Protecting Sensors in an IoT Environment by Modelling Communications as Resources ^†

The growth of the Internet has generated new types of services based on novel data sources. Among these services, the use of sensors and actuators to create hybrid services that allow humans to interact with the physical environment in a natural way is especially remarkable. These services compose what is called the Internet of Things (IoT). One of the biggest challenges is the protection and access control to the sensors and actuators exposed to the Internet, becoming a critical factor in IoT scenarios. We propose the abstraction of the IoT communication elements as Resources that can be protected using conventional access control schemes. To achieve this, we propose using User-Managed Access (UMA), an existent OAuth2 profile originally developed for the protection of Internet services. To validate our proposal, we have selected MQTT, one of the simplest message-based communication protocols used in IoT environments. We have developed a prototype implementation and a use case using a developer board based on the MCU ESP8266 as an IoT device. The performed tests have been focused on validating the proposed solution in terms of the correctness of the access control system, energy consumption and communication delays.