A Comprehensive Study of Security and Privacy Guidelines, Threats, and Countermeasures: An IoT Perspective

Abstract

As Internet of Things (IoT) involvement increases in our daily lives, several security and privacy concerns like linkability, unauthorized conversations, and side-channel attacks are raised. If they are left untouched, such issues may threaten the existence of IoT. They derive from two main reasons. One is that IoT objects are equipped with limited capabilities in terms of computation power, memory, and bandwidth which hamper the direct implementation of traditional Internet security techniques. The other reason is the absence of widely-accepted IoT security and privacy guidelines and their appropriate implementation techniques. Such guidelines and techniques would greatly assist IoT stakeholders like developers and manufacturers, paving the road for building secure IoT systems from the start and, thus, reinforcing IoT security and privacy by design. In order to contribute to such objective, we first briefly discuss the primary IoT security goals and recognize IoT stakeholders. Second, we propose a comprehensive list of IoT security and privacy guidelines for the edge nodes and communication levels of IoT reference architecture. Furthermore, we point out the IoT stakeholders such as customers and manufacturers who will benefit most from these guidelines. Moreover, we identify a set of implementation techniques by which such guidelines can be accomplished, and possible attacks against previously-mentioned levels can be alleviated. Third, we discuss the challenges of IoT security and privacy guidelines, and we briefly discuss digital rights management in IoT. Finally, through this survey, we suggest several open issues that require further investigation in the future. To the best of the authors’ knowledge, this work is the first survey that covers the above-mentioned objectives.

A Novel Methodology for Securing IoT Objects Based on their Security Level Certificates

“…Such attacks and threats may jeopardize the existence of IoT, if they are left untouched. That said, securing IoT seems to be very complex and confusing compared to traditional Internet because of two primary factors [3,4]. One is IoT objects vary from tiny and lightweight objects (e.g., light bulbs) to powerful objects (e.g., smart phones), the majority of which is being connected to the Internet or each other to achieve specific tasks.…”

“…It is, therefore, possible to apply traditional security mechanisms (e.g., Advanced Encryption Standard (AES)) directly to powerful objects like smart phones. In contrast, tiny objects, for instance light bulbs, may not be able to apply such techniques directly without some modifications due to their limited resources in terms of battery life, memory storage, and computational power [3,5]. To this end, several research proposals have been proposed in this regard, and they can be classified broadly into three categories: (i) gateway-based solutions [6][7][8], (ii) IoT stack-based solutions [9][10][11][12][13], and (iii) middleware-based solutions [14][15][16][17][18].…”

“…The other factor is the lack of frameworks that provide widely agreed upon security and privacy guidelines for IoT assets ( physical objects, protocols, data at rest, and software proposed in our earlier work [21]), along with their protection measures [3]. Such guidelines and their suitable implementation techniques would pave the road for IoT stakeholders like developers and manufacturers to build secure IoT systems by integrating such guidelines into their systems from the start [4].…”

“…Such guidelines and their suitable implementation techniques would pave the road for IoT stakeholders like developers and manufacturers to build secure IoT systems by integrating such guidelines into their systems from the start [4]. In spite of the importance of such frameworks of security and privacy guidelines for IoT to enhance its security and privacy by design according to [4], a few research studies have been proposed in this regard [3,4,[22][23][24].…”

Mitigation of DIS flooding attacks in RPL‐based 6LoWPAN networks

“…Such security breach can cause severe health issues to workers if the attacker forces compromised devices to report inaccurate sensor data. Securing such applications is one of the critical challenges nowadays . Keeping this in our mind, Secure‐RPL scheme is proposed in this research paper.…”