On Wide-Area IoT Networks, Lightweight Security and Their Applications—A Practical Review

Abstract

The Internet of Things (IoT) allows users to collect sensor data, control devices, and analyze collected data over the Internet. IoT devices are located in diverse environments and support many applications. To protect IoT systems from cyber threats, Confidentiality, Integrity, and Authentication—the CIA triad—must be supported. However, IoT devices have limited energy and computational resources. Lightweight encryption algorithms have been proposed for IoT, and have been reviewed by previous studies. Some cover communication protocols, while others cover lightweight security or review the challenges in implementing a secure IoT system. The aim of this literature review is to combine the first two topics: communication protocols and lightweight security. They will be approached from a practitioner’s standpoint. Several applications are provided that help readers with a minor background in security to understand these technologies and which elements of the CIA triad have more priority. This paper describes wide-area IoT networks, such as LoRAWAN, Sigfox, and NB-IoT, and their security. It also describes applications throughout the world, and how to enhance their security by implementing emerging lightweight security—specifically, approaches to make well-known ciphers such as Advanced Encryption Standard (AES) and Elliptic Curve Cryptography (ECC) more lightweight.

Enhancing LoRaWAN Security: An Advanced AES-Based Cryptographic Approach

“…Presenting an environment based on hardware, software and SDR to study the radio layer of the protocol Goulart et al [71] Application of the CIA triad Classify lightweight security approaches for AES and ECC [76] Novel secure root key updating scheme that involves periodically changing the root key value based on the CTR_AES DRBG 128 algorithm…”

Internet of Things: A Comprehensive Overview on Protocols, Architectures, Technologies, Simulation Tools, and Future Directions

“…Security: Network data, particularly that of wireless networks, is vulnerable to a wide range of attacks, including denial of service, spoofing, eavesdropping, and so on [25]. In an attempt to counteract these assaults, IoT systems include security features, such as content integrity, message integrity, privacy, authorization, and authentication [26].…”

Bingo: A Semi-Centralized Password Storage System

“…In order to obtain a user's password in plain text, an attacker may act as a "man in the middle" by intercepting the connection between the user's browser and the end server. While best safety practices indicate that all traffic between clients and servers should be secured by encryption such as HTTPS, a large number of online sites still use unencrypted traffic over HTTP [25,26]. If an attacker is able to intercept requests by the user in plain text, there is no need to brute force the password.…”