Source-linked AI summary
Internet of Things Security, Device Authentication and Access Control: A Review
Inayat Ali, Sonia Sabir, Zahid Ullah
TL;DR
The enormous number of IoT devices and M2M communication make traditional authentication and authorization techniques unsuitable, while up-to-date comprehensive IoT security reviews have been scarce [40]. The paper surveys security challenges and attacks across IoT architecture layers, discusses countermeasures and traditional-solution challenges, and reviews IoT authentication and access-control mechanisms. The paper identifies support-layer security as insufficiently explored and presents a study of authentication and access-control mechanisms designed for IoT.
Problem
The enormous number of IoT devices and M2M communication make traditional authentication and authorization techniques unsuitable, while up-to-date comprehensive IoT security reviews have been scarce [40].
Source: A. Motivation · p. 1, §V · p. 8Method
The paper surveys security challenges and attacks across IoT architecture layers, discusses countermeasures and traditional-solution challenges, and reviews IoT authentication and access-control mechanisms.
Source: §I · p. 1, §VI · p. 9Results
The paper identifies support-layer security as insufficiently explored and presents a study of authentication and access-control mechanisms designed for IoT.
Source: §VI · p. 9Takeaways & Limitations
The study aims to guide researchers toward security challenges requiring attention, including robust authentication solutions for constrained devices in M2M communications.
Source: §VI · p. 9
Abstract
from arXiv · showhide
The Internet of Things (IoT) is one of the emerging technologies that has grabbed the attention of researchers from academia and industry. The idea behind Internet of things is the interconnection of internet enabled things or devices to each other and to humans, to achieve some common goals. In near future IoT is expected to be seamlessly integrated into our environment and human will be wholly solely dependent on this technology for comfort and easy life style. Any security compromise of the system will directly affect human life. Therefore security and privacy of this technology is foremost important issue to resolve. In this paper we present a thorough study of security problems in IoT and classify possible cyberattacks on each layer of IoT architecture. We also discuss challenges to traditional security solutions such as cryptographic solutions, authentication mechanisms and key management in IoT. Device authentication and access controls is an essential area of IoT security, which is not surveyed so far. We spent our efforts to bring the state of the art device authentication and access control techniques on a single paper.
I. INTRODUCTION
IoT connects devices and objects with one another and with people, but its heterogeneous, resource-constrained devices and large-scale M2M communication complicate security. The paper reviews IoT security challenges and attacks, with particular attention to underexplored support-layer security and device authentication and access control.
I. INTRODUCTION
- IoT interconnects devices and objects with each other and with humans to achieve common goals.The paper describes IoT as powered by technologies including WSANs and RFID.Source: §I · p. 1
- The paper reviews security threats and potential attacks across IoT architecture layers and discusses countermeasures.Source: §I · p. 1
- Resource constraints make cryptographic security difficult, while IoT scale and M2M communication challenge traditional authentication and access control.These challenges can expose devices to data integrity and confidentiality issues.Source: §I · p. 1
A. Motivation
- Existing reviews were described as scarce, often outdated, and incomplete on support-layer security; the paper also examines authentication and access control [40].The authors identify these mechanisms as critical challenges in IoT.Source: A. Motivation · pp. 1–2
II. INTERNET OF THINGS ARCHITECTURE
The paper presents a four-layer IoT architecture as a useful reference for classifying security issues, while noting that it is not standardized. It describes the layers from physical sensing through networking and cloud or fog support to user-facing services, and places their security concerns in the context of mission-critical applications.
II. INTERNET OF THINGS ARCHITECTURE
- The four-layer IoT architecture is a useful reference for classifying security issues, although it is not standardized.The paper identifies it as the most widely accepted structure.Source: §II · p. 2
A. Perceptual Layer
- The perceptual layer uses sensors, RFID tags, and other devices to collect physical-world data for processing and decision-making.Source: A. Perceptual Layer · p. 2
B. Network Layer
- The network layer transmits perceptual-layer data to fog nodes, the cloud, or other IoT nodes using networks such as mobile, satellite, and wireless ad hoc networks.Source: B. Network Layer · p. 2
C. Support Layer
- The support layer provides fog or cloud storage and computing to resource-constrained devices, supporting their participation and system scalability.Source: C. Support Layer · p. 2
D. Application Layer
- The application layer delivers services through interfaces tailored to user needs, including smart-home, healthcare, transportation, and agriculture applications.Source: D. Application Layer · p. 2
III. SECURITY IN THE INTERNET OF THINGS
- Security and privacy challenges are especially consequential in mission-critical IoT deployments, including healthcare and transportation.The paper discusses these challenges in the context of IoT architecture and presents Fig. 2 as a visual summary of security issues.Source: §III · p. 2
A. Perceptual layer security
Resource-constrained devices, often deployed in open or unsecured environments, face physical and other attacks at the perceptual layer. The paper describes node tampering, fake-node insertion, and side-channel attacks as threats to network security and integrity.
A. Perceptual layer security
- Resource-limited perceptual-layer devices in open or unsecured environments are vulnerable to cyberattacks, including physical attacks.Source: A. Perceptual layer security · p. 2
1) Node tempering:
- Physical access can let an attacker replace or connect to a sensor node and alter sensitive information, including cryptographic keys or routing-table entries.Such breaches can compromise network security and integrity.Source: 1) Node tempering · p. 3
2) Fake node:
- A fake node can inject malicious data, deplete low-power devices’ energy, and serve as a man-in-the-middle attack.Source: 2) Fake node · p. 3
3) Side channel attack:
- Side-channel attacks exploit power consumption, timing, or electromagnetic radiation to infer sensitive data and weaken security.Source: 3) Side channel attack · pp. 3–4
4) Physical damage:
The paper describes perceptual- and network-layer threats ranging from physical damage and malicious code to compromised sensor data and authentication overhead. It emphasizes protecting data integrity and authenticity, securing nodes, and using lightweight cryptography in resource-constrained environments.
4) Physical damage:
- Physical damage can render IoT devices inoperable and disrupt network services.Source: 4) Physical damage · p. 4
5) Malicious code injection:
- Malicious code inserted into a node can grant unauthorized access and let an attacker manipulate or disrupt network operations.Source: 5) Malicious code injection · p. 4
6) Protecting sensor data:
- Sensor-data confidentiality may be less critical than integrity and authenticity, since a nearby sensor can reproduce readings; falsified data can lead to incorrect decisions or actions.Source: 6) Protecting sensor data · p. 4
7) Mass node authentication:
- Authentication traffic from large numbers of nodes can increase latency and resource consumption, motivating efficient, scalable mechanisms.Source: 7) Mass node authentication · p. 4
8) Security requirements of perceptual Layer:
- Perceptual-layer security requires physical protection, node authentication, data integrity and confidentiality, lightweight cryptography, and key management.The paper identifies key management as a significant challenge in resource-constrained IoT networks.Source: 8) Security requirements of perceptual… · p. 4
B. Network Layer Security
- Eavesdropping, DoS, man-in-the-middle attacks, and virus invasions threaten network-layer communication and data confidentiality and integrity.Source: B. Network Layer Security · p. 4
1) Heterogeneity problem:
The passages describe heterogeneity and network or device-layer threats, including congestion, radio disruption, eavesdropping, and denial of service.
1) Heterogeneity problem:
- Heterogeneous access methods and protocols make uniform security measures difficult across IoT devices and systems.Solutions must be flexible across diverse technologies.Source: 1) Heterogeneity problem · p. 4
2) Network congestion problems:
- Authentication overhead from numerous devices, combined with large sensor-data volumes, can contribute to network congestion.The passage points to efficient authentication and robust transport protocols as responses.Source: 2) Network congestion problems · p. 4
3) RFIDs interference:
- Noise disrupting RFID radio signals causes a network-layer denial-of-service attack.The interference prevents effective RFID communication.Source: 3) RFIDs interference · p. 4
4) Node jamming in WSN:
- Radio-frequency interference can disrupt wireless sensor networks and deny their services.The passage describes this as similar to RFID interference.Source: 4) Node jamming in WSN · p. 4
5) Eavesdropping attack:
- Wireless traffic sniffing around WSNs, RFIDs, or Bluetooth devices can expose sensitive information for further attacks.Packet sniffers are one tool used to gather information.Source: 5) Eavesdropping attack · p. 4
6) Denial of service:
- A denial-of-service attack floods a network beyond its capacity, blocking legitimate traffic and disrupting services.The passage characterizes this as excessive illegitimate requests or data.Source: 6) Denial of service · p. 4
7) RFID spoofing:
The passages describe RFID spoofing, routing manipulation, and Sybil attacks, then outline network- and support-layer security concerns and cloud data protections.
7) RFID spoofing:
- Spoofed RFID signals can be used to read a tag and send fake data with its information, gaining system access.The attack can inject false data and compromise network integrity.Source: 7) RFID spoofing · p. 4
8) Routing attacks:
- Manipulated routing information can create loops, advertise false routes, send errors, or drop traffic.These actions can disrupt operations and cause data loss.Source: 8) Routing attacks · p. 5
9) Sybil attack:
- A Sybil attacker claims multiple node identities, potentially falsifying routing information or rigging WSN elections.The passage also links such attacks to congestion or network breakdown.Source: 9) Sybil attack · p. 5
10) Security requirements of network layer:
- Network-layer safeguards must address DoS and DDoS while using robust protocols against routing attacks, congestion, and spoofing.The passage frames protocol resilience as important to network integrity and availability.Source: 10) Security requirements of network… · p. 5
C. Support Layer Security
- Support-layer security includes protecting cloud-hosted user data and applications against breaches, unauthorized access, and infrastructure vulnerabilities.The passage also mentions CSA frameworks, SCAP auditing, and TCG trusted results.Source: C. Support Layer Security · p. 5
1) Data security:
- Cloud data protections include detecting unauthorized migration, using data-loss-prevention tools, monitoring file and database activity, and dispersing or fragmenting data.The passage describes dispersion and fragmentation as ways to obscure data.Source: 1) Data security · p. 5
2) Interoperability and portability:
The support-layer passages cover cloud portability, continuity, auditing, shared-tenant and virtualization risks, and compliance monitoring for cloud and fog services.
2) Interoperability and portability:
- Proprietary cloud standards complicate migration between providers and can create inconsistent security measures and exposure risks.The passage calls for universal standards and protocols supporting interoperability and consistent security.Source: 2) Interoperability and portability · p. 5
3) Business continuity and disaster recovery:
- Cloud providers should plan data-center locations and backups to maintain services during disasters such as floods, fires, and earthquakes.The stated aim is business continuity and reduced data loss.Source: 3) Business continuity and disaster… · p. 5
4) Cloud audit:
- Regular audits are needed to check cloud vendors’ compliance with Cloud Security Alliance standards and verify that security measures remain effective.The passage connects audits with maintaining user trust.Source: 4) Cloud audit · p. 5
5) Tenants security:
- In IaaS, tenants share physical storage, creating a risk that an adversary could steal another tenant’s data.The passage identifies data isolation and robust encryption as protections.Source: 5) Tenants security · p. 5
6) Virtualization security:
- Virtual-machine communication can bypass traditional network controls, while insecure migration can introduce vulnerabilities and complicate cloud audits.Secure VM migration is presented as important to cloud integrity and compliance.Source: 6) Virtualization security · p. 5
7) Security requirements of support layer:
- Because IoT data and application instances reside on cloud and fog nodes, services should meet CSA requirements and support accessible online audits.The passage says users should be able to verify vendors’ security practices.Source: 7) Security requirements of support… · pp. 5–6
D. Application Layer Security
Application-layer security is complicated by diverse use cases and data sharing, with access-control needs alongside phishing, malicious scripts, and malware threats.
D. Application Layer Security
- Application-layer data sharing creates privacy and access-control challenges, while differing application requirements and the absence of a standard construction framework impede consistent security.The passage identifies unauthorized access and breaches during sharing as concerns.Source: D. Application Layer Security · p. 6
1) Data access and authentication:
- Applications with users holding different privileges require authentication and access controls suited to varied access needs.The passage emphasizes protecting sensitive data from unauthorized access.Source: 1) Data access and authentication · p. 6
2) Phishing attacks:
- Phishing uses infected emails or malicious links to steal legitimate credentials and gain unauthorized access.The passage names user education, email filtering, and multi-factor authentication as preventive measures.Source: 2) Phishing attacks · p. 6
3) Malicious activeX scripts:
- An ActiveX script sent over the internet can compromise an IoT system if a user runs it.The passage recommends restricting ActiveX controls, especially from untrusted sources.Source: 3) Malicious activeX scripts · p. 6
4) Malwares attack:
- Trojan horses, worms, and viruses can compromise IoT applications, steal data, or disrupt services.The passage recommends malware detection and prevention tools.Source: 4) Malwares attack · p. 6
5) Security requirements of application layer:
IoT’s scale, heterogeneous architecture, and resource constraints limit the direct use of traditional security solutions. The section describes resulting challenges for cryptography, key management, and DoS defense.
5) Security requirements of application layer:
- Application-layer security calls for strong authentication and access control, strong passwords, and antivirus protection against malware.The passage states that these combined measures can reduce unauthorized access and malware infections.Source: 5) Security requirements of… · p. 6
IV. CHALLENGES TO TRADITIONAL SECURITY SOLUTIONS IN IOT
- Cloud users must trust third-party providers, and vendors can build that trust through audits and recognized security certifications.The passage names Cloud Security Alliance standards as one certification option.Source: §IV · p. 6
- Traditional network security solutions are not directly applicable to IoT because of network size, architectural heterogeneity, and constrained end nodes.The section calls for approaches tailored to these conditions.Source: §IV · p. 6
A. Cryptographic techniques
- Resource constraints make strong cryptographic algorithms costly in CPU power and battery use, limiting their feasibility for IoT devices.The paper calls for developing or optimizing algorithms to balance security with device efficiency and longevity.Source: A. Cryptographic techniques · p. 6
B. Key management
- Key-management solutions suited to other networks do not fit IoT’s large scale and diverse device layer, leaving scalability and efficiency unresolved.The paper identifies this as an ongoing research challenge.Source: B. Key management · p. 7
C. Denial of service
- DoS defenses must account for limited battery and computational resources; allowing even 10 attack messages through before detection can severely affect sensor nodes.Existing detection and mitigation solutions are described as not fully effective in IoT and needing further research.Source: C. Denial of service · p. 7
D. Authentication and access control
IoT’s massive scale and machine-to-machine communication challenge traditional authentication and authorization: devices need to authenticate before exchanging information. The reviewed work spans device authentication and access control schemes.
D. Authentication and access control
- IoT lacks an efficient authentication mechanism for its massive device population, although mutual node authentication is needed to prevent fake-node attacks in M2M communication.The paper identifies scalable, efficient authentication as a continuing research challenge.Source: D. Authentication and access control · pp. 7–8
V. AUTHENTICATION AND ACCESS CONTROL IN IOT
- Chen et al. use a single token for group access, while Rivera et al. describe role-based access levels through User-Managed Access.Chen’s model uses device identifiers and a group prefix to verify tokens; Rivera’s model is a profile of OAuth 2.0.Source: §V · p. 8
- SmartOrBAC uses RESTful web services and dynamically established contracts to support secure collaboration between organizations.The paper describes the approach as suited to collaborative entities in low-power, energy-constrained scenarios.Source: §V · p. 8
- Gaikwad et al. describe a smart-home Kerberos system, while Panwar et al. use certificates for DTLS authentication.The paper notes that Kerberos is not considered sustainable for IoT and AES is impractical for constrained devices; Panwar’s certificates replace DTLS pre-shared keys.Source: §V · p. 8
- Periera et al. combine Kerberos, CoAP, and RADIUS concepts for per-service access control, issuing tickets after user authentication.A server responds to a request only when it contains a valid ticket.Source: §V · p. 8
- Mahalle et al. use threshold cryptography for group authentication, reducing handshake overhead and resource use while resisting man-in-the-middle attacks.Source: §V · p. 8
- Santoso et al. use ECC for smart-home authentication, while Lee et al. propose XOR-based RFID authentication with encrypted passwords.Santoso’s process authenticates a mobile device to an IoT device and then the device to a gateway.Source: §V · pp. 8–9
- Park et al. propose permit codes for constrained-device authentication, while Zhao et al. combine SHA-1 and feature extraction in mutual authentication.The latter scheme is described as reducing computational and communication costs.Source: §V · p. 9
VI. CONCLUSION
The conclusion reviews security issues across the four-layer IoT architecture and highlights underexplored support-layer concerns. It also discusses legacy-solution limitations and surveys IoT authentication and access control mechanisms.
VI. CONCLUSION
- The paper studies security issues across the perceptual, network, support, and application layers, with particular attention to underexplored support-layer concerns.It also proposes brief countermeasures for different security challenges.Source: §VI · p. 9
- Traditional authentication methods are inadequate for IoT devices because of their resource constraints and the scale of M2M communication.Source: §VI · p. 9
- The paper surveys IoT-focused authentication and access control mechanisms to guide researchers toward areas for developing robust security solutions.Source: §VI · p. 9