A Study on Security and Privacy Guidelines, Countermeasures, Threats: IoT Data at Rest Perspective

Abstract

The Internet of Things (IoT) makes our lives much easier, more valuable, and less stressful due to the development of many applications around us including smart cities, smart cars, and smart grids, offering endless services and solutions. Protecting IoT data of such applications at rest either on the objects or in the cloud is an indispensable requirement for achieving a symmetry in the handling and protection of the IoT, as we do with data created by persons and applications. This is because unauthorised access to such data may lead to harmful consequences such as linkage attacks, loss of privacy, and data manipulation. Such undesired implications may jeopardise the existence of IoT applications if protection measures are not taken, and they stem from two main factors. One is that IoT objects have limited capabilities in terms of memory capacity, battery life, and computational power that hamper the direct implementation of conventional Internet security solutions without some modifications (e.g., traditional symmetric algorithms). Another factor is the absence of widely accepted IoT security and privacy guidelines for IoT data at rest and their appropriate countermeasures, which would help IoT stakeholders (e.g., developers, manufacturers) to develop secure IoT systems and therefore enhance IoT security and privacy by design. Toward this end, we first briefly describe the main IoT security goals and identify IoT stakeholders. Moreover, we briefly discuss the most well-known data protection frameworks (e.g., General Data Protection Regulation (GDPR), Health Insurance Portability (HIPAA)). Second, we highlight potential attacks and threats against data at rest and show their violated security goals (e.g., confidentiality and integrity). Third, we review a list of protection measures by which our proposed guidelines can be accomplished. Fourth, we propose a framework of security and privacy guidelines for IoT data at rest that can be utilised to enhance IoT security and privacy by design and establish a symmetry with the protection of user-created data. Our framework also presents the link between the suggested guidelines, mitigation techniques, and attacks. Moreover, we state those IoT stakeholders (e.g., manufacturers, developers) who will benefit most from these guidelines. Finally, we suggest several open issues requiring further investigation in the future, and we also discuss the limitations of our suggested framework.

A Novel Methodology for Securing IoT Objects Based on their Security Level Certificates

“…In [4], the authors propose a comprehensive list of security and privacy guidelines only for IoT data at rest, such as searching on encrypted data, ensuring authorized access, encrypting data storage, and minimizing duplicated copies. Moreover, the authors investigate all possible attacks and threats against data at rest and identify a set of protection measures which can be used to implement their guidelines.…”

“…The other factor is the lack of frameworks that provide widely agreed upon security and privacy guidelines for IoT assets ( physical objects, protocols, data at rest, and software proposed in our earlier work [21]), along with their protection measures [3]. Such guidelines and their suitable implementation techniques would pave the road for IoT stakeholders like developers and manufacturers to build secure IoT systems by integrating such guidelines into their systems from the start [4]. In spite of the importance of such frameworks of security and privacy guidelines for IoT to enhance its security and privacy by design according to [4], a few research studies have been proposed in this regard [3,4,[22][23][24].…”

“…Such attacks and threats may jeopardize the existence of IoT, if they are left untouched. That said, securing IoT seems to be very complex and confusing compared to traditional Internet because of two primary factors [3,4]. One is IoT objects vary from tiny and lightweight objects (e.g., light bulbs) to powerful objects (e.g., smart phones), the majority of which is being connected to the Internet or each other to achieve specific tasks.…”

“…Such guidelines and their suitable implementation techniques would pave the road for IoT stakeholders like developers and manufacturers to build secure IoT systems by integrating such guidelines into their systems from the start [4]. In spite of the importance of such frameworks of security and privacy guidelines for IoT to enhance its security and privacy by design according to [4], a few research studies have been proposed in this regard [3,4,[22][23][24].…”

Model of Threats to Computer Network Software

“…Along with this, technologies are constantly evolving. New types of threats appear [2], and the security of computer networks is evolving into the security of the Internet of Things [3][4][5][6].…”