A Comprehensive and Systematic Survey on the Internet of Things: Security and Privacy Challenges, Security Frameworks, Enabling Technologies, Threats, Vulnerabilities and Countermeasures

Abstract

The Internet of Things (IoT) has experienced constant growth in the number of devices deployed and the range of applications in which such devices are used. They vary widely in size, computational power, capacity storage, and energy. The explosive growth and integration of IoT in different domains and areas of our daily lives has created an Internet of Vulnerabilities (IoV). In the rush to build and implement IoT devices, security and privacy have not been adequately addressed. IoT devices, many of which are highly constrained, are vulnerable to cyber attacks, which threaten the security and privacy of users and systems. This survey provides a comprehensive overview of IoT in regard to areas of application, security architecture frameworks, recent security and privacy issues in IoT, as well as a review of recent similar studies on IoT security and privacy. In addition, the paper presents a comprehensive taxonomy of attacks on IoT based on the three-layer architecture model; perception, network, and application layers, as well as a suggestion of the impact of these attacks on CIA objectives in representative devices, are presented. Moreover, the study proposes mitigations and countermeasures, taking a multi-faceted approach rather than a per layer approach. Open research areas are also covered to provide researchers with the most recent research urgent questions in regard to securing IoT ecosystem.

Current Research Trends in IoT Security: A Systematic Mapping Study

“…Mendez Mena et al [28] focused on IoT architectures but did not consider applications. Obaidat et al [32] aimed to comprehensively cover IoT security but omitted related applications. In contrast, Hassija et al [29] did not cover IoT as a whole, focusing only on applications.…”

IoT-based Application of Information Security Triad

“…Due to security reasons, a new layer was introduced to IoT architecture and this layer is the Middleware layer. Figure 5 shows the four-layer architecture with characteristics [17], [34,35].…”

“…Attackers can use sensors to inject malicious code and activate it to capture sensitive data exchanged between different IoT devices. If sensors are located in open locations so that attackers can do side-channel attacks which are based on electromagnetic field monetization, power consumption monetization or timing monetization to attack different encryption mechanisms or they can inject noise to the signals [22] [35]. An attacker can also data manipulate at sensors, can do boot attacks, can capture a Node [18].…”

“…However, the quick energy consumption due to the jamming of signals disables the communication between devices and nodes. Ultimately, the signal jamming resulting in the DoS of the nodes prevents communication for the IoT nodes or whole network [13,35,[40][41][42][43]. Information security and privacy in IoT fields demand IoT consideration and concerns.…”

A Hybrid Dynamic Encryption Scheme for Multi-Factor Verification: A Novel Paradigm for Remote Authentication

“…Insecure authentication, insufficient cryptography, and insecure authorization are among the most common issues found with many of these applications [ 2 ]. Moreover, with the explosive proliferation of the Internet of Things (IoT) devices in our daily lives, this has created an Internet of Vulnerabilities (IoV) [ 3 , 4 , 5 ]. Some studies have proposed outsourcing an authentication mechanism that requires IoT RFID-based devices to use a server on the edge of the network to complete the verification and the authentication process [ 5 ], which provides an increasingly secure communications by measuring four different security factors.…”