Indexado en

Licencia y uso

Citaciones

Altmetrics

Grant support

This work was supported by AFarCloud project, which has received funding from the ECSEL Joint Undertaking (JU) under grant agreement No. 783221. The JU receives support from the European Union's Horizon 2020 research and innovation programme, and Austria, Belgium, Czech Republic, Finland, Germany, Greece, Italy, Latvia, Norway,Poland, Portugal, Spain, and Sweden. This publication is part of the project PCI2018-092965 funded by MCIN/AEI/10.13039/501100011033 and by the "European Union". This work was supported by the DEMETER project, which has received funding from INDUSTRIAL LEADERSHIP-Leadership in enabling and industrial technologies-Information and Communication Technologies (ICT) under grant agreement No. 857202. ICT receives support from the European Union's Horizon 2020 research and innovation program, and Italy, Luxembourg, Spain, Germany, Greece, United Kingdom, Norway, Czechia, Montenegro, Belgium, Romania, Ireland, Finland, Serbia, Portugal, Poland, Georgia, and Slovenia.

Análisis de autorías institucional

Compartir

Edge-enabled IAM for IoTs with edge-based access management and context-driven syncservice

Publicado en:Journal Of Systems Architecture. 165 103430- - 2025-08-01 165(), DOI: 10.1016/j.sysarc.2025.103430

Autores: Wang, Yiting; Martinez-Ortega, Jose-Fernan; Castillejo, Pedro; de la Parte, Mario San Emeterio

Afiliaciones

Resumen

The number of edge IoT services is experiencing explosive growth. As an entry point for network services, Identity and Access Management (IAM) effectively prevents unauthorized access and blocks most cyber-attacks. However, most edge systems still rely on remote, cloud-based IAM for permission verification. The few edge-enabled IAM solutions that do exist operate on the assumption that attribute values are always up-to-date and provided by a completely trustworthy source, which make access decisions questionable in highly dynamic and distributed IoT environments. To address these challenges, this work proposes EIAM-IoT, an edge-enabled IAM architecture, and an improved Local Authentication and Authorization (LAA) method. The LAA evaluates multi-factor attributes, incorporating the freshness of attribute values and the trustworthiness of attribute providers, to achieve reliable access control. Additionally, the identity information required for LAA is synchronized and stored in the edge database by a context-aware synchronization strategy, which selectively and timely extends relevant identity data based on edge context, optimizing the trade-off between local data management costs and LAA performance. The performance and security analyses show that the LAA does not introduce significant overhead to traditional attribute-based solutions while enabling more fine-grained access control, increasing decision reliability, and offering additional features, such as local verification and federated identity management. While the LAA relies on cloud-extended local data, the system ensures greater availability and resilience to connectivity issues in edge-to-cloud setups. EIAM-IoT is particularly more suitable for dynamic, multi-authority, and edge-native IoT applications to achieve secure, low-latency, offline access to edge IoT services.

Palabras clave