Security Requirements in IoT Architecture

4/3/2020Privacy and Security in IoT; VI Sem; CSE; Dr. Vrince Vimal 1
Security Requirements in IoT
Dr. Vrince Vimal
Computer Science and Engineering

Unit I 9 Hours
SecurityRequirements in IoT Architecture - Security in Enabling Technologies - Security Concerns in IoT Applications. Security
Architecture in the Internet of Things - Security Requirements in IoT - Insufficient Authentication/Authorization - Insecure Access
Control - Threats to Access Control, Privacy, and Availability - Attacks Specific to IoT. Vulnerabilities – Secrecy and Secret-Key Capacity -
Authentication/Authorization for Smart Devices - Transport Encryption – Attack & Fault trees.
Unit II 9 Hours
Cryptographic primitives and its role in IoT – Encryption and Decryption – Hashes – Digital Signatures – Random number generation –
Cipher suites– key management fundamentals – cryptographic controls built into IoT messaging and communication protocols – IoT Node
Authentication
Unit III 8 Hours
Identity lifecycle – authentication credentials – IoT IAM infrastructure – Authorization with Publish / Subscribe schemes – access control
Unit IV 6 Hours
Concerns in data dissemination – Lightweight and robust schemes for Privacy protection – Trust and Trust models for IoT – self-organizing
Things - Preventing unauthorized access
Unit V 8 Hours
Cloud services and IoT – offerings related to IoT from cloud service providers – Cloud IoT security controls – enterprise IoT cloud security
architecture – New directions in cloud enabled IoT computing.

• The emerging Internet of Things (IoT) is believed to be the next
generation of the Internet.
• Easy target for Hackers as billion of devices Communicating
without human intervention.
• Intelligent sensors, wireless communication, networks, data
analysis technologies, cloud computing have been developed
• The development is in initial stages.
Introduction

• Security is significant obstacles in IoT
• It which involves the sensing of :
 Infrastructure security,
 Communication network security
 Application security
 General system security.

• Security means cryptography, secure communication, and
privacy assurances.
• But for IoT Security has diverse meaning i.e.
• Data confidentiality,
• Services availability,
• Integrity,
• Antimalware,
• Information integrity,
• Privacy protection,
• Access control,

• At the lower layer of IoT (sensing layer)
 Limited computation capacity
 Limited energy supply
• At the Middle layer of IoT (network layer)
 Eavesdropping or Interception,
 Denial of service (DoS) attack.
• At the upper layer of IoT (application layer)
 Data aggregation and encryption compensates for
issues of all layers.

Security Requirements
• In IoT, each connected device could be a potential doorway
into the IoT infrastructure or personal data.
• Security Concern would elevate once IoT reaches next level
of interoperability and autonomous decision making and
higher order security loopholes.

Security Concerns in IoT

SECURITY REQUIREMENTS IN IoT
ARCHITECTURE
• A critical requirement of IoT is that the devices must be
interconnected.
• N/W has to acquire, process and communicate data from
real to virtual world.
• provide applications with strong security protection

• N/W must provide operational guarantees for the
IoT, which bridges the gap between the physical
devices and the virtual worlds.
• Framework should consider:
 Technical factors,
 Sensing techniques,
 Communication methods
 Network technologies
 Security protection,
 Information confidentiality,
 Transmission security,
 Privacy protection,

 Business issues,
 Business models,
 Business processes
• SoA has been successfully applied to IoT design
• The services-based application will heavily depend
on the architecture of IoT.

SoA for IoT

Sensing Layer and IoT End-Nodes
For designing sensing layer of an IoT, the
main concerns are:
• Cost, size, resource, and energy
consumption
• Deployment.
• Heterogeneity.
• Communication.
• Networks.

The endless variety of IoT applications poses
an equally wide variety of security challenges.
Devices authentication
Trusted devices
Leveraging the security controls and
availability of infrastructures in sensing layer.
In terms of software update

In this layer, the security concerns can be classified into two
main categories:
• The security requirements at IoT end-node: physically
;access control; authentication; nonrepudiation;
confidentiality; integrity; availability; and privacy.
• The security requirements in sensing layer: confidentiality;
data source authentication; device authentication; integrity;
availability, and timeless.

Security Threats Description
Unauthorized access Due to physically capture or logic
attacked, the sensitive information at the end-nodes is captured
by the attacker.
Availability The end-node stops to work since physically
captured or attacked logically
Spoofing attack With malware node, the attacker
successfully masquerades as IoT end-device, end-node, or
end-gateway by falsifying data
Selfish threat Some IoT end-nodes stop working to save
resources or andwidth to cause the failure of network
Malicious code Virus, Trojan, and junk message that can
cause software failure
DoS An attempt to make a IoT end-node resource unavailable
to its users
Transmission threats Threats in transmission, such as
interrupting, blocking, data manipulation, forgery, etc.

following actions should be taken:
(1) Implement security standards for IoT and ensure all
devices are produced by meeting specific security standards.
(2) Build trustworthy data sensing system and review the
security of all devices/ components.
(3) Forensically identify and trace the source of users.
(4) Software or firmware at IoT end-node should be securely
designed.

In the networking layer, the following issues
should be addressed:
• Network management technologies
including the management for
fixed, wireless, mobile networks,
• Network energy efficiency,
• Requirements of QoS,
• Technologies for mining and searching,
• Information confidentiality,
• Security and privacy.
Network Layer

The security requirements in network layer involve:
• Overall security requirements,
• Privacy leakage:
• Communication security:
• Overconnected:
• MITM attack:
• Fake network message:

The activities in service layer, conducted by following
components:
• Service discovery.
• Service composition.
• Trustworthiness management.
• Service APIs.
Service Layer

The security requirements in the service layer include:
Authorization, service authentication, group authentication,
privacy protection, integrity, security of keys, nonrepudiation,
antireplay, availability, etc.
• Privacy leakage. The main concern in this layer involves
privacy leakage and malicious location tracking.
• Service abuses. In IoT the service abuse attack involves:
i) illegal abuse of services;
ii) abuse of unsubscribed services.
• Node identify masquerade.

• DoS attack.
• Replay attack, the attacker resends the data.
• Service information sniffer and manipulation.
• Repudiation in service layer, it includes the communication
repudiation and services repudiation.

For the application maintenance, following security
requirements will be involved:
• Remote safe configuration.
• Software downloading and updating.
• Security patches.
• Administrator authentication.
• Unified security platform, etc.
Application Layer

In IoT in designing the security solutions, following rules
should be helpful:
a. Since most constrained IoT end-nodes work in an
unattended manner, the designer should pay more attention
to the safety of these nodes;
b. As IoT involves billions of clustering nodes, the security
solutions should be designed based on energy efficiency
schemes;
c. The light security scheme at IoT end-nodes might be
different with existing network security solutions; however, we
should design security solutions in a big enough range for all
parts in IoT.

 Security in Identification and Tracking Technologies
• Due to its capability for identifying, tracing, and tracking,
the RFID system has been wide applications
SECURITY IN ENABLING
TECHNOLOGIES

In general the security features of RFID include:
• Tags/Readers collision problem Data confidentiality
• Tag-to-reader authentication
• High-assurance readers

Security in Integration of WSN and RFID
• IoT with the integration of RIFD and WSNs makes it
possible to develop IoT applications for healthcare,
decision-making of complex systems.
• The security issue in integration of RFID and WSNs
involves following challenges:
• Privacy,
• Identification and authentication,
• Communication security,

• Trust and ownership,
•
• Integration;
• User authentication.

SECURITY CONCERNS IN IoT
APPLICATIONS• The IoT enables information gathering, transmitting, and
storing to be available for devices in many scenarios, which
creates or accelerates many applications such as :
• Industrial control systems,
• Retailing industry,
• Smart shelf operations,
• Healthcare,
• Food and restaurant industry,
• Logistic industry, travel
• Tourism industry, etc.

To integrate the devices of sensing layer as intrinsic parts of the IoT,
effective security technology is essential to ensure security and privacy
protection in
various activities such as :
• Personal activities,
• Business processes,
• Transportations,
• Information protection.

Security Concerns in SCADA Systems
• SCADA systems are generally designed as more technical-
oriented solutions often in the industrial environment.
• Following security concerns are to be concerned while
integrating SCADA with IoT:
 Authentication and access control
 Identification of SCADA vulnerabilities
 Physical security
 System recovery and backups

Security Concerns in EIS
• Enterprise information systems have played the pivotal
role in modern organizations existing as Enterprise
Resource Planning (ERP) systems which integrated
• Intraorganizational business processes and
Supply chain management systems to link
Interorganizational business processes, and Customer
Relationship Management (CRM) systems that maintain
relationships with customers

Security Architecture in the Internet of Things

• The Internet of Things (IoT) is an extension of the
Internet
• The IoT is able to connect the digital cyberspace and real
physical space.
• IoT is able to introduce all the vulnerabilities of the digital
world into our real world.
• The success of IoT applications and IoT infrastructure
significantly depends on the guarantee of the security and
vulnerability in the IoT.
• It is important to set up and take cyber defense seriously.

SECURITY REQUIREMENTS IN IoT
• The IoT introduces large quantities of new devices that will
be deployed or embedded throughout an organization or
even within a system.
• Each connected device could be a potential doorway into
the IoT infrastructure or personal data.
• Data captured from these devices can be analyzed and
acted upon.

• Security Threats in IoT will reach new levels as
interoperability, mashups, and autonomous decision-
making begin to embed complexity, security loopholes.
• The sanctity of security and privacy concerns of the IoT
are not clearly defined yet.
• loopholes might cause potential “black swan” events.

• In a general framework main security requirements
are addressed from six aspects:.
IoT Data Security Challenges

• Privacy risks will arise as objects within the IoT collect and
aggregate fragments of data that relate to their service
Data Confidentiality
• Insufficient authentication/authentication
• Insecure interfaces (web, mobile, cloud, etc.)
• Lack of transport encryption
• Confidentiality preserving & Access control
Privacy
• Privacy, data protection, & information security risk
management
• Privacy by design and default
• Data protection legislation
• Traceability/profiling/unlawful processing

Trust
• Identity management system
• Insecure software/firmware
• Ensuring continuity and availability of services
• Realization of malicious attacks against IoT devices and
system
• Loss of user control/difficult in making decision
• If we model IoT as 4 Layer architecture each layer should be
able to provide access control, device authentication, data
integrity, and confidentiality in transmission, availability, and
the ability to defend IoT devices against virus and attacks.

Authentication in IoT
• The soul of IoT framework is the authentication layer.
(verify identity)
• When M2M devices need access to the IoT infrastructure,
the trust relationship is initiated based on the identity of
the device.
• In human and machine interactions names, patterns
fingerprints, retina scan passwords can authenticate.
• In M2M endpoints must be fingerprinted by means that
do not require human interaction.

• SSL/TLS X.509 certificate is a digital file that's usable for
Secure Sockets Layer (SSL) or Transport Layer Security
(TLS). The certificate fulfills two functions. First, the
certificate can assist with authenticating and verifying the
identity of a host or site. Second, it enables the encryption
of information exchanged via a website.
• However, in the IoT domain, many devices may not have
enough memory to store a certificate.
• IEEE - 802.1X authentication involves three parties: a
supplicant, an authenticator, and an authentication server.
• TLS/DTLS , SSH, IPSec/IKE

Authorization
• The second layer of this framework is authorization that
controls a device’s access throughout the network fabric. This
layer builds upon the core authentication layer by leveraging
the identity information of an entity.

Insufficient Authentication/Authorization
• On the Internet, the users are always authenticated by
requiring a password and browsers authenticate web sites
through the SSL (secure sockets layer protocol).
• In the IoT, new devices that connected into an IoT system
should be able to authenticate itself prior to receiving or
transmitting data.
• Deeply embedded devices often do not have users sitting
behind keyboards.
• Secure storage area plays important role.

• Some new threats and attack vectors that malicious actors
could take advantage of are as follows:
In IoT-based industrial control system, such as SCADA etc.,:
• Control systems, vehicles, and even the human body
(WBAN) can be accessed and manipulated causing injury or
worse.
• Healthcare providers can improperly diagnose and treat
patients based on modified health information or
manipulated sensor data.
• Intruders can gain physical access to homes or commercial
businesses through attacks against electronic, remote
controlled door lock mechanisms.

Individual
• Unauthorized tracking of people’s locations can occur
through usage pattern tracking based on asset usage time
and duration.
• Unlawful surveillance through persistent remote monitoring
capabilities offered by small-scale IoT devices.
• Inappropriate profiles and categorizations of individuals
can be created through examination of network and
geographic tracking and IoT metadata.

Business Area
• Inappropriate profiles and categorizations of individuals
can be created through examination of network and
geographic tracking and IoT metadata.
• Manipulation of financial transactions through
unauthorized POS and POS access.
• Monetary loss arising from the inability to provide service.
• Vandalism, theft, or destruction of IoT assets that are
deployed in remote locations and lack physical security
controls.

Ability to Access the IoT
• Ability to gain unauthorized access to IoT edge devices to
manipulate data by taking advantage of the challenges related
to updating software and firmware of embedded devices.
• Ability to gain unauthorized access to the Enterprise network
by compromising IoT edge devices and taking advantage of
trust relationships.
• Ability to create botnets by compromising large quantities of
IoT edge devices.
• Ability to impersonate IoT devices by gaining access to
keying material held in devices that rely up on software-based
trust stores.

INSECURE ACCESS CONTROL
• Authorization frameworks for computer networks and
online services are role based. First, the identity of the user
is established and then his or her access privileges are
determined from the user’s role within an organization.
• E.g., RADIUS-Remote-Authentication Dial-In User Service.
• LDAP (Lightweight Directory Access Protocol)
• Role-Based Access Control Systems
• Access Control List-Based Systems
• Capability-Based Access

THREATS TO ACCESS CONTROL, PRIVACY,
AND AVAILABILITY
To secure devices access layer before users are at risk, following
actions should be taken:
(1)Implement security standards for IoT and ensure all devices
are produced by meeting specific security standards;
(2)Build trustworthy data sensing system and review the security
of all devices/components;
(3) Forensically identify and trace the source of users;
(4) Software or firmware at IoT end-node should be securely
designed.

Security Threats and Vulnerabilities at IoT End-Node

ATTACKS SPECIFIC TO IoT
IoT applications might be subjected to most types of network
attacks, including :
Actually, more specific attacks to IoT have been emerged in
recently. Attackers can intercept or change the behavior of
smart home devices in many ways.
• Either by physical access
• Remote location
• Eavesdropping,
• Data modification
• Identity spoofing,
• Password-based attacks,
• DOS attack,
• Man-in-the-middle,
• Compromised-key attack,
• Sniffer attack
• Application layer attack

SECRECY AND SECRET-KEY CAPACITY
• The standardization of IoT is still an open issue.
• Available cryptography is designed at the application layer
without regard to the imperfections of the lower layer.

IoT in Health care

One way Authentication

Mutual Authentication

Security Requirements in IoT Architecture

More Related Content

What's hot (20)

Similar to Security Requirements in IoT Architecture (20)

More from Vrince Vimal (11)

Recently uploaded (20)

Security Requirements in IoT Architecture