A Secured System for Internet-Enabled Host Devices
Posted · Updated
Co-authored a peer-reviewed research paper published in the Network and Communication Technologies journal (Canadian Center of Science and Education, 2020), proposing a Capability-based Context Aware Access Control (CCAAC) security model for internet-enabled host devices, validated through a custom web application implementing Elliptic-Curve Diffie-Hellman mutual authentication.
Project details
Proposed and developed a security model adapting Capability-based Context Aware Access Control (CCAAC) for heterogeneous internet-enabled device environments, addressing authentication challenges in wireless communication topologies such as Wi-Fi and Long-Term Evolution (LTE) where unauthorized access, spoofing, and privilege escalation pose significant threats to device integrity and data confidentiality.
Implemented the security model through TetherRemote, a custom-built web application enabling server-controller-client device pairing and remote management, using Apache and MySQL on a simulated server environment (XAMPP). As shown in Fig. 1, the TetherRemote dashboard provided administrators with a centralized overview of all registered devices — categorizing connected computers and smartphones, displaying their online/offline status, and serving as the primary interface for initiating device pairing, authorization, and management operations.
Applied the Elliptic-Curve Diffie-Hellman (ECDH) algorithm for mutual device authentication, implementing secure key exchange where random prime number generation, public key encryption, and shared secret computation ensured that paired devices could cryptographically verify each other's identity before establishing trusted connections. Central to this process was the Capability structure illustrated in Fig. 2, where each device's Access Right was combined with its Device Identifier to form a capability token processed through the Identity and Capability-based Access Control Protocol (ICAP) — determining whether a subject device was authorized to access an object device based on context-aware policies.
Designed a three-tier system architecture (Server, Controller, Client) where the server managed engine connectivity, device authorization, and pairing operations; smartphone controllers handled remote device management with assigned capability tokens and access rights (Read, Write, or NULL); and client machines processed authenticated instruction signals. Fig. 3 demonstrates the controller management interface, where administrators could view registered smartphone controllers, see their last-seen timestamps, and perform granular actions including assigning machines to controllers, viewing paired machines, configuring permissions, or revoking access — all governed by the capability-based access control policies enforcing least-privilege principles.
Validated the CCAAC model against existing authentication solutions, demonstrating effectiveness against Denial of Service, Man-in-the-Middle, and Replay attacks. The Identity and Capability-based Access Control (IACAC) protocol achieved mutual authentication in 14.02ms — substantially outperforming competing schemes including IoT Auth (1,604ms) and HBQ (2,413ms) — while also addressing post-authentication access control that other schemes neglected.
Documented the complete research methodology, system framework, and experimental validation results for academic peer review, culminating in publication in the Network and Communication Technologies journal (Vol. 5, No. 1, 2020, ISSN 1927-064X), contributing to the body of knowledge on IoT security and access control models for connected device environments.
Work Context: This research and implementation work was completed during my FUTA tenure, where secure device access and policy enforcement were active operational concerns.
Current Implementation: I continue applying the same access-control and secure-authentication principles in personal systems and automation projects.