Privacy-Preserving Interdomain Authorization and Authentication for Internet of Things

Collaboration among various Internet of Things (IoT) application service providers has the potential to improve service quality and productivity. However, challenges arise from the complexity of interoperability, particularly in Authorization and Authentication (A&A) for devices across different domains. This paper presents a scheme designed to facilitate interdomain A&A. The proposed approach uses the BBS group signature scheme to ensure anonymous authentication between domains and introduces a privacy-preserving authorization scheme that enables domain managers to grant permissions to authenticated domains for accessing their devices. The proposed A&A does not require an online trusted third party and supports a two-level revocation mechanism: a domain can be revoked from the entire system and no longer authenticated, or an authorizing domain can revoke its permission for another domain, preventing further communication between them. Additionally, a tracing mechanism is developed, leveraging a threshold-based cryptosystem, to reveal the identity of anonymized malicious devices while preventing unauthorized tracing by a single authority. The proposed protocol ensures strong exculpability, guaranteeing that no entity, including trusted entities, can impersonate a domain server. We formally analyze the security of the proposed authorization scheme and report on the protocol’s computational and communication overheads. Finally, the proposed A&A is compared to related protocols in terms of efficiency and security guarantees.