Examining the suitability of the attribute-based access control (ABAC) model for the internet of things (IOT) and implementing required extensions

The Internet of Things (IoT) is an interconnected environment where numerous devices communicate with each other, which poses privacy and security challenges. For users to fully adopt IoT technology in their daily lives, it is crucial that this ecosystem meets fundamental network, system, and security requirements. IoT applications can collect sensitive information from a variety of sources, including sensors, users, and other connected devices. As IoT devices increasingly integrate into our daily routines, the absence of strong authentication and access control mechanisms raises significant security and privacy concerns. Weak credentials and insufficient authentication protocols remain key vulnerabilities within IoT systems, making it crucial to address these issues to enhance user trust and facilitate broader adoption of IoT technologies. This thesis explores critical aspects of user authentication, access control, and privacy within the context of IoT security, focusing particularly on smart home environments. To ensure the privacy of personal data and prevent unauthorized access, detailed and dynamic access control is essential. In this regard, the attribute-based access control (ABAC) model proves to be a suitable approach. This thesis extends Attribute-Based Access Control (AeABAC) model in three stages. In the first stage, the model introduces an innovative method for determining the authentication assurance level based on the biometric match score (AMS) obtained during user authentication. This score is compared to predefined thresholds, allowing for fine-grained access control decisions based on the user's role and authentication assurance level. In the second stage, performance metrics are integrated into the ABAC model to enhance decision-making. By calculating the False Match Rate (FMR) and defining an Access Decision Uncertainty Score (ADUS), the AeABAC model enables effective normalization across a wide range of biometric authentication devices and algorithms. It categorizes device functionality by criticality level and makes access decisions accordingly. This approach demonstrates a more flexible and scalable method for controlling access in IoT environments, particularly in smart homes where biometric authentication is common. The first two stages focus on establishing system-to-user trust in smart home ecosystems. In the third and final phase, the focus is on developing effective solutions to issues related to the protection of user privacy. Authentication and authorization processes ensure system security (system-to-user trust); however, after this stage, systems require users' sensitive data to perform the desired functions. At this point, users want to prioritize the protection of their privacy (user-to-system trust). In this thesis, to enhance users' trust in data privacy, a Risk-Based Privacy Approach is integrated into the AeABAC model, resulting in the proposed RBP-AeABAC model. This approach offers a privacy risk analysis that assesses the likelihood of data disclosure and potential harms (disclosure impact) by defining privacy profiles in the smart home environment. This way, transparent and reliable protection is provided in data collection and disclosure processes, ensuring user privacy. The model allows for an evaluation of the likelihood and impact of data disclosure while considering user privacy, enabling users to make informed decisions. This user-defined privacy profile approach offers protections tailored to individual privacy needs. The model's applicability is demonstrated through various use-case scenarios. The proposed extensions of the ABAC model in this thesis not only enhance the security of IoT devices in smart homes but also offer a comprehensive framework for managing privacy risks. By integrating biometric authentication, performance metric-based access control, and privacy risk assessments, this thesis presents an innovative solution that fosters bidirectional trust between users and systems in IoT environments. Future research will investigate the model's scalability and its applicability in larger IoT ecosystems.