An Attribute-Based Approach toward a Secured Smart-Home IoT Access Control and a Comparison with a Role-Based Approach

Round 1

Reviewer 1 Report

I would like to thank the authors for their precise response to my comments. The article in this form is much clearer and the way of presenting the results is attractive for the readers.
After a thorough analysis of the new version, I do not make any additional comments. The article contains many interesting ideas that can be shared with the scientific community.

Author Response

We would like to thank the reviewer for his/her insightful comments. Attached is a merged pdf document that contains the revised manuscript followed by the response report.

Author Response File: Author Response.pdf

Reviewer 2 Report

Overall, the authors appropriately responded to the suggestions made by the reviewers and the paper has improved significantly.

With the introduction of the more precise definition of "term" as "declarative sentence" the model works. However, the definition is informal. While the examples make it clear where the boundaries between "declarative sentences" are marked by a red disjunction, there is no formal definition of the precise semantics of this different type of disjunction. 

If the authorization function is not printed in color, it is impossible to distinguish where one "term" starts and where the other ends.

E.g.: (A AND B) OR C OR D are the terms :

  - (A AND B) OR C and D

  or

  - (A AND B) and C OR D

The model boils down to a set of "terms" which individually are semantically policies. These policies evaluate to false when undefined attributes are encountered. This is a completely valid approach.

The "red disjunction" is syntactically a boundary between policies implementing a "permit overrides" style policy combining algorithm.

The authorization function is a hard-wired policy combining algorithm.

Recommendations:

• It would be clearer to name "terms" "policies"
• Notation should be clarified to make boundaries between "terms" unambiguous (e.g., use a disjunction symbol with a dot above, or preferably introduce the "terms"/"policies" as a distinct function object (evaluation to false by default on an error)  in the model and keep the authorization function as "normal disjunction".

The introduction of a clearer definition of "term" has consequences for later parts of the paper.

E.g.: Figure 8 is captioned "The Authorization Policy of Use Case B in DNF Format"

This caption implies the following:

• The shown object is a policy, which is not a term used before. Beforehand, it was an "authorization function".
• The Authorization function could be transformed arbitrarily according to Boolean logic.

Starting line 572, the assumption, that the authorization function can be arbitrarily transformed according to Boolean logic is the fundament of the following proofs:

"Here, as a preliminary step, we first transform the authorization policy into a disjunctive normal form (DNF). "

However, this assumes, that the red disjunctions can be treated equivalently to any other disjunction in the authorization function. 

This is not a priori clear, and the reviewer suspects that this could be false in this case. Normalizing arbitrary authorization functions from a generic boolean expression to DNF will dissolve the boundaries between the terms. These boundaries have to be known to know if an isolated term has to be evaluated as "false" due to an undefined value. It may work in the examples given. This is not a priori clear for the general case. 

For the following proof to be correct, the authors first must show that this kind of DNF normalization is possible for arbitrary authorization functions given the introduction of "undefined" and "term" with special rules. Basically. how can a DNF normalized authorization function shown to always evaluate to the same result as the manually authored function with explicit "term boundaries"/"red disjuctions"?

In the worst case, it could not be possible and by dissolving the term boundaries through DNF normalization the semantics of the resulting function becomes the semantics of an authorization function without term boundaries which means that the problems eliminated by introducing the special handling of undefined attributes within the scope of a term breaks.

Alternatively, a proof not based on DNF normalization could be presented.

Author Response

We would like to thank the reviewer for his/her insightful comments. Attached is a merged pdf document that contains the revised manuscript followed by the response report.

Author Response File: Author Response.pdf

Round 2

Reviewer 2 Report

The authors have appropriately responded to the reviewer's comments and the paper is now in excellent shape.

I have no additional comments.