l_{2}$, where $l_{1}\geq l_{2}\iff\forall i_{k},p_{k}=(1,2,\dots,n)[((l_{1}[i_{k}]=l_{2}[i_{k}])\vee(l_{2}[i_{k}]=\perp)\vee(l_{1}[i_{k}]=T))\wedge(l_{1}[p_{k}]\leq l_{2}[p_{k}])]$.

• •

A label $l_{1}$ dominates a label $l_{2}$, provided that $l_{1}$ and $l_{2}$ agree whenever $l_{2}$ is not public or in conflict, and the integrity level of $l_{2}$ is higher than that of $l_{1}$.

• •

The security label corresponding to an NMI at the root level, $\{[\perp,\perp,\ldots,\perp],[\omega_{q}]\}$, is dominated by all other levels.

• •

The system high, denoted by $\{[T,T,\ldots,T],[\omega_{1}]\}$, dominates all other levels.

• •

The dominance relation defines a lattice structure, where the NMI label appears at the bottom and the level trusted appears at the top. Incomparable levels are not connected in this lattice structure.

In accordance with our proposed access control model, the rules for information flow as they apply to it are as follows:

Simply Property: A calibration technician (S), may read a calibration report (O), only if the label, $L(S)\geq L(O)$. 2. 2.

• (Star) Confinement Property: A calibration technician (S) can only calibrate (write) a system component or unit (O), if the label of the component dominates that of the technician, i.e. if $L(O)\geq L(S)$. Specifically, write corresponds to the production of a calibration report.

4 Evaluation

While our unified model may be theoretically sound, it is vital to evaluate whether or not such a model is practically efficient for enforcing constraints in a real application. In this section, we first describe a case example for which our model could be applied, and follow on to evaluate the performance of our model as a practical solution for authorising traceability verification checks.

4.1 Case Example: Calibration Traceability for a Sensor Device

To describe a case as to how our proposed model can be applied, we will take the example of an infrared thermometer sensor. To keep in scope of this paper, we will discount the uncertainty calculations that make part of the traceability verification process, as the primary concern is with the authorisation time for enforcing our model rather than the overall time to complete calibration itself.

In order to calibrate an infrared thermometer, we need: (1) a thermal radiation source, (2) a transfer standard (an intermediate device when comparing other devices in calibration), (3) an ambient temperature thermometer, and (4) a distance measuring device. In some cases, for example where an aperture is part of its calibration, additional equipment may be required, however we will consider the more general case described. Furthermore, uncertainty calculations make up part of the traceability verification process, but as we are more concerned with the authorisation time for our model, we will not take these into account. As shown in Figure 4, we can see an example scheme for tracing the infrared thermometer to national standards.

To discuss our model in this case setting, we will assume the following:

• •

The calibration facilities $O1-3$ are classed as intermediary calibration facilities, and $O4$ is a National Measurement Institute (NMI)

• •

The infrared thermometer sensor is calibrated by technician $T1$ at calibration facility $O1$

• •

The transfer standard used in calibrating the sensor is itself, calibrated by a technician $T2$ at organisation $O2$

• •

The facilities $O2$ and $O3$ are in direct competition with one another

• •

The traceability chain information flows from the sensing device to $O1$, to the transfer standard calibrated by a technician at $O2$, towards the NMI $O4$

Given the assumptions above, we now describe the calibration traceability lifecycle for our infrared thermometer sensor, and how our proposed unified model can be applied.

Initial Calibration

Inspired by biology, we refer to the initial calibration of a system component or test and measurement equipment as the birth of the device, representing the behaviour which implements its secure initialisation. For all devices, there is always an initial calibration step which commences the start of its lifecycle and inaugurates them into the calibration ecosystem. After manufacturing, there are three primary methods of initial calibration: (a) by the manufacturer; (b) by a third-party intermediary calibration facility; and (c) at a National Measurement Institute (NMI).

In accordance with our model, and taking our case example, the sensor’s initial calibration will be conducted by the technician $T1$ at the facility $O1$. This process will output a calibration report for the sensor and this will be given the security label assigned to the technician: $\{[\perp,\perp,\perp],[\omega_{1}]\}$. Similarly, the transfer standard is calibrated by the technician $T2$ at facility $O2$ and will have the security label: $\{[\perp,COI_{1},\perp],[\omega_{2}]\}$, where $COI_{1}=\{O2,O3\}$ denotes that facilities $O2$ and $O3$ are in conflict with each other.

In most cases, there will be no conflicts that arise as part of a device’s initial calibration, however some devices such as those created for military or other government organisations may be classified in nature. Thus, if the organisation in this case previously used a calibration facility for calibrating a set of other devices, the new facility to be contracted could be competition/conflict with the other and thus the labels would indicate this conflict in the chain.

Verifying Traceability

Traceability plays a key role in verifying a newly calibrated device, as well as determining whether it needs to be recalibrated; ultimately lying at the heart of on-the-fly calibration. As the traceability verification process involves first retrieving the report of the device we are tracing, and then its parents’ reports and so forth to the root level, the party who carries out the verification check must first satisfy a set of conditions before being allowed to do so.

In accordance with our access control model, the security label of the device being traced must dominate the label of the party carrying out the verification check. For example, in the case of recalibration which first involves a traceability check, the label for a device must dominate that of the verifier. Furthermore, as we require to read all the reports of all parents at each step in the chain, up to national standards, the label of each parent should also dominate that of the verifying party, such that for a traceability chain $C=\{L(O_{1}),L(O_{2}),\ldots,L(O_{n})\}$, $\forall c\in C$, $L(S)\geq c_{i}$, where $i,n\geq 1$ and $L(S)$ is the label of the party carrying out the verification.

Recalibration

The process of recalibration is one that is carried out either: (a) when the expiry date of a component/unit’s calibration report has been exceeded, (b) when critical measurements are taken, (c) if the accuracy or measurement uncertainty of the equipment has noticeably degraded or drifted before the expiry period, or (d) if any parent unit in the chain does not have valid calibration. In any case, recalibration first involves performing a traceability verification check, to ensure that the component/unit has unbroken traceability and valid calibration. The technician performing calibration must first be allowed to carry out the traceability check, such that the label of the component or unit being calibrated dominates that of the technician, $L(O)\geq L(S)$. Specifically, this dominance relation is satisfied when the technician is not in conflict; i.e. if the technician is the same as the one who performed the initial calibration or previous recalibration, then they will be allowed to do so. Similarly, if not then the model would verify that the new technician performing recalibration is not in conflict with the previous, or others in the chain. That is, the traceability chain of the equipment being recalibrated does not contain information from both technicians in a conflict of interest set $COI_{j}$.

4.2 Performance Evaluation

As well as discussing how the model will be applied in a real-world case, it is vital to determine its practicality. We mention that the individual access control models, or a simple conjunction of them, may not be suitable or efficient compared to the unified model. In this evaluation, we determine whether our unified model can be enforced in a practical setting to support efficient calibration verification on-the-fly and scale well with large, complex calibration hierarchies.

Setup

To evaluate our model, we made use of an attribute-based authorisation framework, following the XACML standard [20] and structured as shown in Figure 5. The framework provides standards for access requests and policy specification, where a client program acts as a Policy Enforcement Point (PEP) which sent access requests to and enforced responses given by the server running a Policy Decision Point (PDP). The experiments on the authorisation framework to evaluate our model were performed on a virtual machine running Ubuntu 14.04 LTS allocated with 64GB of RAM.

Baseline Model To provide a more in-depth comparison as to how our access control model performs, we conducted the evaluation starting with a simple conjunction of the three models (BLP, Reverse BIBA (RBIBA) and Chinese Walls), as a baseline model to compare our unified model against. Specifically, to create the baseline model we made use of the XACML PolicySet, where policies for each model can be combined into a single policy and enforced together using a PolicyCombiningAlgorithm. To combine the policies for our baseline, we used the permit-unless-deny algorithm, which only allows a Permit or Deny response, and will deny access if any one of the combined policies produce a Deny result.

Authorising Traceability Verification

For the first part of our evaluation, we measured the time taken to authorise access requests for calibration traceability verification using our unified model. As a point of comparison, we also measure this time for the baseline model. To recall, traceability verification involves verifying the calibration at each level in the chain of calibrations for some equipment, up to national standards.

Naturally, in the calibration hierarchy, there are several levels for a single traceability chain. For example, a simple temperature sensor could be calibrated with a platinum resistance thermometer, which in turn is calibrated by a more accurate reference thermometer, that is finally calibrated by a helium gas thermometer (primary reference standard) [19]. However, with the consideration of SC-IoT systems, where sensors, etc. could be off-the-shelf components, possibly leading to longer traceability chains (¿4 levels). Thus, for completeness, we conduct our experiment for measuring the authorisation time for traceability verification with up to 50 levels.

For the first experiment, we measured the time to authorise traceability verification for up to 50 levels, with only a single parent (reference device) at each level. As shown in Figure 6, we observe that across the board, the unified model is significantly faster compared to the baseline simple conjunction, with authorisation times not exceeding 11ms on average in the worst case compared to roughly 30ms for the baseline model.

In realistic traceability chains, some devices are calibrated with more than one reference (parent) device. For example, an infrared temperature sensor is calibrated with a distance gauge, infrared source (i.e. hotplates) and reference thermometer [17]. Each of these parent devices will have their own parents, meaning that instead of having a single chain, we now have a chain that branches off several times. Therefore, our next experiment involves measuring the authorisation time for traceability verification for 2 and 4 branches per level, such that we can observe the impact of realistically complex chains. As shown in Figures 7(a) and 7(b), we see a similar pattern to a single branch for a chain, with our unified model outperforming the baseline model by at least 15ms in the worst case. Furthermore, we can also observe an increase in the authorisation time as the number of branches per level also increases, as authorisations for each parent device and so forth in their branches also need to be made.

Across all test cases, while the unified model does outperform (significantly) the baseline simple conjunction, the authorisation time does increase as the number of levels increases. However, in the case of our unified model, the increase of just a few milliseconds as the number of levels or branches increase is considered a reasonable wait on the device prep-cycle or if a measurement was to be taken [9].

Conflict Management

Pertaining to the conflict component of security labels, we note that it is in fact the size of conflict sets, rather than the number of them, which needs to be considered, as some sets may only contain two members, whilst others could contain more. Thus, we evaluated the effect of the size of conflict sets on authorisation time in traceability verification, for our unified model.

For our calibration traceability dataset, we generated a set of calibration reports which contained real calibration data. Each of which were assigned a security label, where the integrity component of the label corresponded with the level at which calibration was conducted, and the conflict component of the label was generated using a $G(n,p)$ variant of the Erdős–Rényi random graph model, where $n$ is the number of potential competitors and $p$ is the probability of conflict. Specifically, the cliques of the random graph represented conflict sets, which for each node $n_{i}$ was assigned a set of conflict sets.

To evaluate the impact of the size of conflict sets, we increase the number of potential competitors $n$ and probability of potential competitors being in conflict $p$, such that we get a range of conflict set sizes from 1 member in the set to 50. As shown in Figure 8, we observe an increase in the time taken to authorise traceability verification requests as the size of the conflict sets increase. Our experiment here shows the effect on authorisation time for a single conflict set, however, we can see clearly that as the number of conflict sets increase, so will the authorisation time; but impressive yet the increase is fairly minimal and as previously stated is considered a reasonable wait on the device prep-cycle.

5 Discussion and Limitations

Within the calibration hierarchy, we observe a unique set of information flows which we hypothesised could not be effectively met by classical access control models, as any one of them or a simple conjunction of a subset such as the lattice model, fails to meet the desired access control requirements for compartmentalising conflicts of interest, calibration integrity and confidentiality.

With some key players (device operators, calibration facilities, etc.) in the calibration ecosystem sharing an adversarial relationship with a subset of others, we observe a unique set of information flows. First, we observe that calibration traceability checks could reveal who-calibrates-for-whom, which can ultimately compromise the confidentiality of business relationships surrounding SC-IoT systems. With the adoption of our unified model, we constrain these information flows such that the field level where systems are deployed retain the highest level of confidentiality and calibration meta-information such as what-is-being-calibrated and how-often-it-is-calibrated cannot be revealed to levels above the field level (i.e. intermediary facilities).

One limitation of this work, is that policies and calibration reports are stored centrally. We assume that encryption mechanisms are in place, however we do not consider the impact of security mechanisms such as TLS and PKI on authorisation times in our evaluation. In any case, added security presents overheads that would need to be considered, and in certain cases (i.e. critical liabilities resulting from calibration checks before system operation can continue) the addition of such security measures could increase the low authorisation times observed from evaluation of our unified model.

6 Related Work

The security surrounding time- and safety-critical IoT systems is an active research area [7], with the main focus pertaining to attacks in the cyber domain (i.e. control system security [13, 2]) and the physical domain (i.e. physical compromise of sensors [3, 8] and physical safety of devices and surrounding environment [22, 8]). However, with the calibration of such systems contributing highly to system accuracy and precision, the compromise of its calibration can ultimately impact the ability to operate safely. Quarta et al. describe calibration parameters of robotics systems to be an essential construct used to compensate for known measurement errors [21]. They demonstrated that by manipulating calibration parameters, an adversary could cause the robot to operate unsafely, such as affecting the servo motor causing the robot to move erratically. Aside from just the manipulation of calibration parameters, we observe a set of calibration information flows, possibly between calibration parties that share conflicts-of-interest, which can lead to compromise of confidentiality and integrity of calibration.

Existing access control literature for safety-critical IoT systems focus on various aspects of the system itself, ranging from securing control systems (i.e. access to actuators) to the validation/enforcement of security policies. Hasan and Mohan [13] propose a framework based on the Simplex architecture, commonly used for time-critical cyberphysical systems for fault-tolerance, which makes use of a rule-based invariant and access control mechanism to ensure the timing and safety requirements of IoT cyberphysical systems (i.e. ensure some task can only access a given actuator if the task has the required permission given a set of invariant conditions). Frank et al. [11] describe a combination of both logical and physical access control – explain each, respectively. He describes that the most widely used multi-level security models are inadequate when logical resources obtain a physical form, that makes use of both mandatory and discretionary access control. While not directly applicable to calibration traceability, one must also consider the access constraints to the physical process of calibration which traceability verification is a key part of. Compared to our work, we make use of attribute-based access control (ABAC) due to its flexibility, limited only by the computational language when implementing policies to enforce access control models. Specifically, it allows greater breadth for access relationships (subjects to access objects) without the need to specify the individual relationships between them. Compared to other traditional approaches such as rule-based access control, this makes its use ideal for dynamic environments such as SC-IoT [15]. Further, while attribute-based access control provides key advantages to earlier forms of access control, such as ACLs and role-based access control, and having a well-maintained policy declaration language and authorisation framework (XACML) for practical solutions, other forms of access control have been proposed which may also be suitable for enforcing our unified model.

In this work, we focus on the calibration angle which has been paid little attention to. Specifically, we focus on the unification of three classical access control models (namely BLP, BIBA and Chinese Walls) which is required to solve the novel set of information flows which arise from calibration traceability. Yang et al. [28] state that while BLP is widely used to enforce multi-level confidentiality, it lacks flexibility due to strict confidentiality rules. Furthermore, they describe that BLP poorly controls integrity and that BLP is commonly combined with BIBA for increased integrity control [24, 14, 29]. In their work, they propose an improved BLP model to manage multi-level security, where the security of each level is distinguished by the security level of the accessed content itself (subjects are defined as a multi-level entity and objects are defined as a single-level entity). With regard to BIBA, Liu et al. [18] note that BIBA can possibly deny non-malicious access requests made by subjects, ultimately reducing the availability to a system. To this, they propose the integration of notions from Break The Glass (BTG) strategies – a set of (efficient) strategies used to extend subject access rights in exceptional cases (i.e. irregular system states) – with the existing BIBA model (BTG-BIBA). They show that with the proposed BTG-BIBA model, it can now provide more fine-grained access control that is context-aware for dynamic situations. In this work, we take into account the traditional BIBA and BLP models in our case for unification, however one can question the applicability of improvements made to these models over recent years. For example, capability-based access control has been shown to perform well in highly scalable and distributed environments, such as IoT. Similarly, like attribute-based access control, capability-based mechanisms can also be enforced in a fine-grained manner [4, 12], where tokens can be given to subjects on-the-fly containing the appropriate security label, and also be verifiable and unlinkable to preserve privacy [30].

7 Conclusion

We have highlighted the shift towards a digital calibration paradigm presents us with a novel access control challenge when we consider the calibration of rapidly adopted safety-critical IoT systems.Upon discussion of the current state-of-the-art in calibration traceability, we observe the information flow through a systems calibration hierarchy and present an access control model which uniquely unifies the BLP, BIBA and Chinese Wall models. Furthermore, we have developed an authorisation framework to evaluate the performance of our model for safety-critical IoT systems, and have shown that authorisation times can suitably enforce restrictions that enable efficient, safe calibration traceability.