Internet_of_Things_Security_Principles_Application
Internet_of_Things_Security_Principles_Application
B. B. Gupta
Megha Quamara
CRC Press
Taylor & Francis Group
6000 Broken Sound Parkway NW, Suite 300
Boca Raton, FL 33487-2742
This book contains information obtained from authentic and highly regarded sources. Reason
able efforts have been made to publish reliable data and information, but the author and publisher
cannot assume responsibility for the validity of all materials or the consequences of their use. The
authors and publishers have attempted to trace the copyright holders of all material reproduced in
this publication and apologize to copyright holders if permission to publish in this form has not
been obtained. If any copyright material has not been acknowledged please write and let us know
so we may rectify in any future reprint.
Except as permitted under U.S. Copyright Law, no part of this book may be reprinted, reproduced,
transmitted, or utilized in any form by any electronic, mechanical, or other means, now known
or hereafter invented, including photocopying, microfilming, and recording, or in any informa
tion storage or retrieval system, without written permission from the publishers.
For permission to photocopy or use material electronically from this work, please access www.
copyright.com (http://www.copyright.com/) or contact the Copyright Clearance Center, Inc.
(CCC), 222 Rosewood Drive, Danvers, MA 01923, 978-750-8400. CCC is a not-for-profit organiza
tion that provides licenses and registration for a variety of users. For organizations that have been
granted a photocopy license by the CCC, a separate system of payment has been arranged.
B. B. Gupta
Megha Quamara
Contents
List of Figures xi
List of Tables xiii
Preface xv
Acknowledgments xvii
Authors xix
vii
viii Contents
4 Challenges in IoT 39
4.1 Introduction 39
4.2 Challenges Associated with IoT Architecture 39
4.3 Challenges Associated with Entities 43
4.4 Technology-Oriented Challenges 44
4.5 Challenges Associated with Features 45
4.6 Challenges Associated with Development Practices 47
4.7 Summary 48
References 49
Index 91
List of figures
xi
List of tables
xiii
Preface
xv
xvi Preface
Many people have contributed greatly to this book on the Internet of Things
Security: Principles, Applications, Attacks, and Countermeasures. The authors
would like to acknowledge all of them for their valuable help and generous
ideas in improving the quality of this book. With our feelings of gratitude,
we would like to introduce them in turn. The first mention is the staff of both
CRC Press and Taylor & Francis Group for their constant encouragement,
continuous assistance, and untiring support. Without their technical support,
this book would not be completed. The next mention is the authors’ families
for being the source of continuous love, unconditional support, and prayers
not only for this work, but throughout our lives. Last, but far from least, we
express our heartfelt thanks to the Almighty for bestowing over us the courage
to face the complexities of life and complete this work.
B. B. Gupta
Megha Quamara
xvii
Authors
xix
xx Authors
1.1 INTRODUCTION
The Internet of Things is the idea of seamless integration of physical devices
with the Internet that are equipped with sensors, processors, and communi
cation components facilitating sensing, computing, and communication capa
bilities for perceiving, processing, and exchanging information through the
Internet with limited or no human intervention. These devices may include
security systems, vehicles, home appliances, electronic gadgets, people, ani
mals, and so forth. User interface is provided for their installation and for pro
viding commands to these devices to control their functionality [1–4]. These
devices share data with one another, or they are sent to the local processing
units or remote cloud servers for processing.
From its very beginning, the idea of the IoT is transforming various
aspects of our everyday lives and has proven to be a revolutionary technologi
cal and networking paradigm. Various industries are adopting the concept of
the IoT in order to function in a smooth and more efficient manner, with a
better understanding of how to deliver enhanced services to the customers and
1
2 Internet of Things Security
of traditional enterprises into digital and smart businesses. It will also facili
tate new business models that would improve the efficiency and employee-
customer engagement.
Recommendation ITU-T Y.2060 defines the IoT as a global infrastructure
for the information society, which enables advanced and high-end services
through inter-connection of physical and virtual things based on existing and
progressing information and communication technologies that support inter-
operability [12]. Physical things are a part of the physical world, and these can
be sensed, actuated, and connected. These can interact with each other via
gateway, without gateway, or directly. On the other hand, virtual things (e.g.,
application software, multi-media content) are a part of the information world,
and these can be stored, processed, and accessed remotely. Fundamental char
acteristics of the IoT include inter-connectivity, heterogeneity, dynamic state
changes, and scalability.
Cisco defines the IoT as a network of sensors that are attached to the
objects and communication devices and provide data that can be analyzed and
utilized for initiating automated actions [13]. Decision-making is dependent on
when the objects can sense and when they can communicate. The IoT has been
designated as a crucial component for business growth in terms of deploy
ing IoT-enabled components or business strategies. It will speed up time-to
market, optimize asset utilization, improve supply-chain efficiency, optimize
asset utilization, improve product development, and implement predictive
maintenance.
1.3 EVOLUTION
Since its invention, the IoT has paved an eventful journey and has now become
a powerful driver for the growth of businesses. Although the IoT is rapidly
progressing, there is a need to look at the development of key fundamentals
associated with the evolutionary process of the IoT and to understand in a bet
ter way how it entered into the current technological mainstream.
The concept of Internet connectivity began proliferating in the early
1990s when consumer markets and enterprises were in the growing stage.
Kevin Ashton, who was the co-founder of Auto-ID Center at MIT, coined
the term “Internet of Things” in the year 1999. The core idea was to identify
and track the products more accurately using Radio Frequency Identification.
Since then, numerous technologies have come into existence to support the
growth of the IoT. Table 1.1 summarizes the milestones achieved during this
evolutionary process.
4 Internet of Things Security
YEAR EVENTS
1999 Kevin Ashton, executive director and co-founder of Auto-ID
Center, coined the term Internet of Things (IoT); First
Machine-to-Machine (M2M) protocol Message Queuing
Telemetry Transport (MQTT) was developed.
2000 LG, a South Korean multi-national electronics company, announced
its first Internet-connected refrigerator plan named Internet Digital
DIOS, which used Local Area Network (LAN) port for Internet
connectivity; idea of cloud computing came into existence.
2001 United States-based National Science Foundation established an
Industry-University Cooperative Research Centre (IUCRC) for
using IoT-based predictive analytics technology.
2002 Collaborative development of Near Field Communication
Technology (NFCT) was announced by Philips and Sony.
2003–2004 Mainstream publications including the Guardian, the Boston
Globe, and Scientific American mentioned the term the IoT.
2005 International Telecommunications Union (ITU) published its first
report on the IoT.
2006 A Bluetooth smart technology wire was introduced by Nokia.
2007 European Research Cluster on IoT (IERC), a European Union based
organization, was founded.
2008 First European IoT conference was organized; Internet-connected
devices exceeded the number of people worldwide.
2009 Google started self-driving cars tests.
2010 ioBridge, an IoT company, developed the first online tide
monitoring system.
2011 IoT Global Standards Initiative (GSI) was created; the term Industry
4.0 was revived.
2012 IPv6 was launched worldwide.
2013 Internet.org, a partnership between Nokia, Samsung, Ericsson,
MediaTek, Opera Software, Qualcomm, and social networking
service provider Facebook, was launched.
2014 IoT Incubation Council was launched.
2015 Internet of Things Security Foundation (IoTSF) was launched.
2016 DDoS attacks powered by IoT devices were conducted using Mirai
malware.
2017 IoT Terms Database was created by IoT One, which is a reliable source
containing information about the Industrial Internet of Things (IIoT).
2018 California became the first state to pass IoT cybersecurity law.
2019 Year for the 4th annual IoT Global Innovation Forum.
1 • Internet of Things – Evolution, Statistics, and Forecasts 5
35
30
Share of Attacks (in %)
30
25
20 19
17
15
15
11
10 8
5
0
$5m+ $2.5m–$4.9m $1m–$2.9m $500k–$999k $100k–$499k Less than $100k
Amount (in US dollars)
FIGURE 1.1 Global financial damages to businesses due to cyber attacks (as of
April 2018).
6 Internet of Things Security
2500
2000
Amount (in $ million)
1500
1000
500
0
2016 2017 2018 2019 2020 2021
Year
Endpoint Security Gateway Security Professional Services
more and enhanced security solutions. Although the exact influence of these
predictions is accompanied with several questions, it will certainly help in
shaping the industrial evolutionary process in the domain [27].
Gartner predicted that newer threats would come into the picture by the
year 2021 with hackers finding novel ways for attacking IoT systems and
protocols raising a requirement of hardware and software amendments [28].
It is also predicted that the investment in IoT endpoint security solutions
would rise from $240 in the year 2016 to $631 million in the year 2021,
accompanied with a CAGR growth of 21.38% [29]. Gateway security spend-
ing will reach from $102 in 2016 to $415 in 2021. Similarly, professional
service securities will see an investment growth from $570 in 2016 to $2071
in 2021. Figure 1.2 shows the IoT security-spending forecast. Worldwide
IoT security spending will reach $3.1 billion in the year 2021, with a CAGR
growth of 27.87% from the year 2016 [30]. Size of the IoT security market
from the year 2016 to 2025 across the globe is expected to reach $30.9 bil-
lion from $7.28 billion [31].
The smart home security segment is expected to achieve a revenue of
$28.19 billion by the year 2023 across the globe [32]. Many hardware manu-
facturers including Dell, Cisco, and HPE, are developing specialized infra-
structure for end-point security for preventing loss of data, ensuring threat
protection and access control, enforcing right privileges, and so forth.
8 Internet of Things Security