Combining IOTA and Attribute-Based Encryption for Access Control in the Internet of Things

TL;DR

This paper introduces a scalable, fee-less IoT access control scheme combining IOTA's distributed ledger technology with attribute-based encryption, enabling fine-grained, distributed authorization with improved throughput.

Contribution

It presents a novel IoT access control scheme that integrates IOTA and CP-ABE, overcoming blockchain limitations like cost and throughput.

Findings

Feasibility demonstrated through a prototype system.

Achieved scalable, fee-less access control in IoT.

Improved processing throughput for access requests.

Abstract

Unauthorized resource access represents a typical security threat in the Internet of things (IoT), while distributed ledger technologies (e.g., blockchain and IOTA) hold great promise to address this threat. Although blockchain-based IoT access control schemes have been the most popular ones, they suffer from several significant limitations, such as high monetary cost and low throughput of processing access requests. To overcome these limitations, this paper proposes a novel IoT access control scheme by combining the fee-less IOTA technology and the Ciphertext-Policy Attribute-Based Encryption (CP-ABE) technology. To control the access to a resource, a token, which records access permissions to this resource, is encrypted by the CP-ABE technology and uploaded to the IOTA Tangle (i.e., the underlying database of IOTA). Any user can fetch the encrypted token from the Tangle, while only those who can decrypt this token are authorized to access the resource. In this way, the proposed scheme enables not only distributed, fee-less and scalable access control thanks to the IOTA but also fine-grained attribute-based access control thanks to the CP-ABE. We show the feasibility of our scheme by implementing a proof-of-concept prototype system and evaluate its performance in terms of access request processing throughput.