SAML Standard Optimization for Use on CoAP-Based Web Servers on Internet of Things

Document Type : Persian Original Article

Authors

1 Islamic Azad University, Tehran jonoub branch

2 Malek Ashtar University

3 Islamic Azad University

Abstract

The use of web services has been increased by IoT technology development and increasing interoperability between objects. IoT web services Access control is a challenging problem in IoT environment. Many standards such as SAML has been proposed for authorization and access control in common web services, but it is not possible to use these standards in IoT web services, because IoT resources has constraints in network, memory and procces.
This article proposed a modified version of SAML standard for using in IoT web services. In proposed changes, CoAP protocol has been chosen as application layer protocol, in order to reduce process time and memory consumtion, the JSON format has been used, and CBOR has also been used to reduce network trafic. COSE is also used to enhance the security of messages exchange between servers.
In comparision of SAML standard, optimized SAML is more appropriate fot IoT Web services because of low memory usage and processing time and, consequently, the reduction of the time for providing access in IoT environments.

Keywords

References

[1]          T Aihkisalo, "Latencies of Service Invocation and Processing of the REST and SOAP Web Service Interfaces," in IEEE Eighth World Congress on Services, 2012, pp. 100-107.
[2]          Hiro Gabriel, Cerqueira Ferreira, and Edna Dias Canedo, "IoT Architecture to Enable Intercommunication Through REST API a nd U PnP U sing IP, ZigBee a nd Arduino," in 1 st International Workshop on Internet of Things Communications and Technologies (IoT'13), 2013, pp. 53 – 60.
[3]          Jo. Juyeon, Kim. Yoohwan, and Lee Sungchul, "Mindmetrics: Identifying users without their login IDs," in IEEE International Conference on Systems, Man and Cybernetics (SMC), 2014, pp. 2121 - 2126.
[4]          Matthias Kovatsch, Martin Lanter, and Zach Shelby, "Californium: Scalable Cloud Services for the Internet of Things with CoAP," in 4th International Conference on the Internet of Things (IoT 2014), 2014.
[5]          Z. Shelby, K. Hartke, C. Bormann, and B. Frank, "Constrained Application Protocol (CoAP). draft-ietf-core-coap-12," 2012.
[6]          Mahdi Aiash, "Security Analysis of the Constrained Application Protocol in the Internet of Things," , 2013.
[7]          OASIS. (2008, March) OASIS. [Online]. www.oasis-open.org/committees/download.php/27819/sstc-saml-tech-overview-2.0-cd-02.pdf
[8]          M. Ali, T. S. Sobh, and S. EL-Gamal, "Identity Management: Lightweight SAML for Less Processing Power," I.J. Information Technology and Computer Science, pp. 42-49, 2015.
[9]          IEEE Internet Initiative, "Towards a definition of the Internet of Things (IoT)," 2015.
[10]        D. Booth et al. (2004) Web Services Architecture. [Online]. http://www.w3.org/TR/2004/NOTE-ws-arch-20040211/
[11]        G Moritz, F. Golatowski, and D Timmermann, "A Lightweight SOAP over CoAP Transport Binding for Resource Constraint Networks," in Eighth IEEE International Conference on Mobile Ad-Hoc and Sensor Systems, 2011, pp. 861 - 867.
[12]        B. Negasha, A. Rahmani, T Westerlunda, P. Liljeberg, and H. Tenhunena, "LISA: Lightweight Internet of Things Service Bus Architecture ," in The 6th International Conference on Ambient Systems, Networks and Technologies , 2015.
[13]        R. Shirey. (2010) Network Working Group. [Online]. https://www.ietf.org/rfc/rfc2828.txt
[14]        Yinzhi Cao et al., "Protecting Web-Based Single Sign-on Protocols against Relying Party Impersonation Attacks through a Dedicated Bi-directional Authenticated Secure Channel," in Research in Attacks, Intrusions and Defenses.: Springer International Publishing , 2014, pp. 276-298.
[15]        D. Hardt. (2012) Internet Engineering Task Force (IETF). [Online]. https://datatracker.ietf.org/doc/rfc6749/
[16]        Kohlar.F and Schwenk.J Sovis.P, "Security analysis of OpenID," in Proceedings of the Securing Electronic Business Processes-Highlights of the Information Security Solutions Europe 2010 Conference, 2010.
[17]        P. Wang, X. Wu, and H. Yang, "Analysis of the efficiency of data transmission format based on Ajax applications," in nternational Conference of Information Technology, Computer Engineering and Management Sciences, 2011, pp. 265-268.
[18]        N. Nurseitov, M. Paulson, and P. Reynol, "Comparison of JSON and XML Data Interchange Formats: A Case Study," in Computers and Their Applications in Industry and Engineering, 2009.
[19]        C. Bormann and P. Hoffman. (2013) RFC 7049 Internet Engineering Task Force. [Online]. https:lltools.ietf.org/html/rfc7049
[20]        J. Schaad. (2016, Jan.) CBOR Object Signing and Encryption (COSE). [Online]. https://tools.ietf.org/id/draft-ietf-cose-msg-24.txt
[21]        The Eclipse Foundation. (2014) Californium (Cf) CoAP framework. [Online]. https://www.eclipse.org/californium/
Journal of Soft Computing and Information Technology
Volume 8, Issue 1 - Serial Number 23
Spring
March 2019
Pages 14-23

Files

Share

How to cite

Statistics