skip to main content
US FlagAn official website of the United States government
dot gov icon
Official websites use .gov
A .gov website belongs to an official government organization in the United States.
https lock icon
Secure .gov websites use HTTPS
A lock ( lock ) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

Explore Research Products in the PAR
It may take a few hours for recently added research products to appear in PAR search results.


Title: Heracles: Scalable, Fine-Grained Access Control for Internet-of-Things in Enterprise Environments
Scalable, fine-grained access control for Internet-of- Things are needed in enterprise environments, where thousands of subjects need to access possibly one to two orders of magnitude more objects. Existing solutions offer all-or-nothing access, or require all access to go through a cloud backend, greatly impeding access granularity, robustness and scale. In this paper, we propose Heracles, an IoT access control system that achieves robust, fine-grained access control at enterprise scale. Heracles adopts a capability-based approach using secure, unforgeable tokens that describe the authorizations of subjects, to either individual or collections of objects in single or bulk opera- tions. It has a 3-tier architecture to provide centralized policy and distributed execution desired in enterprise environments, and delegated operations for responsiveness of more resource- constrained objects. Extensive security analysis and performance evaluation on a testbed prove that Heracles achieves robust, responsive, fine-grained access control in large scale enterprise environments.  more » « less
Award ID(s):
1652276
PAR ID:
10048626
Author(s) / Creator(s):
; ; ;
Date Published:
Journal Name:
IEEE INFOCOM 2018
Format(s):
Medium: X
Sponsoring Org:
National Science Foundation
More Like this
  1. ; ; ; (, ACM)
    There is much interest in fine-grained RFID localization systems. Existing systems for accurate localization typically require infrastructure, either in the form of extensive reference tags or many antennas (e.g., antenna arrays) to localize RFID tags within their radio range. Yet, there remains a need for fine-grained RFID localization solutions that are in a compact, portable, mobile form, that can be held by users as they walk around areas to map them, such as in retail stores, warehouses, or manufacturing plants. We present the design, implementation, and evaluation of POLAR, a portable handheld system for fine-grained RFID localization. Our design introduces two key innovations that enable robust, accurate, and real-time localization of RFID tags. The first is complex-controlled polarization (CCP), a mechanism for localizing RFIDs at all orientations through software-controlled polarization of two linearly polarized antennas. The second is joint tag discovery and localization (JTDL), a method for simultaneously localizing and reading tags with zero-overhead regardless of tag orientation. Building on these two techniques, we develop an end-to-end handheld system that addresses a number of practical challenges in self-interference, efficient inventorying, and self-localization. Our evaluation demonstrates that POLAR achieves a median accuracy of a few centimeters in each of the x/y/z dimensions in practical indoor environments. 
    more » « less
  2. ; ; ; (, USENIX Security)
    Augmented Reality (AR) is widely considered the next evolution in personal devices, enabling seamless integration of the digital world into our reality. Such integration, however, often requires unfettered access to sensor data, causing significant over privilege for applications that run on these platforms. Through analysis of 17 AR systems and 45 popular AR applications, we explore existing mechanisms for access control in AR platforms, identify key trends in how AR applications use sensor data, and pinpoint unique threats users face in AR environments. Using these findings, we design and implement Erebus, an access control framework for AR platforms that enables fine-grained control over data used by AR applications. Erebus achieves the principle of least privileged through the creation of a domain-specific language (DSL) for permission control in AR platforms, allowing applications to specify data needed for their functionality. Using this DSL, Erebus further enables users to customize app permissions to apply under specific user conditions. We implement Erebus on Google’s ARCore SDK and port five existing AR applications to demonstrate the capability of Erebus to secure various classes of apps. Performance results using these applications and various microbenchmarks show that Erebus achieves its security goals while being practical, introducing negligible performance overhead to the AR system. 
    more » « less
  3. ; ; ; (, Proceedings of the ACM on Human-Computer Interaction)
    Crowdsourcing is popular for large-scale data collection and labeling, but a major challenge is on detecting low-quality submissions. Recent studies have demonstrated that behavioral features of workers are highly correlated with data quality and can be useful in quality control. However, these studies primarily leveraged coarsely extracted behavioral features, and did not further explore quality control at the fine-grained level, i.e., the annotation unit level. In this paper, we investigate the feasibility and benefits of using fine-grained behavioral features, which are the behavioral features finely extracted from a worker's individual interactions with each single unit in a subtask, for quality control in crowdsourcing. We design and implement a framework named Fine-grained Behavior-based Quality Control (FBQC) that specifically extracts fine-grained behavioral features to provide three quality control mechanisms: (1) quality prediction for objective tasks, (2) suspicious behavior detection for subjective tasks, and (3) unsupervised worker categorization. Using the FBQC framework, we conduct two real-world crowdsourcing experiments and demonstrate that using fine-grained behavioral features is feasible and beneficial in all three quality control mechanisms. Our work provides clues and implications for helping job requesters or crowdsourcing platforms to further achieve better quality control. 
    more » « less
  4. ; ; (, IEEE/ACM Symposium on Edge Computing)
    We present CAPLets, an authorization mechanism that extends capability based security to support fine grained access control for multi-scale (sensors, edge, cloud) IoT deployments. To enable this, CAPLets uses a strong cryptographic construction to provide integrity while preserving computational efficiency for resource constrained systems. Moreover, CAPLets augments capabilities with dynamic, user defined constraints to describe arbitrary access control policies. We introduce an application specific, turing complete virtual machine, CapVM, alongside with eBPF and Wasm, to describe constraints. We show that CAPLets is able to express permissions and requirements at a fine grain, facilitating construction of non-trivial access control policies. We empirically evaluate the efficiency and flexibility of CAPLets abstractions using resource constrained devices and end-to-end IoT deployments, and compare it against related mechanisms in wide use today. Our empirical results show that CAPLets is an order of magnitude faster and more energy efficient than current IoT authorization systems. 
    more » « less
  5. ; ; ; (, ACM Transactions on Sensor Networks)
    Optical wireless communication (OWC) shows great potential due to its broad spectrum and the exceptional intensity switching speed of LEDs. Under poor conditions, most OWC systems switch from complex and more error prone high-order modulation schemes to more robust On-Off Keying (OOK) modulation defined in the IEEE OWC standard. This paper presents LiFOD, a high-speed indoor OOK-based OWC system with fine-grained dimming support. While ensuring fine-grained dimming, LiFOD remarkably achieves robust communication at up to 400 Kbps at a distance of 6 meters. This is the first time that the data rate has improved via OWC dimming in comparison to the previous approaches that consider trading off dimming and communication. LiFOD makes two key technical contributions. First, LiFOD utilizes Compensation Symbols (CS) as a reliable side-channel to represent bit patterns dynamically and improve throughput. We firstly design greedy-based bit pattern mining. Then we propose 2D feature enhancement via YOLO model for real-time bit pattern mining. Second, LiFOD synchronously redesigns optical symbols and CS relocation schemes for fine-grained dimming and robust decoding. Experiments on low-cost Beaglebone prototypes with commercial LED lamps and the photodiode (PD) demonstrate that LiFOD significantly outperforms the state-of-the-art system with 2.1× throughput on the SIGCOMM17 data-trace. 
    more » « less
  • Citation Formats
  • MLA
  • APA
  • Chicago
  • BibTeX
  • Save / Share this Record
  • Send to Email