Attribute-Based Access Control Utilizing Verifiable Credentials for Multi-Tenant IoT Systems

Abstract

Many Internet of Things (IoT) applications are considering multi-tenancy to support for multiple entities sharing access to the same IoT devices. The challenge of ensuring IoT security and privacy is exacerbated in multi-tenant environments accommodating “guest” users, i.e., opportunistic users that the system has not encountered. Thus, there is a need for novel access control mechanisms capable of addressing the complexities introduced by the opportunistic nature of the users who create complex trust relationships within the IoT ecosystem. In this study, we proposed a solution that leverages Verifiable Credentials (VCs) to implement Attribute-Based Access Control (ABA C) for multi-tenant IoT environments and we integrate it with W3C's Web of Things (WoT) standards, enhancing interoperability. Through the utilization of VCs, the solution provides secure verification and efficient revocation of user attributes, enabling access control decisions based on the enclosed attributes. Additionally, the proposed system ensures privacy, since users can selectively disclose the necessary attributes to gain access to resources through the utilization of Zero Knowledge Proofs (ZKPs). Finally, the solution does not require users to have any “pre-existing” trust relationships with the protected system.