Privacy-Enhanced Role-Based Access Control for IoT Systems

Unauthorized accessing private information poses a significant security risk in Internet of Things (IoT). Although role-based access control can partially address the problem, there is a lack of studies on protecting the privacy of roles. This work proposes a novel privacy-enhanced role-based access control (PE-RBAC) scheme for resource-limited cloud-based IoT systems. Our PE-RBAC scheme enhances the privacy of traditional RBAC by allowing the cloud platform (CP) to learn only the necessary roles of IoT devices rather than their entire role sets. IoT devices remain unaware of the CP’s roles through the incorporation of the authorized private set intersection (APSI) protocol. Our scheme enables role authorization to prevent unauthorized requests by integrating an authorization center (AC) with an authentication scheme. It achieves lightweight computation and communication overhead using a garbled Bloom filter (GBF), independent of IoT roles. It requires only xor operations and random number generation, making it ideal for IoT devices with limited computing capacity and bandwidth. Through formal security model definitions and rigorous security analysis, it achieves unlinkability and ciphertext indistinguishability for IoT device privacy and unforgeability for both the CP and IoT devices. It demonstrates high practicality through real-world-like experiments considering varying role sizes and the number of concurrent IoT devices. Experimental results show a throughput of 1100 requests per second, with storage overhead remaining linear with the number of devices.