Context-based security is an approach for modeling adaptive security solutions based on the situation of use of the system. Security policies in this approach are not static as it used to be in traditional systems. The security actions to be taken are based on the knowledge of the combination of various factors such as the location of the user, the surroundings, time, temperature etc making the security policies more adaptive. The aim of this paper is to present security meta-policies based on an existing approach known as Contextual Graphs and the multilevel access model, which we presented in our previous paper. These meta-policies determine within what contexts actions in other policies should be taken - it is in this sense that we have the notion of other policies “embedded” within the meta-policy. Our approach can be easily used in various smart environments, even for context-aware safety meta-policies. The paper presents their use in a smart home scenario.
Computers have become more pervasive and their functionality more transparently integrated into homes and communities. As a result, new applications have emerged making everyday living easier for people. Context based security is an emerging approach for more flexible security solutions. It aims at coping with the security problems resulting from the high heterogeneity and dynamicity of ubiquitous environments. It provides a convenient way for modeling security requirements in complex systems.
The paper presents context-based security policies for a smart home scenario using
contextual graphs developed by [
The remainder of the paper is organized as follows. Section 2 presents the concept of context-based security. Section 3 discusses the need for context-based security in a smart home environment. Section 4 describes a brief presentation of contextual graphs that will be used to model context based security. Section 5 gives an overview of basic security policies referred to from our meta-policy contextual graph. Section 6 develops a context based security meta-policy for a smart home. In section 7, related work done is discussed. Section 8 concludes the paper.
In traditional security systems, protected resources such as documents, hardware
devices and software applications follow an On/Off access policy [
As shown in the figure the pervasive
environment is initially controlled by some
security policy depending upon the initial
context at that time [
Kouadri and Brézillon [
The role of a security policy is to recognize valuable system assets and clarify security
responsibilities [
Smart home is an upcoming example of ubiquitous computing. A communication infrastructure is installed that allows the various systems and devices in the home to communicate with each other [16]. In early stages of security, the user needed to carry smart cards for authenticating himself. But with the introduction of advanced biometrics with automatic sensing capabilities there is no burden of carrying these smart cards. As each person’s retina, thumbprint or voice is unique, these features are used to check the authenticity of the users.
The design of a smart home needs to take into account not only the form of the house itself but also the requirements, both generic and specific, of the people who may live in and visit the house. The security system in smart homes must be adaptive to the changing situations. The user should be given the right to formulate the security actions based on the changing context and store it in the database. Thus, the use of context-based security in smart homes is very important. It gives the security policy the flexibility to adjust its security actions according to the situational information. This prevents any unauthorized access to the devices at home. A policy can restrict access to information or resources based on several factors, including attributes pertaining to the subject, the resource or the environment [16]. For example, subjects can be classified into roles such as “resident” or “guest.” Access rights can depend on the subject’s classification (i.e resident), as well as on his or her actual identity (i.e parent, child etc.). Access also may be restricted based on the subject’s location, or based on environmental factors such as the temperature or the time of day. The sensors sense the combination of all these factors present and the security policy generates the security action based on the rules stored in the database by the users.
Mobile Ambients first proposed by Cardelli and Gordon [
When a privileged process (agent or person) leaves the parent ambient (e.g., a host
institution) to execute some external independent activities, it relinquishes its local
privileges and authority within its bounding parent ambient and ambient community. It
exits the parent and might later return to the parent ambient. At this point an
Authentication mechanism is needed to check the authenticity of the returning
original process. Cardelli and Gordon [
So if any agent/process has to enter an ambient, it has to know the name of the ambient and also posses the capability to enter in it. The functionality of firewall is achieved with the help of restriction primitives and with the help of anonymity of the ambient name. Thus without knowing the ambient name, no process or agent can go out or enter in the parent ambient. This helps in achieving protection of the resources from unwanted agents. The ambient name could be interpreted as a secret password.
Cardelli and Gordon also put forth the encryption primitives to communicate
between two ambients or between an ambient and a remote agent. These primitives
helped in maintaining the Confidentiality of the message or data. Consider a Plaintext
message M. The encryption of the plaintext message is done with the help of the
encryption key k. The Ciphertext produced is indicated as Mk. [
In general, an enclosed ambient environment would typically contain numerous subambients as well as active processes, agents and information resources. These groups of subambients within an ambient may be arbitrarily nested and organised in a hierarchical structure. Ambients and processes which are at the higher level of the nested structure are responsible for managing resources which are more vital and important than those which are at lower level. In such kind of multilevel environments, it is necessary to restrict the access to the flow of information depending upon the need and the security levels. Information can only flow from lower levels of security to higher levels and not conversely. A policy for this assigns levels to users and restricts information flow among the users.
The multilevel security policy mandatory access control security in the boxed
ambients provided restricted access to information based on the various security levels
in the hierarchical levels. The access is defined by the level at which the agents are
which are predetermined based on their needs. But Braghin [
The Security Boundary [
A contextual graph (CxG)
allows a context-based
representation of a given problem
solving for operational processes
by taking into account the working
environment [
This section gives the various types of users associated with the smart home. It also specifies the various types of contextual information that is going to be used for implementing the security meta-policy. Finally the various security actions to be taken depending upon the information received are also stated. All the users need to know the secret code of the home network to get access to the network.
Roles: Owner, Child, Other members, Guests, Maintenance staff.
The five policies above are integrated into a contextual graph in that security actions taken in the graph are those with respect to these policies. The approach gives safe access to the devices. So anything which is not specified is considered as unsafe and is denied and hence not shown.
The Secret code S in the diagram can be considered as a secret name of the smart home network, which has to be known by each and every person who, wants to enter the house. In case of guests, the owner is responsible for producing it. This secret code is similar to the secret name of the ambient in case of ambient terms.
Security actions: These are the various techniques, which are used for authorizing the user at the various security points. The security actions are taken in conjunction with the security policies specified.
1. SAo: This security action is taken by the security policy when a user departs from the home network temporarily, curbing all her/his rights. The system gives a secret password to each user so that his identity can be checked when s/he would come back again. This security action although not given in the two figures below is mandatory for all local entities. When they arrive back then they have to revoke their rights by presenting their identity.
2. SAi: This security action is taken by the system when a user who had temporarily departed needs the access to the network. If the location is just outside the house at the door then the retina and the thumb print scanner checks the identity and this is enough to validate the local user. If the access place is remote then the user has to first enter the secret code of the smart home network, which is mandatory for any user and then the secret password is given to him/her at the time of departure.
3. SAf1: This security action is required in case of access for some foreign agent into the network. It prompts the user for her/his password to authenticate her/him-self to the system. It can either be a normal identification by the scanners when the access point is the door or a normal password if the access point is at remote location.
4. SAf2: This security action is required in case of some foreign agent entry into the network. It helps the user to get into the network. It can be the administrator authentication in case of door access to ensure that s/he is with the foreign user or can be one more level of password authentication if the location is remote.
5. SAe: This security action ensures that the data/information is carried in an encrypted format. It is taken when the access point is a remote location.
6. SAr: This security action prompts the users to enter their respective roles. This is used while accessing the devices inside the house.
7. SAb: In this security action the transfer of information between remote high level entities is carried through one more high level entity in order to prevent accidental leakage of data to the low level entities or unauthorised users.
8. SAsi: The security action SAi which when taken with the help of biometric identification tools. These tools are used for user authentication in order to have authorized access to the valuable resources. We have many devices such as Thumb Print scanner, Voice recognition, palm prints, hand/wrist vein patterns, retinal/iris eye scans, hand geometry/topography, keystroke dynamics or typing rhythms, and signature verification. In case of thumb print scanner the user presses his or her finger against an input device for verification in order to gain access. Within seconds, access is either granted or rejected, based upon stored fingerprints. In case of the Voice recognition, the users voice is recorded and matched with the one stored before in the database. The same methods apply in retina scanning but with the help of retina properties of the users.
9. SAso: The security action SAo which when taken with the help of biometrics (Retina scan or Voice recognition) as described above.
10. SAsr: The security action SAr which when taken with the help of biometrics (Retina scan or Voice recognition) as described above. 6.2
Getting access to the home network is the first step in accessing the devices. The contextual graph shown in Figure 3 gives the various scenarios in which a user is given access to the home network. The access is given only when a particular user satisfies the various criteria decided by the security policy. The secret password has to be known by each and every user and is a mandatory condition if he wants the access. 1. When the owner of the house wants the access to the house, s/he has to first enter the secret code of the home network with the help of some wireless device. If s/he is not having the device then because s/he being the administrator of the network is given access to the network. But for others, carrying a device is a must. If the access point is the door then the owner is authenticated with the help of retina scanner, which in this case serves to satisfy the requirement of the security actions, SAr and SAi together. If s/he wants to access the network from a remote location such as his/her office then s/he has to enter the secret code of the network, her/his role, and the secret password that validates that s/he is a local (occupants of the home) entity. As s/he is at the top security level s/he is not asked for more identification. S/he gets access to the home straight away. Such kind of authentication is part of a multilevel access security model. The retina scanner in this case makes sure that only the authenticated person from the home community is given access. Once the owner is in the house he can access the devices according to the policy in Figure 4.
2. Children are given access to the home similar to the owner, as they are also the local entities of the home community. Once they are inside the house they are given access to the devices depending upon the devices and also on the presence or absence of the owner of the house as in Figure 4. The only difference is that in their case they are not allowed to access the devices from a distant location.
3. The remaining members from the house like spouse, parents, grandparents who are staying in the house also have to face similar kinds of authentication while entering the home. Once inside the network they are given access according to their predefined security level, which is needed by the security action SAr.
4. Guests are treated in a different manner. They are given access to the home network after passing through an authentication procedure in a multilevel access model. They are given access only when their location is at the door of the house. Further as per case 2 they have to pass two authentication levels necessitated by the security actions SAf1 and SAf2. For SAf1, they have to first validate themselves with the help of retina scan. For SAf2, they are given access only if they are with the owner of the house. The retina scanner first validates them and then the owner. Thus, the validation of owner helps in getting the guest in the home network. If this is not satisfied then the guest is not given the access. Once inside the owner need not be with them all the time, and can access the devices in the home based on their predefined security levels as dictated by Figure 4.
5. The maintenance staff is the one from which the security package is purchased from. They are required to monitor the performance of the smart devices. They can (but need not) come every weekend at a particular time to have an overall check up. They are also considered as foreign entities like guests. The retina scanner first validates them and then they have to enter a password given to them, which will help them to enter the home network. But a situation might also happen when there is an emergency. Emergency can be when an unauthorized person is trying to access a particular device in the house. In such situations, the staff might have to enter the house not necessarily at the specified time. They can get access to the network in such cases from any location. They can enter the home network after validating twice: first by entering the password given to them, and then using an emergency code that they are also given that will get them into the network. The difference from the owner in such access is that it just allows them to disconnect all the smart home facilities. In such cases, the owner is contacted and then the necessary actions are taken based on the owners’ consent.
The following section indicates how the security policy provides controlled access to the devices in the home network. The following approach when used in conjunction with the approach in the previous section can be effectively used to implement stern security policies The above approach shows how Context based security is implemented in smart homes. The following subsection describes the various security actions taken by the security policy in appropriate situations. Let’s have a look at the various valid scenarios in which the smart devices in the home can be accessed after passing through various authentication levels.
Context 1: Role= User, location= home; Context 2: Role= User, location= outside.
If the user is the owner of the house, s/he is considered at the topmost security level. If s/he is in the house s/he can access the device by just entering his/her role in case of manual authentication. If the process is automatic then either the thumb print scanner or retina scanner authenticates him.
If the owner is not at home and wants to communicate with his/her PC then s/he has to go through the three authentication levels that depict the security actions deployed by the model as shown in Figure 4. Once s/he gets in the network s/he has to enter his/her role, which will prove that s/he is the administrator. After this the most important security action taken by the policy is encryption of the further information, which is communicated between the device and the user.
Further, in order to prevent the accidental leakage of data to high-level or unauthorised entities, the messages are first sent to the server which is kept at the security company which checks whether the communicating entities are at the same level or not. The security action SAb accounts for this checking.
Scenario 2. There is just one valid context in this case. Valid context is that in which the access to the device is granted.
Context: Role= Children, location= home & with parent
If the users are the children in the house, they are given access to the devices only when the owner is with them. Further the access is granted only when they are at home and is based on their security levels.
Context: Role= Guest, location= home
Guests in this model are the owner’s friends, relatives or colleagues. If the guests want to access the devices they have to first get inside the house using the part of the policy defined in the first contextual graph. They can only do that when the owner of the house is with them. After getting in they can access the devices as per their predefined security levels by either entering their usernames/passwords which will decide their security level based on the predefined one’s or by normal biometrics in case of an advanced scenario.
Context 1: Role= other members of the house, location= house.
Context 2: Role= other members of the house, location= outside.
Other members are spouse, parents of the owner. The security policy behaves in a similar fashion as in the case of the owner. If the members of the house other than the owner want to access the devices then they are given access after performing two different sequences of security actions in two different contexts. If they are within the house then they are given access based on their security level as predefined. The biometrics devices sense their role. The security action SAsr takes care of that. When the access point is a remote location they have to first get in the home network with the help of the first policy (Figure 3). Then they can access the resources based on their role/security level by manually entering their username/role through some remote devices. Beyond this as the information transfer is between two remote devices the communication has to be secured. Our security policy prompts the necessary security action (SAe) to be taken to account for that. This is Policy3, which provides an encrypted communication between the remote place and the local devices. SAb assures that there is no leakage of data in the process of communication. Scenario 5. The maintenance staffs are allowed to access the devices only at weekends and at a particular time. If they arrive at the specific time then they can access the particular device according to their predefined security levels, which is sensed by the sensor at each of the devices. This is done in the security action denoted by SAsr. If not approved, then they are not allowed to access any devices. They are limited in what they do with the system – they can only turn off the working of all the devices and then take the necessary steps depending upon the cause of the unauthorized access. A red node in the figure 4 denotes this. This special denotation is used to make things clear in emergency situations and is very much in lines with the definition of the context graph in respect of the number of outputs.
In this way the security meta-policy proposed would take appropriate security actions based on the context at that moment and will give controlled access to the resources. The contextual graphs shown above can be expanded to include more possibilities as and when the need arises.
This section briefly highlights the existing projects and technologies that have
influenced my work in using ambient calculus in context based security and how my
model is different than those existing ones. Although the concept of contextual graph
was first explored by Mostefaoui et al. (2004) [
Due to ubiquitous nature of the today’s computing world security is of utmost important. The traditional static authentication techniques are no longer valid and justified. This situation is due to the lack of consideration for context in existing security systems. Context based security helps the security policy to adapt to the new threats as it comes. It aims at providing flexible security models for distributed infrastructures, where the user’s and application environments are continually changing. In this paper, we have presented an approach that helps in context based security for a smart home. The type and nature of the authentications that are demanded by the security policy depend on the information that is collected from the environment. Further, contextual graph approach helps to add/modify secure paths based on the newly detected contexts that need to be inculcated for security. The model presented although explained in a smart home environment is a generalised model, which can be used, in any context aware environment or enterprise, from the office to factories. There is a fine line between context-aware security to contextaware safety (e.g., children cannot operate the stove unless in the company of an adult – as determined by location sensors), and one can transition from one to another with an analysis as exemplified in this paper.