Since ancient times, there has been a practice to authorize individuals that we trust. Today, we grant credentials and privileges digitally, making authorization a crucial part of security control and extending its use cases beyond people and web applications. Authorization plays an important role in emerging technologies such as the Internet of Things (IoT) and Cyber-Physical Systems (CPS), and there is a trend toward intelligent devices such as autonomous vehicles that are capable of executing tasks on our behalf. 

However, there are challenges in facilitating this evolution. Industrial use cases with many devices, contractors, subcontractors, and other parties need to maintain trust by sub-granting in one or many steps to define a trust chain. Ultimately Industrial CPS and semi-autonomous devices should be authorized to work as agents with defined credentials on behalf of their contractor. This would enable them to function self-sufficiently at a target site or network for a set amount of time.

The scope of this thesis is a new way of authorization known as the Digital Power of Attorneys. Traditionally, Power of Attorney is a legal document that is used for granting a person's authority to a trusted individual to act/work (e.g., running a business) on behalf of the first person. The objective of this thesis is to develop digital Power of Attorney based authorization for Cyber-Physical Systems and the Internet of Things. This technique enables devices (agents) such as autonomous or semi-autonomous devices to work/act on behalf of human beings (principals), even if he/she is not available online. 

The literature study includes both academic concepts and industrial authorization solutions, protocols, and standards such as  OAuth, UMA, GNAP, and ACE. PoA based authorization is inspired by the concept of proxy signatures by warrants and developed for industrial use, both as stand-alone libs and as extensions to existing standard protocols. The major standards that we propose to be extended with the PoA based authorization are IETF standards OAuth and ACE. In this way, the work in this thesis is highly correlated with the IETF. In addition to the academic papers on PoA based authorization and its applications, this thesis includes IETF Internet-Drafts as part of the standardization process of the PoA based authorization technique. 

The development of PoA based authorization technique begins with designing a Proof-of-Concept based on the gaps identified in existing authorization techniques. For implementation in current networks, different ways of providing PoA-based authorization are explored. First, by extending the OAuth protocol as a new OAuth grant type to add the principal entity to the OAuth protocol that can delegate the client. Second, by extension of the ACE framework, which adds a notion of PoA based delegation to ACE.  Third, by implementing an open-source library that can be downloaded and used independently by each entity to interpret the PoA. These approaches address the PoA interpretation challenges and enable every entity being part of the process to use and verify PoAs.

This thesis defines the architecture, protocol flow, and PoA structure of the proposed authorization technique and demonstrates its implementation in several use cases such as zero touch-device onboarding and delegation of smart devices in a mining station. Furthermore, possible security threats and vulnerabilities of the proposed system are thoroughly analyzed using different approaches such as threat modeling, risk assessment, and exploiting the system in the context of different attack scenarios.  

Many Cyber-Physical Systems are today semiautonomous and powerful enough to perform advanced tasks on their own. This means they can also act as representatives of people or devices that have given them an order. However, traditional access control policies and delegation models do not meet industrial requirements such as support for letting autonomous CPS devices act on their own with certified credentials under the sub authorization by subcontractors, without the need for a separate account per device. In this paper, we analyze and compare power of attorney, proxy signature by warrant, and OAuth to identify the strengths and challenges of each. Based on the comparison, we propose an OAuth grant type based on the power of attorney and inspired by the concept of proxy signature by warrant. Power of Attorney is a generic and self-contained document that a principal signs and directs to an agent, thereby providing it the power to execute actions on behalf of the principal for a predefined time, even if it is offline. One key advantage of the power of attorney is that it can support effective sub-granting on several levels to support industrial scenarios where resource owners bring in authorized contractors that can in their turn authorize and bring in several devices without incurring management overhead to the resource owner. A proof-of-concept and performance evaluation of the proposed model is presented using an industrial use-case scenario with multi-level authorization.

Large-scale onboarding of industrial cyber-physical systems requires efficiency and security. In situations with the dynamic addition of devices, e.g., from subcontractors entering the workplace, automation of the onboarding process is needed. The Eclipse Arrowhead framework, which provides a platform for industrial automation, requires reliable, flexible, and secure device onboarding to local clouds. In this paper, we propose a device onboarding method in the Arrowhead framework using the power of Attorney based authorization. It is an authorization technique that allows users to transfer or subgrant their power to trusted autonomous or semi-autonomous devices to act on their behalf. We present the concepts, implementation of the proposed system, and some performance evaluation results using real-world use cases.

In the age of digitization, many Cyber-Physical Systems are semi-autonomous and have sufficient power and resources to perform tasks on behalf of users. This thesis defines an authorization technique to transfer the power of legitimate users to trusted CPS or IoT devices, allowing the device to sign or access resources on behalf of the user. The authorization technique is based on digital Power of Attorney, which is a self-contained document generated by the user (principal) and sent to the agent (trusted device). A Power of Attorney contains a timestamp, that makes it invalid after a period of time predefined by the principal. Here, the agent who receives the PoA does not require a separate account; instead, it uses the principal account with limited features. The thesis studies and analyzes other delegation based and subgranting based authorization techniques, such as the OAuth standard. There are certain similarities and differences between OAuth and PoA, that are analyzed based on metrics such as protocol flow, communication type, token format, and control expiration. Considering the benefits and challenges of both the OAuth and PoA, this thesis combines these two techniques and proposes a multilevel subgranting system. The conceptual architecture, protocol flow, design overview, PoA format, use case scenarios, and implementation details of the proposed system are presented. The system is implemented based on an industrial CPS usecase scenario. The results are qualitatively analysed and also quantitatively evaluated based on the metric of computational time.Future work includes security analysis, result evaluation, and comparison of findings with respect to OAuth and other delegation based authorization standards, implementation of PoA based authorization technique from the scratch, and integration with frameworks such as Arrowhead.

Authentication, authorization and digital identity management are core features required by secure digital systems. Therein, authorization is the key component for regulating the detailed access credentials to required service resources. Authorization, therefore, plays a significant role in the trust management of autonomous devices and services. Due to the heterogeneous nature of Cyber-Physical Systems and the Internet of Things, several authorization techniques using different access control models, accounts, groups, tokens, and delegations have both strengths and weaknesses. There exists many literature studies on other main security requirements such as authentication, identity management and confidentiality. However, there is a need for a comprehensive review on different authorization techniques in Cyber Physical systems and Internet of Things. A specific target of this paper is authorization in the Cyber Physical system and Internet of Things networks with non-constrained devices in industrial context with mobility, subcontractors, and autonomous machines that are able to carry out advanced tasks on behalf of others. We study the different authorization techniques using our three-dimensional classification including access control models, sub-granting models and authorization governance.We focus on the state of the art on authorization sub-granting, including delegation techniques by access control/authorization server and self-contained authorization using a new concept of Power of Attorney. Comparison is performed on several parameters such as type of communication, method of authorization, control of expiration, and use of techniques such as public-key certificate, encryption techniques, and tokens. The results show the differences and similarities of server-based and Power of Attorney based authorization sub-granting. The most common standards are also analyzed in light of those classifications.

Distributed Internet of Things and cyber-physical systems can potentially be used as agents to automatically sign events and transactions on behalf of users. To accomplish this, there is a need for a model that can represent the relationships, credentials and organizational hierarchies of people and devices, facilitating agents acting as signatories in a controlled way. This paper proposes such a model, where people in different positions are entitled to sign on behalf of organizations or departments therein and extend that to representing machines. Central in this model is the Power of Attorney (PoA), which is a self-contained and signed digital document that for a limited time and in a defined context, authorizes a particular agent (whether a person or device) to sign on behalf of a principal. Although such self-contained PoAs can be stored anywhere, we propose a conceptual architecture based on PoAs and include a signatory registry that keeps track of organizational hierarchies in terms of people and devices according to the defined model and stored PoAs in that context.