In the world of IoT analytics platforms, data security is of utmost importance. With the growing number of connected devices and the increasing volume of data being generated, organizations must have the tools to manage and secure this information. One of the key elements of data security is access control, and role-based access control (RBAC) is a popular and effective method for controlling access to sensitive information.

The AirQo platform utilizes a Microservice architecture which separates concerns by reducing the coupling between application modules, which is conducive to the development, deployment, and maintenance of complex application systems. However, compared with the monolithic architecture, the access control of its resources becomes more complex. This blog post shares an access control solution, which can meet the requirements of a centralized access control system, improving the efficiency of authorization and authentication while accelerating the speed of system development under the microservice architecture coupled with a multitenant system design.

Background

What is Role-based Access Control (RBAC)?

Role-based access control is a method of regulating access to information based on the user's role within an organization. In RBAC, different users are assigned different roles, and each role is associated with a set of permissions that define what the user can and cannot do with the data. For example, an administrator role might have full access to all data, while a data analyst role might only be able to view and analyze the data.

Why is RBAC important in an analytics Platform?

Analytics platforms are complex systems that process and analyze massive amounts of data in real-time. The microservices architecture of these platforms can make it difficult to manage user access and ensure data privacy and security. That's why RBAC is an essential tool for controlling access to sensitive information within analytics platforms. With RBAC, organizations can control who has access to the data, what they can do with it, and when they can do it, which helps to reduce the risk of unauthorized access, data breaches, and data misuse.

What is Microservices Architecture?

Microservices architecture can be described as a way of breaking down a complex system into smaller, independent, and scalable components that work together to form a larger system. To illustrate this concept, let's use a football game as an example.

Imagine a football game as a microservices architecture. Instead of having one giant system that manages every aspect of the game, such as the players, the ball, the stadium, the fans, etc., you have smaller, independent services that manage each of these aspects. For example, you could have a player management service, a ball management service, a stadium management service, and a fan management service.

Each of these services operates independently and communicates with the others through well-defined APIs. This allows each service to be developed, tested, and deployed independently, making the system as a whole much more flexible and scalable.

If a particular service needs to be updated, such as the ball management service, it can be done without affecting the rest of the system. This allows for a faster and more efficient development process.

Similarly, in a microservices architecture for an IoT system, each microservice can handle a specific functionality and communicate with other microservices through APIs, allowing for greater scalability, flexibility, and efficiency.

What is Monolithic Architecture?

A monolithic architecture is a traditional software architecture approach where all components of a system are tightly coupled and built as a single, unified whole. To illustrate this concept, let's use a football game as an example.

Imagine a football game as a monolithic architecture. Instead of having smaller, independent components, you have one large system that manages every aspect of the game, such as the players, the ball, the stadium, the fans, etc. All these components are tightly intertwined, making it difficult to make changes to one component without affecting the others.

For example, if you wanted to make a change to the ball management component, you would have to make changes to the entire system, test the entire system, and deploy the entire system. This can be time-consuming and can cause disruptions to the rest of the system.

Similarly, in a monolithic architecture for an IoT system, all components are tightly coupled, making it difficult to make changes to one component without affecting the rest of the system. This can lead to slow development times and decreased flexibility.

So what problem is there to be solved?

Implementing access control for different organizations can be very challenging and difficult since each of these organizations could have very specific requirements that need to be met. This makes this customization a real challenge. At the same time, it becomes a challenge if the organization that is developing the platform wants to maintain its brand identity.

It can also be challenging when it comes to the management of different types of users, such as administrators, data scientists, and data analysts, with different levels of access and privileges across multiple organizations, can be complex.

For a system targeting different organizations, it becomes challenging when these organizations have different security requirements. Many do not want to go through complex security procedures and yet it is important to ensure that access control is secure and sensitive data is protected against unauthorized access.

Integration of access control for different microservices can be very challenging and time-consuming at the same time. Especially when it comes to different technology stacks and when it targets multiple organizations.

One of the most challenging aspects is ensuring that the user experience is not affected by this access control implementation. Ensuring that the entire process is user-friendly and intuitive is not so straightforward if the system is to remain secure and effective at the same time. This even becomes more challenging due to the different levels of technical expertise in different organizations. Overall, usability is something to seriously consider as one goes about this.

Keeping track of user activity, especially, those who have accessed the data can be very challenging. Knowing when and for what purpose a user accessed data is important for auditing and compliance purposes, especially across different organizations with different regulations and compliance requirements.

There is also a risk of the challenge of an access control system negatively impacting the performance of the entire system, especially at times when the system is dealing with high volume and real-time data. This even becomes more challenging when dealing with multiple organizations and their specific requirements.

There is also a maintenance challenge of such a system. Keeping it up-to-date and also compatible with other systems and applications can be an ongoing challenge, especially across multiple organizations with different technical requirements.

Methodology

Implementing RBAC in an analytics platform can be challenging, especially in a microservices architecture where data is distributed across multiple services and components. However, there are a few key steps that organizations can follow to implement RBAC effectively:

1. Define roles: The first step in implementing RBAC is to define the different roles within the organization and the permissions associated with each role. For example, roles might include administrator, data analyst, data scientist, and so on.

2. Assign roles to users: Once the roles have been defined, the next step is to assign the roles to users. This can be done manually or through an automated process, such as integration with an external identity provider.

3. Integrate RBAC into the platform: To make RBAC effective, it must be integrated into the analytics platform itself. This can be done by using an RBAC library or developing custom code that implements RBAC within the microservices architecture.

4. Monitor and manage access: Finally, it's important to monitor and manage access to the data within the analytics platform. This can be done through logging and auditing, and organizations should have procedures in place for revoking access if necessary.

Results

As we continue to implement the access control, we already have a few results we can share when it comes to the different aspects of the system, such as security, performance, and usability.

The implementation significantly improves the security of the system by ensuring that sensitive data is only accessed by authorized users with the correct privileges. The use of tokens and encryption of user data helps to further enhance the security of the system.

The performance of the system has not yet been negatively affected because of the application of a microservices architecture, caching, and load balancing techniques.

The implementation has not yet improved the usability of the system since its documentation has not yet been made. Also, we have just implemented the backend of the system so the actual users have not yet tested it out. But for the moment, all is still good since the backend solution was deployed.

The usage of the system across the entire platform is still a work in progress since some configurations have to be made at the API gateway level. The beauty of the microservices architecture is that this is implemented once and utilized across other microservices.

Overall, this implementation has a positive impact on the security, performance, and integration of the system with others. At the same time, the usage of best practices will help to ensure that the system implementation is secure, flexible, and user-friendly when managing access and privileges for a multi-tenant system.

Analysis

The goal of the entire access control system is to improve the security of the system by ensuring that sensitive data is only accessible to authorized users with correct privileges.

The results show that the implementation is successful but it has not yet been widely adopted across the entire system. There are a couple of challenges that were encountered with the integration of this access control system with all microservices and client applications. These problems require additional time and resources to resolve.

At the same time, we aimed to ensure that the performance of the entire system is not affected by the access control system. Preliminary results show that the implementation was successful in achieving this goal, with caching and load-balancing techniques being used to minimize the impact of access control on the overall performance of the system. However, there might be some limitations encountered with the use of access control in high-traffic environments, which required additional tuning and optimization to resolve.

In order to improve the usability of the system for users with different levels of technical expertise, the system is about 80% there due to the introduction of access tokens which do not require a user to utilize Authorization Headers which are synonymous with JWT tokens. Many of our users just want to access this data from the browser where one cannot easily embed an Authorization Header. We are yet to make intuitive documentation for the usage of access tokens so we still have some more work to do to achieve this. Also, we still need to do some training for members who are not familiar with some technical aspects of access tokens and control.

We also had a goal of ensuring that it would be easy to integrate our system with other systems and applications. The results show that the implementation was partially successful in achieving this goal, with APIs and a flexible microservices architecture being used to simplify the process of integrating access control into the overall system. However, there were some challenges encountered with the integration of access control through the API gateway, which requires additional time and resources to accomplish.

One of the goals of implementing the system was to ensure that it meets a set of security requirements. The results show that the implementation was partially successful in achieving this goal. The pending work is still around auditing and reporting features to ensure that all access to sensitive data was properly documented and accounted for. However, there were some limitations encountered with the use of access control in highly regulated environments, which required additional analysis and testing to resolve.

Overall, the implementation of role-based access control in a multitenant AirQo Platform using a microservices architecture was successful in achieving its goals and objectives but also encountered some challenges and limitations. The use of modern technologies and best practices helped to ensure the success of the implementation but also required additional time and resources to resolve certain issues. Despite these challenges, the implementation of role-based access control provided a secure, flexible, and user-friendly solution for managing access and privileges in a multitenant IoT environment.

Conclusion

Role-based access control is a critical component of data security in analytics platforms. By controlling access to sensitive information based on user roles, organizations can reduce the risk of unauthorized access, data breaches, and data misuse. To implement RBAC effectively, organizations should define roles, assign roles to users, integrate RBAC into the platform, and monitor and manage access to the data. With these steps in place, organizations can ensure the security and privacy of their IoT data and stay ahead of the curve in an ever-evolving world of technology.