Cloud-based federated identity for the Internet of Things

Paul Fremantle, Benjamin Aziz

Research output: Contribution to journalArticlepeer-review

144 Downloads (Pure)


The Internet of Things (IoT) has significant security and privacy risks. Recent attacks have shown that not only are many IoT devices at risk of exploit, but those devices can be successfully used to attack wider systems and cause economic damage. Currently, most devices connect to a cloud service that is provided by the manufacturer of the device, offering no choice to move to more secure systems. We outline a proposed model for IoT that allows the identity of users and devices to be federated. Users and devices are issued with secure, random, anonymised identities that are not shared with third-parties. We demonstrate how devices can be connected to third-party applications without inherently de-anonymising them. Sensor data and actuator commands are federated through APIs to cloud services. All access to device data and commands is based on explicit consent from users. Each user’s data is handled by a personal cloud instance providing improved security and isolation, as well as providing a trusted intermediary for both devices and cloud services. We demonstrate this model is workable with a prototype system that implements the major features of the model. We present experiment results including performance, energy usage, capacity and cost metrics from the prototype. We compare this work with other related work, and outline areas for discussion and future work.
Original languageEnglish
Pages (from-to)415-427
Number of pages13
JournalAnnals of Telecommunications
Issue number7-8
Early online date29 May 2018
Publication statusPublished - 1 Aug 2018


  • IoT
  • identity management
  • Cloud computing
  • authentication
  • security
  • privacy


Dive into the research topics of 'Cloud-based federated identity for the Internet of Things'. Together they form a unique fingerprint.

Cite this