The Internet of Things (IoT) - the emerging global interconnection of billions of 'smart' devices - will be collecting increasing amounts of private and sensitive data about our lives, and will require increasing degrees of reliability and trustworthiness in terms of the levels of assurance provided with respect to confidentiality, integrity and availability. This book examines these important security considerations for the IoT Topics covered include a security survey of middleware for the IoT; privacy in the IoT; privacy and consumer IoT - a sensemaking perspective; a secure platform for smart cities and IoT; model-based security engineering for the IoT; federated identity and access management in IoT systems; the security of the MQTT protocol; securing communications among severely constrained, wireless embedded devices; lightweight cryptographic identity solutions for the IoT; and a reputation model for the IoT.
Inspec keywords: data privacy; smart cities; security of data; protocols; embedded systems; Internet of Things
Other keywords: smart cities; SMARTIE; consumer IoT system; privacy breaches; MQTT protocol; middleware; model-based security engineering; federated identity and access management; constrained wireless embedded devices; reputation model; communication security; Internet of Things; lightweight cryptographic identity solutions
Subjects: Cryptography; Information networks; Public administration; General electrical engineering topics; Protocols; Data security; General and management topics
The rapid growth of small Internet connected devices, known as the Internet of Things (IoT), is creating a new set of challenges to create secure, private infrastructures. The purpose of this chapter is to review the current literature on the challenges and approaches to security and privacy in the IoT, with an especial focus on how these aspects are handled in IoT middleware. We focus on IoT middleware because many systems are built from existing middleware and these inherit the underlying security properties of the middleware framework. The chapter is composed of three main sections. First, we look at the general security and privacy challenges around IoT. Second, we present a structured literature review of the available middleware and how security is handled in these middleware approaches. Finally, we draw a set of conclusions and identify further work in this area.
Privacy protection is gaining public attention, and even more so with the advances of the Internet of Things (IoT). But there is still no consensus on how privacy can be engineered, even for traditional Information Technology (IT) systems. This chapter, after discussing the main challenges, proposes a general methodology to manage the privacy engineering in the context of IoT and some technical building blocks and solutions. More concretely, this chapter explains why IoT both increases the likelihood and aggravates the impact of data breaches in IT systems. Then, after presenting existing privacy protection principles and frameworks and mapping them to privacy protection mechanisms, a privacy development life cycle (PDLC) is proposed. Finally, privacy-enhancing technologies specific for the IoT are presented, as the application of a PDLC in IoT would require new and adapted technologies due to IoT's constraints.
Internet of Things (IoT) is slowly entering the realm of consumer devices in the form of smart devices and home automation. However, simultaneously it has led to concerns of privacy due to the frequent citation of media reports highlighting weak privacy policies of device manufacturers [1]. In some cases, manufacturers have even been found themselves actively monitoring and analyzing user's private information [2]. End user's private information is exchanged and traded as currency in this IoT ecosystem. These apprehensions have affected consumer IoT adoption. In this chapter, novel concerns of consumer privacy are highlighted. The change in connected device architecture is presented, to reflect upon the role of various stakeholders in this ecosystem. Sensemaking theory is used to explain the change in the relation between users and conventional consumer devices vs IoT-enabled devices. Based on this renewed understanding, we engage the privacy concerns and system use perspectives of IoT users and providers focusing on enhancing perceived usefulness of IoT in consumer devices. Future avenues for research are suggested, focusing on designing privacy-aware systems.
The Internet of Things (IoT) is intended to transform our daily lives through the convergence of significant efforts from different disciplines. Under the vision of a hyper-connected world, security and privacy must be properly tackled by holistic approaches, since they are considered as key factors for a large-scale deployment of new IoT-enabled services and applications. Towards this end, the focus of the SMARTIE project is the application of security and privacy mechanisms to different use cases under the umbrella of a high-level architecture with a strong emphasis on security and privacy. The instantiation of this architecture is aimed to facilitate the creation of valuable and innovative services for citizens in the upcoming generation of Smart Cities, while security and privacy are preserved.
We propose in this chapter a Model-based Security Toolkit (SecKit) and methodology to address the control and protection of user data in the deployment of the Internet of Things (IoT). This toolkit takes a more general approach for security engineering including risk analysis, establishment of aspect-specific trust relationships, and enforceable security policies. We describe the integrated metamodels used in the toolkit and the accompanying security engineering methodology for IoT systems using these metamodels. We validate our approach through a case study of a realworld supply chain scenario where sensors are used to monitor the temperature and control environmental conditions of the transported goods. The toolkit is applied in the design of this case study, analysis of risks, and specification of security policy rules following the steps of our methodology. Finally, we also show how the specified security policies are enforced using technology-specific policy enforcement points.
In this chapter, we look at how identity and access management work in the Internet of Things (IoT). In particular, we propose approaches to apply Federated Identity and Access Management (FIAM) techniques to work with IoT devices, networks and servers. We first look at the motivation for using FIAM with IoT. We then look at the previous work and approaches to identity management and access control for IoT systems. We look at how Web-based approaches to FIAM translate into the world of IoT where non-Web protocols are more common. We outline two separate phases of research where we created new FIAM approaches for IoT systems, and we include a performance analysis of the latter system. One emerging area of interest for FIAM is within the domain of Web API Management, and we explore how this also affects the IoT domain. Finally, we conclude with the outcomes of this research, open questions and propose avenues for further research.
We present a security analysis for one of the most popular standards for the Internet of Things, namely the MQ Telemetry Transport (MQTT) protocol, based on a formal model of the protocol in a timed process algebra. We explain the modelling choices we made and give a review of the results of earlier work on the formal verification of the protocol model. We also reveal in this chapter new results related to another case of its message delivery semantics, namely that of at-least-once delivery. We discuss the implications of different failure scenarios for clients and servers in the protocol as well as the variations in the attacker models that could affect the security guarantees of the protocol.
The goal of this chapter is to present the ideas and concepts of the EU-FP7 SMART-CITIES project “RERUM” with regards to improving the communication security in Internet of Things (IoT)-based smart city applications. The chapter tries to identify the gaps in previous IoT frameworks with regards to security and privacy and shows the advances that RERUM brings to the IoT community with its significant focus on embedded device functionalities. The goal of the RERUM secure communications framework is to provide light-weight solutions so that they can be applied even in the very constrained IoT devices. Solutions for lightweight encryption (based on the relatively new theory of Compressive Sensing), on transport-layer security (based on DTLS) and on integrity verification of data (using on-device signatures) are presented in detail, discussing their applicability and the benefits they bring to IoT.
With the increasing emergence of pervasive electronic devices in our lives, the Internet of Things (IoT) has become a reality with its influence on our day to day activities set to further increase with a projected 50 billion connected devices by the year 2020 [8]. These smart devices and sensors will be found in our homes, our cars, our workplaces, etc., and have the potential to revolutionise how we interact with the world today. The slew of data generated by such a volume of devices necessitates the use of smart, autonomous machine-to-machine (M2M) communications; however, this necessarily poses serious security and privacy issues as we will no longer have direct control over with whom and what our devices communicate. This could potentially open up new attack vectors for criminal hackers to exploit through the use of malicious or tampered IoT devices. Compounding the problem is that to enable the ubiquitous nature of the IoT, the embedded devices themselves are often low-cost, low-power, throwaway units which are restricted both in memory and computing power. Generally, low-cost devices targeted at the IoT space, such as the ARM Cortex-M® or the Atmel tinyAVR® families of microcontroller units (MCUs), contain little if any embedded security features. Their lightweight nature is such that even highly optimised cryptographic implementations targeted at specific MCU still require a significant timing, and corresponding energy, overhead [9]. Hence, it is clear we need a new approach to securing the IoT. In this chapter, we outline the proposed use of Physical Unclonable Functions (PUFs) for the provision of IoT device security.
The MQ Telemetry Transport (MQTT) protocol has emerged over the past decade as a key protocol for a number of low power and lightweight communication scenarios including machine-to-machine and the Internet of Things. In this chapter we develop a utility-based reputation model for MQTT, where we can assign a reputation score to participants in a network based on monitoring their behaviour. We mathematically define the reputation model using utility functions on participants based on the expected and perceived behaviour of MQTT clients and servers. We define an architecture for this model, and discuss how this architecture can be implemented using existing MQTT open source tools, and we demonstrate how experimental results obtained from simulating the architecture compare with the expected outcome of the theoretical reputation model.
