{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,30]],"date-time":"2026-09-30T06:19:19Z","timestamp":1790749159362,"version":"4.1.0"},"reference-count":66,"publisher":"MDPI AG","issue":"2","license":[{"start":{"date-parts":[[2022,1,25]],"date-time":"2022-01-25T00:00:00Z","timestamp":1643068800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Information"],"abstract":"<jats:p>The area of smart homes is one of the most popular for deploying smart connected devices. One of the most vulnerable aspects of smart homes is access control. Recent advances in IoT have led to several access control models being developed or adapted to IoT from other domains, with few specifically designed to meet the challenges of smart homes. Most of these models use role-based access control (RBAC) or attribute-based access control (ABAC) models. As of now, it is not clear what the advantages and disadvantages of ABAC over RBAC are in general, and in the context of smart-home IoT in particular. In this paper, we introduce HABAC\u03b1, an attribute-based access control model for smart-home IoT. We formally define HABAC\u03b1 and demonstrate its features through two use-case scenarios and a proof-of-concept implementation. Furthermore, we present an analysis of HABAC\u03b1 as compared to the previously published EGRBAC (extended generalized role-based access control) model for smart-home IoT by first describing approaches for constructing HABAC\u03b1 specification from EGRBAC and vice versa in order to compare the theoretical expressiveness power of these models, and second, analyzing HABAC\u03b1 and EGRBAC models against standard criteria for access control models. Our findings suggest that a hybrid model that combines both HABAC\u03b1 and EGRBAC capabilities may be the most suitable for smart-home IoT, and probably more generally.<\/jats:p>","DOI":"10.3390\/info13020060","type":"journal-article","created":{"date-parts":[[2022,1,25]],"date-time":"2022-01-25T20:40:18Z","timestamp":1643143218000},"page":"60","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":41,"title":["An Attribute-Based Approach toward a Secured Smart-Home IoT Access Control and a Comparison with a Role-Based Approach"],"prefix":"10.3390","volume":"13","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-0473-1682","authenticated-orcid":false,"given":"Safwa","family":"Ameer","sequence":"first","affiliation":[{"name":"Department of Computer Science, Institute for Cyber Security and CREST C-SPECC, The University of Texas at San Antonio, San Antonio, TX 78249, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7209-2344","authenticated-orcid":false,"given":"James","family":"Benson","sequence":"additional","affiliation":[{"name":"Department of Computer Science, Institute for Cyber Security and CREST C-SPECC, The University of Texas at San Antonio, San Antonio, TX 78249, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3165-1813","authenticated-orcid":false,"given":"Ravi","family":"Sandhu","sequence":"additional","affiliation":[{"name":"Department of Computer Science, Institute for Cyber Security and CREST C-SPECC, The University of Texas at San Antonio, San Antonio, TX 78249, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2022,1,25]]},"reference":[{"key":"ref_1","unstructured":"(2022, January 18). Internet of Things. Available online: https:\/\/en.wikipedia.org\/wiki\/Internet_of_things."},{"key":"ref_2","unstructured":"He, W., Golla, M., Padhi, R., Ofek, J., D\u00fcrmuth, M., Fernandes, E., and Ur, B. (2018, January 15\u201317). Rethinking access control and authentication for the home internet of things (IoT). Proceedings of the 27th USENIX Security Symposium (USENIX Security 18), Baltimore, MD, USA."},{"key":"ref_3","unstructured":"Tilley, A. (2022, January 18). How a Few Words to Apple\u2019s Siri Unlocked a Man\u2019s Front Door. Available online: https:\/\/www.forbes.com\/sites\/aarontilley\/2016\/09\/21\/apple-homekit-siri-security\/?sh=4f5270c862e5y."},{"key":"ref_4","unstructured":"Hill, K. (2022, January 18). Baby Monitor Hack Could Happen To 40,000 Other Foscam Users. Available online: https:\/\/www.forbes.com\/sites\/kashmirhill\/2013\/08\/27\/baby-monitor-hack-could-happen-to-40000-other-foscam-users\/?sh=51b3cb2f58b5."},{"key":"ref_5","unstructured":"Jia, J., Qiu, X., and Cheng, C. (2012, January 27\u201329). Access control method for web of things based on role and sns. Proceedings of the 2012 IEEE 12th International Conference on Computer and Information Technology, Chengdu, China."},{"key":"ref_6","doi-asserted-by":"crossref","unstructured":"Kaiwen, S., and Lihua, Y. (2014). Attribute-role-based hybrid access control in the internet of things. Asia-Pacific Web Conference, Springer.","DOI":"10.1007\/978-3-319-11119-3_31"},{"key":"ref_7","doi-asserted-by":"crossref","unstructured":"Alramadhan, M., and Sha, K. (August, January 31). An overview of access control mechanisms for internet of things. Proceedings of the 2017 26th International Conference on Computer Communication and Networks (ICCCN), Vancouver, BC, Canada.","DOI":"10.1109\/ICCCN.2017.8038503"},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Ameer, S., Benson, J., and Sandhu, R. (2020, January 11\u201313). The EGRBAC Model for Smart Home IoT. Proceedings of the 2020 IEEE 21st International Conference on Information Reuse and Integration for Data Science (IRI), Las Vegas, NV, USA.","DOI":"10.1109\/IRI49571.2020.00076"},{"key":"ref_9","first-page":"19","article-title":"Criteria specifications for the comparison and evaluation of access control models","volume":"5","author":"Hasani","year":"2013","journal-title":"Int. J. Comput. Netw. Inf. Secur."},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"99","DOI":"10.1109\/TMSCS.2015.2498605","article-title":"Privacy and security in internet of things and wearable devices","volume":"1","author":"Arias","year":"2015","journal-title":"IEEE Trans. Multi-Scale Comput. Syst."},{"key":"ref_11","unstructured":"Ur, B., Jung, J., and Schechter, S. (2013, January 24). The current state of access control for smart devices in homes. Proceedings of the Workshop on Home Usable Privacy and Security (HUPS), Newcastle, UK."},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"1294","DOI":"10.1109\/COMST.2015.2388550","article-title":"Security for the internet of things: A survey of existing protocols and open research issues","volume":"17","author":"Granjal","year":"2015","journal-title":"IEEE Comm. Surv. Tutor."},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"94","DOI":"10.1145\/2398356.2398377","article-title":"Computer security and the modern home","volume":"56","author":"Denning","year":"2013","journal-title":"Commun. ACM"},{"key":"ref_14","doi-asserted-by":"crossref","unstructured":"Cui, A., and Stolfo, S.J. (2010, January 6\u201310). A quantitative analysis of the insecurity of embedded network devices: Results of a wide-area scan. Proceedings of the 26th Annual Computer Security Applications Conference, Austin, TX, USA.","DOI":"10.1145\/1920261.1920276"},{"key":"ref_15","unstructured":"Oluwafemi, T., Kohno, T., Gupta, S., and Patel, S. (2013, January 16\u201317). Experimental security analyses of non-networked compact fluorescent lamps: A case study of home automation security. Proceedings of the Learning from Authoritative Security Experiment Results (LASER) 2013, Arlington, VA, USA."},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Fernandes, E., Jung, J., and Prakash, A. (2016, January 22\u201326). Security analysis of emerging smart home applications. Proceedings of the 2016 IEEE Symposium on Security and Privacy (SP), San Jose, CA, USA.","DOI":"10.1109\/SP.2016.44"},{"key":"ref_17","unstructured":"Ho, G., Leung, D., Mishra, P., Hosseini, A., Song, D., and Wagner, D. (June, January 30). Smart locks: Lessons for securing commodity internet of things devices. Proceedings of the 11th ACM on Asia Conference on Computer and Communications Security, Xi\u2019an, China."},{"key":"ref_18","unstructured":"Fernandes, E., Paupore, J., Rahmati, A., Simionato, D., Conti, M., and Prakash, A. (2016, January 10\u201312). Flowfence: Practical data protection for emerging IoT application frameworks. Proceedings of the 25th USENIX Security Symposium (USENIX Security 16), Austin, TX, USA."},{"key":"ref_19","unstructured":"Morgner, P., Mattejat, S., and Benenson, Z. (2016). All your bulbs are belong to us: Investigating the current state of security in connected lighting systems. arXiv."},{"key":"ref_20","doi-asserted-by":"crossref","unstructured":"Gupta, M., and Sandhu, R. (2018, January 13\u201315). Authorization framework for secure cloud assisted connected cars and vehicular internet of things. Proceedings of the 23nd ACM on Symposium on Access Control Models and Technologies, Indianapolis, IN, USA.","DOI":"10.1145\/3205977.3205994"},{"key":"ref_21","doi-asserted-by":"crossref","first-page":"237","DOI":"10.1016\/j.comnet.2016.11.007","article-title":"Access control in the Internet of Things: Big challenges and new opportunities","volume":"112","author":"Ouaddah","year":"2017","journal-title":"Comput. Netw."},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"224","DOI":"10.1145\/501978.501980","article-title":"Proposed NIST standard for role-based access control","volume":"4","author":"Ferraiolo","year":"2001","journal-title":"ACM Trans. Inf. Syst. Secur. (TISSEC)"},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"237","DOI":"10.1016\/S0065-2458(08)60206-5","article-title":"Role-based access control","volume":"Volume 46","author":"Sandhu","year":"1998","journal-title":"Advances in Computers"},{"key":"ref_24","unstructured":"Covington, M.J., Moyer, M.J., and Ahamad, M. (2000). Generalized Role-Based Access Control for Securing Future Applicationsl Technical Report, Georgia Tech."},{"key":"ref_25","unstructured":"Zhang, G., and Tian, J. (2010, January 18\u201319). An extended role based access control model for the Internet of Things. Proceedings of the 2010 International Conference on Information, Networking and Automation (ICINA), Kunming, China."},{"key":"ref_26","doi-asserted-by":"crossref","unstructured":"Barka, E., Mathew, S.S., and Atif, Y. (2015). Securing the web of things with role-based access control. International Conference on Codes, Cryptology, and Information Security, Springer.","DOI":"10.1007\/978-3-319-18681-8_2"},{"key":"ref_27","doi-asserted-by":"crossref","unstructured":"Bandara, S., Yashiro, T., Koshizuka, N., and Sakamura, K. (2016, January 25\u201327). Access control framework for api-enabled devices in smart buildings. Proceedings of the 2016 22nd Asia-Pacific Conference on Communications (APCC), Yogyakarta, Indonesia.","DOI":"10.1109\/APCC.2016.7581479"},{"key":"ref_28","doi-asserted-by":"crossref","unstructured":"Liu, J., Xiao, Y., and Chen, C. (2012, January 18\u201321). Authentication and access control in the internet of things. Proceedings of the 2012 32nd International Conference on Distributed Computing Systems Workshops, Macau, China.","DOI":"10.1109\/ICDCSW.2012.23"},{"key":"ref_29","doi-asserted-by":"crossref","unstructured":"Bhatt, S., Patwa, F., and Sandhu, R. (2017, January 21\u201323). Access control model for AWS internet of things. Proceedings of the International Conference on Network and System Security, Helsinki, Finland.","DOI":"10.1007\/978-3-319-64701-2_57"},{"key":"ref_30","doi-asserted-by":"crossref","first-page":"85","DOI":"10.1109\/MC.2015.33","article-title":"Attribute-based access control","volume":"48","author":"Hu","year":"2015","journal-title":"Computer"},{"key":"ref_31","doi-asserted-by":"crossref","unstructured":"Jin, X., Krishnan, R., and Sandhu, R. (2012, January 11\u201313). A unified attribute-based access control model covering DAC, MAC and RBAC. Proceedings of the IFIP Annual Conference on Data and Applications Security and Privacy, Paris, France.","DOI":"10.1007\/978-3-642-31540-4_4"},{"key":"ref_32","doi-asserted-by":"crossref","unstructured":"Bezawada, B., Haefner, K., and Ray, I. (2018, January 19\u201321). Securing Home IoT Environments with Attribute-Based Access Control. Proceedings of the Third ACM Workshop on Attribute-Based Access Control, Tempe, AZ, USA.","DOI":"10.1145\/3180457.3180464"},{"key":"ref_33","doi-asserted-by":"crossref","unstructured":"Mutsvangwa, A., Nleya, B., and Nleya, B. (July, January 28). Secured access control architecture consideration for smart grids. Proceedings of the 2016 IEEE PES Power Africa, Livingstone, Zambia.","DOI":"10.1109\/PowerAfrica.2016.7556606"},{"key":"ref_34","doi-asserted-by":"crossref","unstructured":"Xie, Y., Wen, H., Wu, J., Jiang, Y., Meng, J., Guo, X., Xu, A., and Guan, Z. (2015, January 6\u20139). Three-layers secure access control for cloud-based smart grids. Proceedings of the 2015 IEEE 82nd Vehicular Technology Conference (VTC2015-Fall), Boston, MA, USA.","DOI":"10.1109\/VTCFall.2015.7391174"},{"key":"ref_35","doi-asserted-by":"crossref","unstructured":"Gupta, M., Benson, J., Patwa, F., and Sandhu, R. (2019, January 25\u201327). Dynamic groups and attribute-based access control for next-generation smart cars. Proceedings of the Ninth ACM Conference on Data and Application Security and Privacy, Richardson, TX, USA.","DOI":"10.1145\/3292006.3300048"},{"key":"ref_36","doi-asserted-by":"crossref","unstructured":"Bhatt, S., and Sandhu, R. (2020, January 10\u201312). ABAC-CC: Attribute-Based Access Control and Communication Control for Internet of Things. Proceedings of the 25th ACM Symposium on Access Control Models and Technologies, Barcelona, Spain.","DOI":"10.1145\/3381991.3395618"},{"key":"ref_37","doi-asserted-by":"crossref","first-page":"318","DOI":"10.1016\/j.cose.2019.06.010","article-title":"Blockchain based permission delegation and access control in Internet of Things (BACI)","volume":"86","author":"Ali","year":"2019","journal-title":"Comput. Secur."},{"key":"ref_38","doi-asserted-by":"crossref","unstructured":"Ouaddah, A., Elkalam, A.A., and Ouahman, A.A. (2017). Towards a novel privacy-preserving access control model based on blockchain technology in IoT. Europe and MENA Cooperation Advances in Information and Communication Technologies, Springer.","DOI":"10.1007\/978-3-319-46568-5_53"},{"key":"ref_39","first-page":"1184","article-title":"Blockchain meets IoT: An architecture for scalable access management in IoT","volume":"5","author":"Novo","year":"2018","journal-title":"IEEE IoT J."},{"key":"ref_40","doi-asserted-by":"crossref","unstructured":"Dorri, A., Kanhere, S.S., Jurdak, R., and Gauravaram, P. (2017, January 13\u201317). Blockchain for IoT security and privacy: The case study of a smart home. Proceedings of the 2017 IEEE International Conference on Pervasive Computing and Communications Workshops (PerCom Workshops), Kona, HI, USA.","DOI":"10.1109\/PERCOMW.2017.7917634"},{"key":"ref_41","doi-asserted-by":"crossref","first-page":"38431","DOI":"10.1109\/ACCESS.2019.2905846","article-title":"A novel attribute-based access control scheme using blockchain for IoT","volume":"7","author":"Ding","year":"2019","journal-title":"IEEE Access"},{"key":"ref_42","doi-asserted-by":"crossref","unstructured":"Park, J., and Sandhu, R. (2002, January 3\u20134). Towards usage control models: Beyond traditional access control. Proceedings of the Seventh ACM Symposium on Access Control Models and Technologies, Monterey, CA, USA.","DOI":"10.1145\/507711.507722"},{"key":"ref_43","unstructured":"Park, J. (2003). Usage Control: A Unified Framework for Next Generation Access Control. [Ph.D. Thesis, George Mason University]."},{"key":"ref_44","doi-asserted-by":"crossref","first-page":"351","DOI":"10.1145\/1108906.1108908","article-title":"Formal model and policy specification of usage control","volume":"8","author":"Zhang","year":"2005","journal-title":"ACM Trans. Inf. Syst. Secur. (TISSEC)"},{"key":"ref_45","first-page":"724","article-title":"The research of access control based on UCON in the internet of things","volume":"6","author":"Guoping","year":"2011","journal-title":"J. Softw."},{"key":"ref_46","doi-asserted-by":"crossref","unstructured":"La Marra, A., Martinelli, F., Mori, P., and Saracino, A. (2017, January 1\u20134). Implementing usage control in internet of things: A smart home use case. Proceedings of the 2017 IEEE Trustcom\/BigDataSE\/ICESS, Sydney, NSW, Australia.","DOI":"10.1109\/Trustcom\/BigDataSE\/ICESS.2017.352"},{"key":"ref_47","doi-asserted-by":"crossref","unstructured":"Martinelli, F., Michailidou, C., Mori, P., and Saracino, A. (2018, January 4). Too long, did not enforce: A qualitative hierarchical risk-aware data usage control model for complex policies in distributed environments. Proceedings of the 4th ACM Workshop on Cyber-Physical System Security, Incheon, Korea.","DOI":"10.1145\/3198458.3198463"},{"key":"ref_48","doi-asserted-by":"crossref","first-page":"9762","DOI":"10.1109\/JIOT.2019.2931372","article-title":"Certificate-based anonymous device access control scheme for IoT environment","volume":"6","author":"Malani","year":"2019","journal-title":"IEEE Internet Things J."},{"key":"ref_49","doi-asserted-by":"crossref","first-page":"4682","DOI":"10.1109\/JIOT.2020.2969326","article-title":"A survey on access control in the age of internet of things","volume":"7","author":"Qiu","year":"2020","journal-title":"IEEE Internet Things J."},{"key":"ref_50","doi-asserted-by":"crossref","first-page":"79","DOI":"10.1016\/j.jnca.2019.06.017","article-title":"Access control in Internet-of-Things: A survey","volume":"144","author":"Ravidas","year":"2019","journal-title":"J. Netw. Comput. Appl."},{"key":"ref_51","doi-asserted-by":"crossref","unstructured":"Zhang, Y., and Wu, X. (2016). Access control in internet of things: A survey. arXiv.","DOI":"10.12783\/dtetr\/apetc2017\/11295"},{"key":"ref_52","doi-asserted-by":"crossref","first-page":"344","DOI":"10.1016\/j.future.2018.12.061","article-title":"IoT-FBAC: Function-based access control scheme using identity-based encryption in IoT","volume":"95","author":"Yan","year":"2019","journal-title":"Future Gener. Comput. Syst."},{"key":"ref_53","first-page":"156","article-title":"Secure mutual authentication and automated access control for IoT smart home using cumulative keyed-hash chain","volume":"45","author":"Alshahrani","year":"2019","journal-title":"J. Inf. Secur. Appl."},{"key":"ref_54","unstructured":"Sikder, A.K., Babun, L., Celik, Z.B., Acar, A., Aksu, H., McDaniel, P., Kirda, E., and Uluagac, A.S. (2019). Multi-user multi-device-aware access control system for smart home. arXiv."},{"key":"ref_55","doi-asserted-by":"crossref","unstructured":"Sandhu, R., Ferraiolo, D., and Kuhn, R. (2000, January 26\u201328). The NIST model for role-based access control: Towards a unified standard. Proceedings of the ACM Workshop on Role-Based Access Control, Berlin, Germany.","DOI":"10.1145\/344287.344301"},{"key":"ref_56","doi-asserted-by":"crossref","unstructured":"Ameer, S., and Sandhu, R. (2021, January 28). The HABAC Model for Smart Home IoT and Comparison to EGRBAC. Proceedings of the ACM Workshop on Secure and Trustworthy Cyber-Physical Systems (SAT-CPS), Online.","DOI":"10.1145\/3445969.3450428"},{"key":"ref_57","unstructured":"(2022, January 20). Partial Function. Available online: https:\/\/en.wikipedia.org\/wiki\/Partial_function."},{"key":"ref_58","unstructured":"(2022, January 20). Atomic Sentence. Available online: https:\/\/en.wikipedia.org\/wiki\/Atomic_sentence."},{"key":"ref_59","doi-asserted-by":"crossref","unstructured":"Geneiatakis, D., Kounelis, I., Neisse, R., Nai-Fovino, I., Steri, G., and Baldini, G. (2017, January 22\u201326). Security and privacy issues for an IoT based smart home. Proceedings of the 2017 40th International Convention on Information and Communication Technology, Electronics and Microelectronics (MIPRO), Opatija, Croatia.","DOI":"10.23919\/MIPRO.2017.7973622"},{"key":"ref_60","unstructured":"(2022, January 20). AWS-IoT. Available online: https:\/\/aws.amazon.com\/iot\/."},{"key":"ref_61","unstructured":"(2022, January 20). AWS IoT Greengrass. Available online: https:\/\/docs.aws.amazon.com\/greengrass\/latest\/developerguide\/what-is-gg.html."},{"key":"ref_62","unstructured":"(2022, January 20). AWS IoT Device SDK for Python. Available online: https:\/\/docs.aws.amazon.com\/greengrass\/latest\/developerguide\/IoT-SDK.html."},{"key":"ref_63","unstructured":"(2022, January 20). MQTT.fx\u2014A JavaFX based MQTT Client. Available online: https:\/\/softblade.de\/en\/welcome\/."},{"key":"ref_64","unstructured":"(2022, January 20). The Transport Layer Security (TLS) Protocol. Available online: https:\/\/tools.ietf.org\/html\/rfc5246."},{"key":"ref_65","doi-asserted-by":"crossref","first-page":"231","DOI":"10.3233\/JCS-2007-15202","article-title":"A theory for comparing the expressive power of access control models","volume":"15","author":"Tripunitara","year":"2007","journal-title":"J. Comput. Secur."},{"key":"ref_66","doi-asserted-by":"crossref","first-page":"79","DOI":"10.1109\/MC.2010.155","article-title":"Adding attributes to role-based access control","volume":"43","author":"Kuhn","year":"2010","journal-title":"Computer"}],"container-title":["Information"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2078-2489\/13\/2\/60\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,10]],"date-time":"2025-10-10T22:07:10Z","timestamp":1760134030000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2078-2489\/13\/2\/60"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,1,25]]},"references-count":66,"journal-issue":{"issue":"2","published-online":{"date-parts":[[2022,2]]}},"alternative-id":["info13020060"],"URL":"https:\/\/doi.org\/10.3390\/info13020060","relation":{},"ISSN":["2078-2489"],"issn-type":[{"value":"2078-2489","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022,1,25]]}}}