Paper 50-Security Issues in The Internet of Things
Paper 50-Security Issues in The Internet of Things
net/publication/318096417
CITATIONS READS
23 1,431
4 authors, including:
SEE PROFILE
Some of the authors of this publication are also working on these related projects:
All content following this page was uploaded by Mirza Abdur Razzaq on 08 July 2017.
Abstract—Wireless communication networks are highly prone work, shop, chat (keep pets and plants in the virtual world
to security threats. The major applications of wireless commu- provided by the network), whereas humans live in the real
nication networks are in military, business, healthcare, retail, world. Therefore, it is very difficult to replace all the human
and transportations. These systems use wired, cellular, or adhoc activities with the fully automated living. There is a bounding
networks. Wireless sensor networks, actuator networks, and limit of fictional space that restricts the future development
vehicular networks have received a great attention in society
of internet for better services. The IoT has successfully in-
and industry. In recent years, the Internet of Things (IoT) has
received considerable research attention. The IoT is considered tegrated the fictional space and the real world on the same
as future of the internet. In future, IoT will play a vital role platform. The major targets of IoT are the configuration of
and will change our living styles, standards, as well as business a smart environment and self-conscious independent devices
models. The usage of IoT in different applications is expected such as smart living, smart items, smart health, and smart
to rise rapidly in the coming years. The IoT allows billions of cities among others [2]. Nowadays the adoption rate of the
devices, peoples, and services to connect with others and exchange IoT devices is very high, more and more devices are connected
information. Due to the increased usage of IoT devices, the IoT via the internet. According to appraisal [3], there are 30 billion
networks are prone to various security attacks. The deployment connected things with approximate 200 billion connections that
of efficient security and privacy protocols in IoT networks is will generate revenue of approximately 700 billion euros by the
extremely needed to ensure confidentiality, authentication, access
year 2020. Now in China, there are nine billion devices that are
control, and integrity, among others. In this paper, an extensive
comprehensive study on security and privacy issues in IoT expected to reach 24 billion by the year 2020. In future, the IoT
networks is provided. will completely change our living styles and business models.
It will permit people and devices to communicate anytime,
Keywords—Internet of Things (IoT); security issues in IoT; anyplace, with any device under ideal conditions using any
security; privacy network and any service [4]. The main goal of IoT is to create
Superior world for human beings in future. Fig. 1 shows the
I. I NTRODUCTION concept of IoT with their capabilities.
www.ijacsa.thesai.org 386 | P a g e
(IJACSA) International Journal of Advanced Computer Science and Applications,
Vol. 8, No. 6, 2017
6) Security Attacks and System Vulnerabilities: There has The main emphasis of this paper was to highlight major
been a lot of work done in the scenario of IoT security up till security issues of IoT particularly, focusing the security attacks
now. The related work can be divided into system security, and their countermeasures. Due to lack of security mechanism
application security, and network security [17]. in IoT devices, many IoT devices become soft targets and
even this is not in the victim’s knowledge of being infected.
a) System Security: System security mainly focuses on In this paper, the security requirements are discussed such
overall IoT system to identify different security challenges, to as confidentiality, integrity, and authentication, etc. In this
design different security frameworks and to provide proper survey, twelve different types of attacks are categorized as
security guidelines in order to maintain the security of a low-level attacks, medium-level attacks, high-level attacks, and
network. extremely high-level attacks along with their nature/behavior
as well as suggested solutions to encounter these attacks are
b) Application security: Application Security works for discussed.
IoT application to handle security issues according to scenario
requirements. Considering the importance of security in IoT applications,
it is really important to install security mechanism in IoT
c) Network security: Network security deals with se- devices and communication networks. Moreover, to protect
curing the IoT communication network for communication of from any intruders or security threat, it is also recommended
different IoT devices. not to use default passwords for the devices and read the
security requirements for the devices before using it for the first
In the next section, the security concerns regarding IoT are time. Disabling the features that are not used may decrease the
discussed. The security attacks are categorized into four broad chances of security attacks. Moreover, it is important to study
classes. different security protocols used in IoT devices and networks.
www.ijacsa.thesai.org 387 | P a g e
(IJACSA) International Journal of Advanced Computer Science and Applications,
Vol. 8, No. 6, 2017
TABLE I. A S UMMARY OF D IFFERENT T YPES OF ATTACKS AND T HEIR T HREAT L EVELS , T HEIR NATURE AND S UGGESTED S OLUTIONS
Type Threat level Behavior Suggested Solution
Passive Low Usually breach data confidentiality. Examples are passive eaves- Ensure confidentiality of data and do not allow an attacker to
dropping and traffic analysis. Hostile silently listen the commu- fetch information using symmetric encryption techniques.
nication for his own benefits without altering the data.
Man in the Middle Low to Medium Alteration and eavesdropping are the examples of this attack. Apply data confidentiality and proper integration on data to
An eavesdropper can silently sense the transmission medium ensure integrity. Encryption can be also applied so that no one
and can modify the data if encryption is not applied and steal can steal the information or modify the information or encode
the information that is being transmitted. Hostile may also the information before transmission.
manipulate the data.
Eavesdropping Low to Medium The information content may be lost by an eavesdropper that Apply encryption on all the devices that perform communica-
silently senses the medium. For example in medical environ- tion.
ment, privacy of a patient may be leaked.
Gathering Medium to High Occurs when data is gathered from different wireless or wired Encryption can be applied to prevent this kind of attack. Identity
medium. Examples are skimming, tampering and eavesdrop- based method and message authentication code can also be
ping. Data is being collected to detect messages. Messages may applied in order to prevent the network from such malicious
also be altered. attacks.
Active High Effects confidentiality and integrity of data. Hostile can alter Ensure both confidentiality and integrity of data. To maintain
the integrity of messages, block messages, or may re-route the data confidentiality, symmetric encryption can be applied. An
messages. It could be an internal attacker. authentication mechanism may be applied to allow data access
to only authorized person.
Imitation High It impersonate for an unauthorized access. Spoofing and cloning To avoid from spoofing and cloning attacks, apply identity
are the examples of this attack. In spoofing attack a malicious based authentication protocols. Physically unclonable function
node impersonate any other device and launch attacks to steal is a countermeasure for cloning attack.
data or to spread malware. Cloning can re-write or duplicate
data.
Privacy High Sensitive information of an individual or group may be dis- Apply anonymous data transmission. Transmit sample data
closed. Such attacks may be correlated to gathering attack or instead of actual data. Can also apply techniques like ring
may cause an imitation attack that can further lead to exposure signature and blind signature.
of privacy.
Interruption High Affects availability of data. This makes the network unavailable. Applying authorization, only authorized users are allowed to
access specific information to perform certain operation.
Routing diversion High Only the route is diverted showing the huge traffic and the Ensure connectivity based approach so no route will be di-
response time increased. verted.
Blocking Extremely High It is type of DoS, jamming, or malware attacks. It sends huge Turn on the firewall, apply packet filtering, anti-jamming, active
streams of data which may leads to jamming of network, jamming, and updated antivirus programs in order to protect the
similarly different types of viruses like Trojan horses, worms, network from such attacks.
and other programs can disturb the network.
Fabrication Extremely High Affects the authenticity of information. Hostile can inject false Data authenticity can be applied to ensure that no information
data and can destroy the authenticity of information. is changed during the transmission of data.
DoS Extremely High Malicious user may modify the packets or resend a packet again Apply cryptographic techniques to ensure security of network.
and again on network. User can also send bulk messages to Apply authenticity to detect the malicious user and block
devices in order to disturb the normal functionalities of devices. them permanently. In this way, the network is prevented from
damage.
www.ijacsa.thesai.org 388 | P a g e