IEEE Systems, Man and Cybernetics Magazine - October 2023 - 14

attributes linked to identity, and access management
involves evaluating these attributes and making decisions
based on policies to manage access to other
objects or services. Authentication, authorization, and
access control collectively represent
identity access management.
Through a compar ison of
diverse ways in practice, we want
to first investigate the notion of
the Identity of Things and analyze
why it is so different from the
concept of the Identity of Users/
Identity of Devices in traditional
networks and systems. We have
revisited the identity formats,
identity models, and IDM architectures
used in traditional and
current IoT applications. Through
a comparison, we concluded to
have identity-based authentication,
authorization, and access
control by keeping a balance between memory and computational
overhead.
Introduction
IDM, often called identity and access management (IAM),
is a group of policies and technologies that guarantees that
only authorized users have access to authorized resources.
From an industry/enterprise perspective, resources are the
networks, things, services, products, and applications hosted
by the organization, including even entry at different
infrastructural buildings.
An IDM system should manage, secure, and preserve
the identities of resources and their clients (where applicable),
and methods for identity verification, resource
access control, and usage data privacy protection
should all be in place [1]. In a nutshell, rules specify
which devices and users are permitted on the network
as well as what a user is permitted to do, based on
device type, location, and other factors [2]. Authentication,
authorization, and auditing are the terms used to
describe these procedures [27]. The auditing operation
monitors the authentication and authorization processes
by keeping track of them in a log. The audit is beneficial
in discouraging attempts at violations, analyzing
user behavior, and tracking potential access control
model defects [3].
In this article, the " Related Work " section provides a
summary of the thorough literature review on identity
components and formation and IDM systems models.
The " Research Gaps in the Existing Identification Formats
and IDM System Models " section highlights
research gaps. The " Challenges in Identification Method
in IoT " section deliberates on the challenges. The " Motivation
Toward a Secured IoT for Maintaining Privacy
and Security " section illustrates the motivation for
14 IEEE SYSTEMS, MAN, & CYBERNETICS MAGAZINE October 2023
secured IoT to maintain privacy and security. The " Current
Work and Its Limitations " section discusses current
research and limitations. The " Discussions on Tradeoffs
in Current IDM Architectures " section explores tradeoffs
in current IDM architectures.
This article concludes in the
" Conclusion " section.
We have revisited
the identity formats,
identity models, and
IDM architectures
used in traditional
and current IoT
applications.
Related Work
Introduction of Identity
Components of an Identity
A digital depiction of a person is
formed from a sequence of claims
called an identity [3]. Each identity
is tied to a certain subject but not
the other way around. Furthermore,
identities might be permanent
or temporary depending on
the application's settings. Identifiers,
characteristics, and credentials are the three components
of an identity, according to the International
Telecommunication Union-Telecommunication standardization
sector (ITU-T) regulation (Y.2720).
◆ Identifiers: Identifiers are " a set of integers, letters,
symbols, or other particulars which is used to recognize
an individual " [4].
◆ Credentials: Credentials are " a bundle of facts that
supports assertions about various aspects of our
identities " [4].
◆ Attributes: Attributes are " a collection of facts that characterize
the characteristics of a topic. " Identity is
defined as " the depiction of a reality (or set of realities)
expressed as information components that enable the
reality (or realities) to be specifically recognized within
an operational environment " as per the ITU-X.1250 recommendation
[4].
Identity Formation
The procedure of validating a user's identity using some
identification components is known as identity formation.
Something the user knows (a knowledge factor), something
the user has (a possession factor), and something the
user is (an inherence factor) are the most common factors.
In addition, the context-aware factor is a fourth distinguishing
element [5].
User Identification Factors
1) Knowledge factor: Usernames, passwords, Personal
Identification Numbers, and answers to secret questions
are examples of information that a user recalls and uses
to log in.
2) Possession factor: The user carries something to sign in,
for example, a security token, a one-time password
token, a staff identification card, or a mobile number.
IEEE Systems, Man and Cybernetics Magazine - October 2023

Table of Contents for the Digital Edition of IEEE Systems, Man and Cybernetics Magazine - October 2023
