A Named-Entity-based TTP-free Authentication and Authorization Architecture for IoT Systems

Authentication and authorization are essential functionalities in Internet of Things (IoT) systems in the areas of device monitoring, access control, data sharing, and privacy preservation. The current authentication and authorization technologies are mainly based on ID/Password (credential), public key cryptography collaborating with multi-factor approaches, and manual basis static access control for data resources. However, they have disadvantages in terms of identity/credential management, privacy preservation, and the mandatory requirement of Trusted Third Party (TTP) Certificate Authorities (which are not cryptographically secure) for certificate verifications. The objective of this fast abstract is to present a novel idea for named-entity-based TTP-free authentication and authorization architecture in IoT systems. The proposed architecture is based on the collaboration of blockchain technology and DNS-based Authentication of Named Entity (DANE) protocol to provide secure and privacy-preserved authentication and authorization functionalities with considering effective device identity management and secure data access control in IoT systems.