IoT-HarPSecA: A Framework and Roadmap for Secure Design and Development of Devices and Applications in the IoT Space

Abstract

The past couple of years have marked continued growth in the applications and services of the Internet of Things (IoT). This has attracted the attention of new operators as well as institutional, corporate, and private investors in every sector of the economy, and as a result, new businesses are springing up rapidly. These include many start-up companies that are producing various kinds of useful IoT devices and Smart Applications (smart apps). While this can be seen as a boost for innovation in the IoT, some of these companies produce IoT devices and smart apps with security vulnerabilities. In this paper, we propose the IoT Hardware Platform Security Advisor (IoT-HarPSecA), a security framework intended to provide support to such IoT producers. IoT-HarPSecA offers three functionality features, namely security requirement elicitation, security best practice guidelines for secure development, and above all, a feature that recommends specific LightWeight Cryptographic Algorithms (LWCAs) for both software and hardware implementations. Accordingly, IoT-HarPSecA is composed of three main components, namely Security Requirements Elicitation (SRE) component, Security Best Practice Guidelines (SBPG) component, and LightWeight Cryptographic Algorithms Recommendation (LWCAR) component, each of them servicing one of the aforementioned features. We implement a command-line tool in C++ to serve as an interface between users and the proposed framework. IoT-HarPSecA can be employed during the early stages of IoT systems design, and it can also be used to facilitate the implementation of security in existing IoT systems. This paper presents a detailed description, design, and implementation of the SRE, SBPG, and LWCAR components of the proposed framework. Using real-world practical scenarios, we show how IoT-HarPSecA can be used to elicit security requirements and recommend appropriate LWCAs based on user inputs. While a full performance evaluation of the SRE and SBPG components is beyond the scope of this paper, we present a detailed performance evaluation of the LWCAR component, which shows that IoT-HarPSecA can serve as a roadmap for secure IoT development.

Vulnerabilidades de Segurança da Informação na Indústria 4.0: Proposição de Critérios para o uso de Análise Multicritério

“…Confidencialidade (Agrawal et al, 2020;Ankele et al, 2019;Butun et al, n.d., 2020;Dimitriadis et al, 2020;Kim et al, 2020;Lara et al, 2020;Liang et al, 2019;Luo et al, 2015;Murch et al, 2018;Ratasich et al, 2019;Samaila et al, 2020;Sun & Liu, 2012;Willing et al, 2020) Integridade (Agrawal et al, 2019;Ankele et al, 2019;Bolbot et al, 2020;Butun et al, n.d., 2020;Dimitriadis et al, 2020;Kim et al, 2020;Lara et al, 2020;Liang et al, 2019;Luo et al, 2015;Mohamed et al, 2020;Moraitis et al, 2020;Ratasich et al, 2019;Sun & Liu, 2012;Willing et al, 2020) Disponibilidade (Agrawal et al, 2019(Agrawal et al, , 2020Al-Mhiqani et al, 2018;Bolbot et al, 2020;Butun et al, n.d., 2020;Dimitriadis et al, 2020;Liang et al, 2019;Luo et al, 2015;Mohamed et al, 2020;Ratasich et al, 2019;Sun & Liu, 2012;Willing et al, 2020) Autenticação (Ankele et al, 2019;Bolbot et al, 2020;…”

“…Trabalhos relacionados Mourtzis et al, 2019;Murch et al, 2018;Ratasich et al, 2019;Russo et al, 2019;Samaila et al, 2020;Yan et al, 2020) Criptografia (Ankele et al, 2019;Lara et al, 2020;Samaila et al, 2020) Impacto nos ativos Criticidade (Anuar et al, 2013;Luo et al, 2015) Capacidade de manutenção (Agrawal et al, 2020;Ani et al, 2019;Anuar et al, 2013;Luo et al, 2015;Prislan et al, 2020;Sun & Liu, 2012) Capacidade de substituição (Ani et al, 2019;Anuar et al, 2013) Confiabilidade (Agrawal et al, 2020;Anuar et al, 2013;Luo et al, 2015) Dano colateral (Luo et al, 2015) Controle e remediação (Ani et al, 2019;Anuar et al, 2013;Luo et al, 2015;Prislan et al, 2020;Walker-Roberts et al, 2020) Probabilidade de ameaça e vulnerabilidade Severidade (Agrawal et al, 2020;Anuar et al, 2013;Mendonça Silva et al, 2016; A. K. Pandey & Alsolami, n.d.) Explorabilidade (Anuar et al, 2013;Luo et al, 2015;A. K. Pandey & Alsolami, n.d.; Sun & Liu, 2012) Sensibilidade (Anuar et al, 2013;Luo et al, 2015;Yan et al, 2020) Similaridade e distribuição de alvo (Agrawal et al, 2020;Anuar et al, 2013;…”

“…K. Pandey & Alsolami, n.d.;Sun & Liu, 2012;Walker-Roberts et al, 2020) Gestão de risco (Anuar et al, 2013;Bolbot et al, 2020;Dimitriadis et al, 2020;Fekete & Rhyner, 2020;Kim et al, 2020;Mohamed et al, 2020;Prislan et al, 2020;Russo et al, 2019) Impacto do evento/ameaça (Anuar et al, 2013) Segurança de rede Cadeias de suprimento (Fekete & Rhyner, 2020;He et al, 2016;Moraitis et al, 2020;Murch et al, 2018) Sistemas de segurança (Ankele et al, 2019;Butun et al, 2020;Lara et al, 2020;Luo et al, 2015;Mohamed et al, 2020;A. K. Pandey & Alsolami, n.d.;Russo et al, 2019;Samaila et al, 2020) Interoperabilidade (Agrawal et al, 2019;Butun et al, 2020;Dimitriadis et al, 2020;Modarresi & Symons, 2020;Ratasich et al, 2019;Willing et al, 2020) Ameaças de segurança (Al-Mhiqani et al, 2018;Ankele et al, 2019;Bolbot et al, 2020;Butun et al, 2020;Dimitriadis et al, 2020;Fernández-Caramés & Fraga-Lamas, 2020b;He et al, 2016;Kim et al, 2020;Lara et al, 2020;Liang et al, 2019;…”

On the development of flexible mobile multi-sensor units based on open-source hardware platforms and a reference framework

“…Since some monitoring scenarios may lack the basic networking infrastructure for continuous online transmission of the samples, either due to costs constraints or coverage holes, such multi-sensor units should operate for long periods of disconnection, demanding them to locally store samples for future transmissions. Therefore, for all aforementioned defined characteristics, there will be some basic functions that will be equivalent for different applications, which push us to the proposal and adoption of standard hardware frameworks [3] , [4] .…”

A Review on Privacy Requirements and Application Layer Security in Internet of Things (IoT)

“…These IoT applications enable the technology, electronic equipments, phone like emebbed products, vehicles and other possible electronic devices to be monitored and controlled through the Internet based on actuators and sensor nodes that are wired or wirelessly connected [5]. Any person at any instant of time has the possibility of connecting with physical objects at distance locations or remote places through the path or the network [6]. IoT refers to the connectivity of the computers and different types of physical devices that need to cooperate with minimum degree of human interface in order to exchange data with the complementary devices connected on the Internet [7].…”