Authentication and Authorization for Constrained Environments (ACE) com Framework OAuth e Protocolo CoAP

Cleber Bittencourt Porciúncula, Sílvio Beskow, Érico Santos Rocha, Jeferson Campos Nobre

Resumo


O presente artigo tem por objetivo estudar o framework ACE (Authentication and Authorization for Constrained Environments) utilizando o framework OAuth 2.0 e o protocolo CoAP. O grupo analisado explora conceitos como autenticação e autorização em ambientes restritos a conexão. Este framework, engloba um conjunto de protocolos que estão em estudo para uma padronização na utilização em dispositivos IoT. Dispositivos restritos formam redes de comunicação trocando informações entre si, necessitando de requisitos de segurança para a garantir confidencialidade, integridade e disponibilidade.


Palavras-chave


Constrained; Environments; Device

Texto completo:

PDF

Referências


[Beltran and Gómez-Skarmeta 2016] Beltran, V. and Gómez-Skarmeta, A. F. (2016). An overview on delegated authorization for coap: Authentication and authorization for constrained environments (ace). 2016 IEEE 3rd World Forum on Internet of Things (WF-IoT), pages 706–710.

[Bormann 2012] Bormann, C. (2012). Using CoAP with IPsec draft-bormann-core-ipsecfor-coap-00. Draft 00, CoRE Working Group.

[Bormann et al. 2014] Bormann, C., Ersue, M., and Keranen, A. (2014). Terminology for Constrained-Node Networks. RFC 7228, RFC Editor.

[Bormann and Hoffman 2013] Bormann, C. and Hoffman, P. (2013). Concise Binary Object Representation (CBOR). RFC 7049, RFC Editor.

[Cirani et al. 2013] Cirani, S., Ferrari, G., and Veltri, L. (2013). Enforcing security mechanisms in the ip-based internet of things: An algorithmic overview. Algorithms, 6(2):197–226.

[Cooper et al. 2008] Cooper, D., Santesson, S., Farrell, S., Boeyen, S., Housley, R., and Polk, W. (2008). Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile. RFC 5280, RFC Editor.

[D. Hardt 2012] D. Hardt, E. (2012). The OAuth 2.0 Authorization Framework. RFC 6749, RFC Editor.

[Dierks and Rescorla 2008] Dierks, T. and Rescorla, E. (2008). The Transport Layer Security (TLS) Protocol Version 1.2. RFC 5246, RFC Editor.

[Fielding et al. 1999] Fielding, R., Irvine, U., Gettys, J., Mogul, J., Frystyk, H., Masinter, L., Leach, P., and Berners-Lee, T. (1999). Hypertext Transfer Protocol – HTTP/1.1. RFC 2616, RFC Editor.

[Hoffman 2013] Hoffman, P. (2013). O Tao do IETF. RFC 00, RFC Editor.

[Kaduk et al. 2014] Kaduk, B., Schaad, J., and athleen Moriarty (2014). Authentication and Authorization for Constrained Environments. RFC 00, RFC Editor.

[Navas et al. 2016] Navas, R. E., Lagos, M., Toutain, L., and Vijayasankar, K. (2016). Nonce-based authenticated key establishment over oauth 2.0 iot proof-of-possession architecture. 2016 IEEE 3rd World Forum on Internet of Things (WF-IoT), pages 317–322.

[P. Eronen and H. Tschofenig 2005] P. Eronen, E. and H. Tschofenig, E. (2005). Pre-Shared Key Ciphersuites for Transport Layer Security (TLS). RFC 4279, RFC Editor.

[P. Wouters et al. 2014] P. Wouters, E., H. Tschofenig, E., Gilmore, J., Weiler, S., and Kivinen, T. (2014). Using Raw Public Keys in Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS). RFC 7250, RFC Editor.

[Postel 1980] Postel, J. (1980). User Datagram Protocol. RFC 768, RFC Editor.

[R. Fielding and J. Reschke 2014] R. Fielding, E. and J. Reschke, E. (2014). Hypertext Transfer Protocol (HTTP/1.1): Message Syntax and Routing. RFC 7230, RFC Editor.

[Rescorla and Modadugu 2012] Rescorla, E. and Modadugu, N. (2012). Datagram Transport Layer Security Version 1.2. RFC 6347, RFC Editor.

[Rosenberg et al. 2012] Rosenberg, J., Schulzrinne, H., Camarillo, G., Johnston, A., Peterson, J., Sparks, R., Handley, M., and Schooler, E. (2012). SIP: Session Initiation Protocol. RFC 3261, RFC Editor.

[Schaad and Cellars 2017] Schaad, J. and Cellars, A. (2017). CBOR Object Signing and Encryption (COSE). RFC 8152, RFC Editor.

[Seitz et al. 2016] Seitz, L., Gerdes, S., Selander, G., Mani, M., and Kumar, S. (2016). Use Cases for Authentication and Authorization in Constrained Environments. RFC 7744, RFC Editor.

[Shelby et al. 2014] Shelby, Z., Hartke, K., and Bormann, C. (2014). The Constrained Application Protocol (CoAP). RFC 7252, RFC Editor.

[Simmonds et al. 2004] Simmonds, A., Sandilands, P., and Van Ekert, L. (2004). An ontology for network security attacks. In Asian Applied Computing Conference, pages 317–323. Springer.

[Stallings 2014] Stallings, W. (2014). Cryptography and Network Security: Principles and Practice, International Edition: Principles and Practice. Pearson Higher Ed.

[T. Bray 2014] T. Bray, E. (2014). The JavaScript Object Notation (JSON) Data Interchange Format. RFC 7159, RFC Editor.

[Vasseur 2014] Vasseur, J. (2014). Terms Used in Routing for Low-Power and Lossy Networks. RFC 7102, RFC Editor.




DOI: http://dx.doi.org/10.5902/2448190430934

Apontamentos

  • Não há apontamentos.