This paper investigates a critical access control issue in the Internet of Things (IoT). In particular, we propose a smart contract-based framework, which consists of multiple access control contracts (ACCs), one judge contract (JC) and one register contract (RC), to achieve distributed and trustworthy access control for IoT systems. Each ACC provides one access control method for a subject-object pair, and implements both static access right validation based on predefined policies and dynamic access right validation by checking the behavior of the subject. The JC implements a misbehavior-judging method to facilitate the dynamic validation of the ACCs by receiving misbehavior reports from the ACCs, judging the misbehavior and returning the corresponding penalty. The RC registers the information of the access control and misbehavior-judging methods as well as their smart contracts, and also provides functions (e.g., register, update and delete) to manage these methods. To demonstrate the application of the framework, we provide a case study in an IoT system with one desktop computer, one laptop and two Raspberry Pi single-board computers, where the ACCs, JC and RC are implemented based on the Ethereum smart contract platform to achieve the access control.

Efficient and reliable access control in smart cities is critical for the protection of various resources for decision making and task execution. Existing centralized access control schemes suffer from the limitations of single point of failure, low reliability, and poor scalability. This article, therefore, proposes a distributed and reliable access control framework for smart cities by combining the blockchain smart contract technology and the attribute-based access control (ABAC) model. The framework consists of one policy management contract (PMC) for managing the ABAC policies, one subject attribute management contract (SAMC) for managing the attributes of subjects (i.e., entities accessing resources), one object attribute management contract (OAMC) for managing the attributes of objects (i.e., resources being accessed), and one access control contract (ACC) for performing the access control. To show the feasibility of the proposed framework, we construct a local private Ethereum blockchain system to implement the four smart contracts and also conduct experiments to evaluate the monetary cost as well as to compare the proposed framework with an existing access control list (ACL)-based scheme. The experimental results show that although the proposed scheme consumes more money than the ACL-based scheme at the deployment stage, it introduces less monetary cost during the system running especially for large-scale smart cities.

Due to the rapid penetration of the Internet of Things (IoT) into human life, illegal access to IoT resources (e.g., data and actuators) has greatly threatened our safety. Access control, which specifies who (i.e., subjects) can access what resources (i.e., objects) under what conditions, has been recognized as an effective solution to address this issue. To cope with the distributed and trust-less nature of IoT systems, we propose a decentralized and trustworthy Capability-Based Access Control (CapBAC) scheme by using the Ethereum smart contract technology. In this scheme, a smart contract is created for each object to store and manage the capability tokens (i.e., data structures recording granted access rights) assigned to the related subjects, and also to verify the ownership and validity of the tokens for access control. Different from previous schemes which manage the tokens in units of subjects, i.e., one token per subject, our scheme manages the tokens in units of access rights or actions, i.e., one token per action. Such novel management achieves more fine-grained and flexible capability delegation and also ensures the consistency between the delegation information and the information stored in the tokens. We implemented the proposed CapBAC scheme in a locally constructed Ethereum blockchain network to demonstrate its feasibility. In addition, we measured the monetary cost of our scheme in terms of gas consumption to compare our scheme with the existing Blockchain-Enabled Decentralized Capability-Based Access Control (BlendCAC) scheme proposed by other researchers. The experimental results show that the proposed scheme outperforms the BlendCAC scheme in terms of the flexibility, granularity, and consistency of capability delegation at almost the same monetary cost.

This paper investigates the fundamental issues of mode selection and spectrum partition in cellular networks with in-band device-to-device (D2D) communication from the physical-layer security (PLS) perspective. We consider a mode selection scheme allowing each D2D pair to probabilistically switch between the underlay and overlay modes, and also a spectrum partition scheme where the system spectrum is orthogonally partitioned between cellular and overlay D2D communications. We first develop a general theoretical framework to model the secrecy outage and secrecy capacity performance of cellular users as well as the outage and capacity performance of D2D pairs. Optimization problems are also solved to identify the optimal mode selection and spectrum partition for secrecy capacity maximization and secrecy outage probability minimization. A case study is then provided to demonstrate the application of our theoretical framework for performance modeling and optimization, and also to illustrate the impacts of mode selection and spectrum partition on the PLS performances of in-band D2D communications.

This article explores a new secure wireless communication scenario for the data collection in the Internet of Things (IoT) where the physical layer security technology is applied to counteract both the detection and eavesdropping attacks, such that the critical covertness and secrecy properties of the communication are jointly guaranteed. We first provide theoretical modeling for covertness outage probability (COP), secrecy outage probability (SOP), and transmission probability (TP) to depict the covertness, secrecy, and transmission performances of the wireless communication system. To understand the fundamental security performance under the wireless communication system, we then define a new metric—covert secrecy rate (CSR), which characterizes the maximum transmission rate subject to the constraints of COP, SOP, and TP. We further conduct a detailed theoretical analysis to identify the CSR under various scenarios determined by the detector-eavesdropper relationships and the secure transmission schemes adopted by transmitters. Finally, numerical results are provided to illustrate the achievable performances under the secure wireless communication system.

Millimeter-wave (mmWave) communications are highly promising to improve the capacity of modern wireless networks, while the physical layer security (PLS) techniques hold great potential to enhance the critical secrecy performance therein. By carefully exploiting the significant signal difference between the Non-Light-of-Sight (NLoS) and Line-of-Sight (LoS) mmWave links, this paper proposes a Sight-based Cooperative Jamming (SCJ) scheme to improve the PLS performance of mmWave ad hoc communications. In this scheme, each potential jammer that has no LoS link to its nearest receiver but may have LoS links to eavesdroppers is selected with a certain probability to generate artificial noise such that channel advantages at legitimate receivers can be achieved. For performance modeling of the new jamming scheme, novel and efficient theoretical approximation approaches are firstly developed to enable the challenging issue of interference distribution modeling to be tackled, and then a theoretical framework based on stochastic geometry is proposed to capture the secrecy transmission capacity behavior under the SCJ scheme. Finally, extensive numerical results are provided to illustrate the SCJ scheme under various network scenarios.