Access Control Framework for Smart Systems in IoT Environment: A Review of Significance, Challenges & Future Directions

Abstract

As the number of Internet of Things (IoT) devices continues to grow, access control is becoming an increasingly key component in smart home, healthcare, industrial and urban environments. However, the nature of IoT environments, such as device heterogeneity, extreme resource constraints, vast deployment, and dynamic and often unpredictable connectivity patterns, makes it difficult for established networked systems to support application of traditional access control models. Based on this, this paper aims to present an overview of access control frameworks proposed for smart systems in IoT environments by summarizing the existing body of knowledge and categorizing it into six categories: role-based, capability-based, attribute-based, blockchain-based, risk- and trust-adaptive, and machine-learning-driven models. The results show that none of the models is developed in a way that is satisfying for all criteria, and that there are always compromises in the development of models that are still ongoing. The review also highlights open challenges such as lack of real-world validation, interoperability and standardization, the challenge of enforcing lightweight but privacy-preserving solutions on resource-constrained devices, and explainability and robustness concerns with the new learning-based authorization mechanisms. The paper concludes that future advances are likely to rely on hybrid architectures where more than one model is used and recommends future directions for empirical validation, benchmarking and standardization to further the field.