Source-linked AI summary
The Effect of IoT New Features on Security and Privacy: New Threats, Existing Solutions, and Challenges Yet to Be Solved
Wei Zhou, Yuqing Zhang, Peng Liu
TL;DR
IoT applications are expanding while new security and privacy threats emerge and many existing studies remain immature or lack applicability. This survey proposes IoT features as an organizing perspective, analyzes eight features and their associated threats, challenges, and solutions, and studies nearly 200 security papers from 2013 to 2017. It reports that research attention follows IoT application development and concentrates particularly on privacy disclosure and insecure network or protocol problems.
Problem
IoT security research has not adequately explained the root causes of emerging threats and challenges, while growing collection and use of sensitive information increases privacy concerns.
Method
The survey analyzes eight IoT features and their security effects, then examines nearly 200 IoT security papers from 2013 to 2017 using statistical analysis.
Results
Research hotspots follow IoT application development, while research efforts focus mainly on privacy disclosure and insecure network or protocol problems.
Takeaways & Limitations
Analyzing the features behind IoT helps identify security research trends, their reasons, and future research hotspots.
Abstract
from arXiv · showhide
The future of Internet of Things (IoT) is already upon us. IoT applications have been widely used in many field of social production and social living such as healthcare, energy and industrial automation. While enjoying the convenience and efficiency that IoT brings to us, new threats from IoT also have emerged. There are increasing research works to ease these threats, but many problems remain open. To better understand the essential reasons of new threats and the challenges in current research, this survey first proposes the concept of "IoT features". Then, the security and privacy effects of eight IoT new features were discussed including the threats they cause, existing solutions and challenges yet to be solved. To help researchers follow the up-to-date works in this field, this paper finally illustrates the developing trend of IoT security research and reveals how IoT features affect existing security research by investigating most existing research works related to IoT security from 2013 to 2017.
I. INTRODUCTION
IoT adoption brings serious security and privacy risks, while existing research remains immature and leaves many problems open. The paper introduces IoT features as a perspective for analyzing these threats, challenges, and research trends.
- Motivation: IoT applications and connected devices are expanding rapidly across smart homes, healthcare, grids, and cities, increasing their societal importance.The supplied passage projects growth from 20.35 billion connected devices in 2017 to 75.44 billion in 2025.
- Motivation: IoT attacks can compromise medical devices, smart cars, public services, industrial systems, and national security.The examples include attacks on implantable medical devices and smart cars, the 2016 Dyn DDoS attack, and Stuxnet’s damage to Iran’s nuclear program.
- Motivation: Limited security awareness and weak manufacturer support leave device vulnerabilities exposed for longer and with broader effects than traditional computer vulnerabilities.Manufacturers may omit security guidance, patch assistance, firmware updates, and warnings.
- Research gap: Earlier surveys covered threats, mechanisms, solutions, and open issues but rarely analyzed the root causes of IoT security challenges.This gap motivates the paper’s feature-based perspective.
- Contributions: The paper proposes IoT features—unique properties of IoT devices, networks, and applications such as constrained resources—as a framework for explaining threats and challenges.The contribution explicitly presents the concept as a way to identify the basic causes of current IoT threats.
- Contributions: It discusses eight features’ security and privacy effects and analyzes nearly 200 IoT security papers from 2013 to 2017 to identify development trends and their causes.The paper organizes the feature analysis in Section II and performs statistical analysis of the collected research in Section III.
II. THE EFFECT OF IOT FEATURES ON SECURITY AND PRIVACY
The paper examines IoT features through descriptions, threats, challenges, solutions, and opportunities. Interdependence lets attackers manipulate related devices or environments, undermining single-device defenses and static authorization.
- Analysis framework: Each IoT feature is analyzed through its description, resulting threats, research challenges, existing solutions, and opportunities.The approach also uses diagrams and attack examples for selected threats.
- Interdependence: Interdependence describes implicit relationships in which device behavior or environmental conditions can control other devices with little human involvement.Examples include temperature-triggered windows and smart plugs controlling air-conditioning-related behavior.
- Interdependence: Attackers can compromise a related device or environment instead of directly attacking the target, reducing attack difficulty and bypassing its original defenses.The target itself may not be easily compromised, while dependent devices or conditions remain exploitable.
- Interdependence: Interdependent behavior makes defensive boundaries, static access control, and privilege management difficult for systems managed through cloud platforms.The paper notes that many IoT devices are controlled by platforms such as SmartThings, HomeKit, Alexa, JD, and Ali.
3) Challenges:
IoT security research must address heterogeneous devices, protocols, and platforms alongside weak firmware and protocol security. Existing defenses face resource, scalability, interoperability, and assurance challenges.
- Interdependence: Existing interdependence policies become more complicated and impractical as the number of devices increases.ContexIoT addresses overprivileged platform permissions by comparing context, procedure control, data flow, and runtime action data.
- Diversity: More than 90% of IoT device firmware had vulnerabilities, while 94% of known Web security vulnerabilities remained in device Web interfaces.The reported weaknesses include hard-coded keys and exploitable Web-interface flaws.
- Protocols: Rapidly deployed company-designed protocols can contain security problems, and incompatible semantic definitions can create vulnerabilities when protocols work together.The passage cites JoyLink device hijacking and BadTunnel as examples.
- Diversity: Diverse IoT devices and protocols make common system defenses difficult, especially in industrial environments.The paper frames vulnerability discovery and mitigation across varied devices as an urgent challenge.
3) Challenges:
IoT security research must accommodate constrained devices, heterogeneous protocols, and device-specific attacks while meeting practical resource, power, and latency requirements. Existing protections remain difficult to deploy broadly without performance or applicability trade-offs.
- Protocol and network challenges: Protocol diversity requires researchers to identify general security problems and risks arising from interactions among different protocols.
- Analysis coverage: Large-scale firmware dynamic analysis remains limited because existing frameworks may be unsuitable without physical devices or apply only to Linux systems.
- Device heterogeneity: Anomaly-traffic IDS and IPS models may perform poorly because attacks vary across target device types.
- Resource constraints: IoT devices have limited computing ability, storage, and power, restricting deployment of conventional system and network defenses.Lightweight devices may lack MMU-based memory isolation and ASLR, while complex cryptography can consume excessive resources.
- Resource constraints: Fine-grained system protection remains challenging because lightweight devices must satisfy security, software, hardware, time, and power constraints simultaneously.
- Existing protection trade-offs: ARMor can sandbox embedded applications but incurs high overhead for address checks, making it unsuitable for high-real-time-demand IoT devices.
4) Solutions & Opportunities:
The survey describes the risks created by the myriad of IoT devices and data, including large-scale botnets, and reviews lightweight cryptographic and botnet-mitigation approaches. Universal, secure, and effective protections remain unresolved.
- Solutions and challenges: Lightweight cryptographic algorithms reduce resource consumption, but may not provide the same security level as classical algorithms, while new algorithms may introduce security problems.
- Myriad: The “Myriad” feature denotes the enormous number of IoT devices and the huge amount of data they generate, transmit, and use.
- Threats: 1 million IoT devices were compromised, and attack traffic exceeded 1Tbps in the cited Mirai botnet example.
- Threats: IoT botnets use unsecured devices to launch large-scale DDoS attacks, with future targets potentially including critical industrial and public infrastructure.
- Challenges: Detecting and preventing IoT botnet malware early, while interrupting transmission across huge device populations, remains difficult.
- Solutions and opportunities: Mirai-derived tactics can catalog vulnerable IoT devices and detect poor security practices early, but effective universal botnet precautions remain unavailable.
4) Solutions & Opportunities:
Unattended IoT devices are difficult to inspect and protect because they operate remotely, perform critical physical functions, and often share constrained hardware. Existing trusted-execution approaches have limited device coverage and unresolved safety and applicability gaps.
- Unattended: The “unattended” feature describes devices that operate for long periods without physical access, including smart meters, medical devices, and industrial sensors.
- Threats: Unattended devices are difficult to verify or detect as remotely attacked, while their crucial operations make them attractive targets.
- Challenges: Unattended devices are often constrained, task-specific, and strongly coupled to physical environments, making traditional mobile trusted computing difficult to deploy.
- Solutions and opportunities: TrustShadow targets trusted execution for security-critical applications but supports ARM Cortex-A processors rather than tiny ARM Cortex-M devices.
- Open problems: Existing approaches leave more effective and widely applicable remote attestation, lightweight trusted execution, and safety patching as open problems.
- Intimacy: The “Intimacy” feature captures IoT devices’ close relationship with users through collection of biological, surrounding, and daily-activity information.
- Privacy threats: Analyzing smoke and carbon-dioxide sensor data can reveal whether a home is occupied with more than 90 percent accuracy.
2) Threats:
IoT services depend on sensitive personal information, but collecting, transferring, and using it expands privacy-leak exposure. Existing protections trade data availability and timeliness against privacy and often cover only narrow scenarios or lifecycle stages.
- Privacy threats: IoT applications use personal information to provide services such as customized insurance discounts, creating a utility–privacy trade-off.
- Privacy threats: Collecting, transferring, and using sensitive information increases the attack surface for privacy leaks.
- Existing solutions: Masking, encryption, and homomorphic methods can protect sensitive data but reduce original-data availability and increase delay.
- Challenges: Effective privacy protection must preserve privacy, high availability of original data, and real-time operation simultaneously.
- Open problems: Many privacy solutions apply only to specific scenarios or individual data-lifecycle stages, leaving more complete general protection open.
- Opportunities: Biological signals collected by IoT devices may support user-specific encryption keys or authentication.
- Mobility: Mobile IoT devices face broader attack surfaces and malicious-code propagation risks as they join more networks and communicate with more devices.
- Mobility: Cross-domain identification and trust are central challenges when mobile devices move between networks and receive permissions from new domains.
3) Challenges:
IoT security challenges arise from constrained devices, insecure configurations, complex interactions, limited security services, and insufficient awareness across stakeholders. The paper calls for more practical, coordinated, and feature-aware research and safeguards.
- Mobile-device data crossing networks and protocols requires key negotiation, confidentiality, and integrity protection.
- Insecure-by-default configurations and vulnerable vehicle systems can let attackers reach CAN-Bus controls.The paper illustrates this risk with in-vehicle infotainment and navigation systems connected directly to CAN-Bus.
- Manufacturers often provide limited security guidance, patching, firmware updates, and warnings, extending vulnerability exploitation and impact.The paper identifies detailed product security standards and cooperation with supervisory agencies as urgent needs.
- Operators may misinterpret abnormal device behavior as malfunction, so they need stronger security awareness and IDS or IPS skills.
- Researchers should cooperate with consumers, manufacturers, and operators to design practical safeguards for diverse devices, resources, and architectures.
I. Summary
The paper surveys IoT security by examining interacting IoT features and analyzing nearly 200 research papers. It uses structured classification to identify current research focus and development trends while noting scope boundaries.
- The paper’s discussed IoT features interact, so security solutions must consider combined effects such as constrained resources and unattended devices.
- Features with less impact on security and privacy remain outside the survey’s scope.
- The survey studies nearly 200 IoT security papers from leading journals and conferences published during the recent five-year period.
- The analysis aims to reveal IoT security research development trends, current problem priorities, and the effects of IoT features on existing research.
- The papers are searched, filtered, and labeled by IoT relevance, IoT layers, application scenarios, and threats for statistical analysis.
B. Statistical Analysis
The survey analyzes how IoT application scenarios, system layers, and threat types shape security research trends. It links changing research emphasis to application development, scenario-specific architectures, and IoT features.
- Application scenarios: Security research followed application growth: smart grid and manufacturing led earlier, while smart home and healthcare gained attention recently.Research interest in smart grid and manufacturing declined as smart home and healthcare technologies developed.
- IoT layers: Layer-level research differs by scenario, with transfer-layer studies exceeding application-layer studies in smart manufacturing, but the reverse pattern appearing in smart homes.The paper relates this contrast to wireless sensor networks in industrial settings and mobile or web applications in homes.
- Implications: Different IoT application scenarios require scenario-specific security analysis because their devices have different working models and main security problems.The paper recommends understanding these differences to identify the primary security problems in each scenario.
- Threat tags: Privacy disclosure and insecure network or protocol problems receive most research attention across application scenarios.The paper connects these priorities to IoT features involving sensitive data, many devices, and diverse devices and protocols.
- Survey contribution: The survey analyzes security and privacy issues through IoT features, reviews existing solutions, identifies further technology needs, and traces research development.It uses IoT features to explain threats, research challenges, and changing security research hotspots.
APPENDIX
The appendix provides a public collection of the research and survey papers analyzed in the study.
- Research materials: The authors publish their collected research and survey papers on GitHub and state that the collection will be updated.The repository is identified as https://github.com/chaojixx/IoT-security-papers.