REVIEW ARTICLE ON INTERNET OF THINGS
Ngendahimana Moise , Huang Li Can
Information Communication Engineering, School Of Informatics, Zhejiang Sci-Tech University, Hangzhou, China
ngendahimana_moise@hotmail.com
Abstract: The Internet of Things (IOT) is a communication network in which physical objects are connected to each other or to larger systems.This highly interconnected global network will enrich everyone’s life, increase business productivity, improve government efficiency and so many other opportunities. However, this new reality (IoT) built on the basis of Internet, contains new kind of challenges from a security and privacy perspective. Traditional security primitives cannot be directly applied to IoT technologies due to the different standards and communication stacks involved.This article presents an overview of IoT,network access protocols, security threats and some exiting countermeasures security solutions.
Keywords: Wireless Networks, IoT, Security Vulnerable, Smart Devices
INTRODUCTION
IoT is such a system that supplies connectivity and interactive communication for anything. Data of physical object are transmitted continuously through wired/wireless networks to platforms where it will be interpreted. Physical objects are capable of understanding complexity of the environment and reacting due to their feature of sense and communication. The revolutionary advance in this case is that physical objects begin to be deployed and adopted widely. In addition, most of them begin to work properly without human intervention [10].
INTERNET OF THINGS(IoT) STAGE
The four Stage IoT architecture which are:
STAGE 1: Sensors and actuators
STAGE 2: Internet gateways and Data Acquisition Systems
STAGE 3: Edge IT Data Processing
STAGE 4: Data-center and cloud
Figure 1 IoT Stages
Stage 1. Connected devices (sensors/actuators):The best thing about sensors is that it can convert the information it senses into a set of data which we can process further for analysis. Alternatively, it’s important to start including sensors in the early stages of IoT architecture framework to get information that we need to process.This process goes even further for Actuators. They can decide and take actions based on the information they gather automatically.
Example: Switching on a light when someone enters the room, or temperature regulation, etc.In this stage, we can make use of hardware and gain necessary insights for further analysis.
Stage 2. Sensor Data Acquisition:We understand at this stage that IoT deals with working with sensors and actuators in close proximity. Internet gateways and Data Acquisition Systems (DAS) plays an important role here as well. DAS aggregates output by connecting to the sensor network. On the other hand, Internet gateways work with Wi-Fi, wired LANs and perform further processing.This stage is important to process the information collected from the previous stage and compress it to the optimal size for further analysis. On top of this, timing conversion and structure conversion happens at this stage.Eventually, Stage 2 helps to make data aggregated and digitized.
Stage 3. The appearance of edge enabled IT systems:Here, in this stage, we transfer the data that we prepared in stage 2 and expose them to the IT world. To be precise, the edge IT system performs enhanced analytics here along with pre-processing. Particularly, machine learning and visual representation.Some additional processing may also happen here before the data is entered in data centers. Step 3 enables data to be captured at local sensors and at the same time transferring the data to the remote locations.
Stage 4: Analyzing, Visualizing and Storing Data:Here, in the last stage, data is processed in depth in the data centers. This stage requires skilled analytics IT professionals along with high-end applications. Data might also be gathered from other sources for execution. Once all the quality standards and requirements are met, the information is then brought back to the physical world for predictive analysis.
INTERNET OF THINGS(IoT) ADVANTAGES
- Comfort:Development activities are all focused on providing comforts to the people. What is comfort? Is coffee ready to be poured into your cup as soon as you wake up? A smart fridge that can order milk online whenever the pot is empty? A car that can drive by itself when activated on the night mode? Whatever the definition is, it all implies convenience in human lives. And with the Internet of Things, user can perform the work conveniently without complexity.
- Safety and Efficiency:Imagine working in a risky working environment, who would not like to avoid that? A smart device that can maximize safety in such places would be everyone’s choice. Efficiency is another factor which encourages the use of Internet of Things for commercial as well as industrial purposes.For example, if the monotonous tasks can be automated such as in assembly lines, the efficiency of the system will increase resulting in higher productivity, and this will also drive higher worker satisfaction which will, in turn, increase the profit margins.
- Assisted Decision Making:It will be easier to make better decisions when there are various insights provided by reliable data from different angles. The trends from the empirical data can be analyzed more properly with the help of the Internet of Things, and strong premises achieved, and assumptions would minimize– a data-backed analysis into business insight. No decision is difficult now! (this excludes your relationship decisions, but wait, everyone would love that! Come on, think-tanks, get us a device for that!!)
- Reduced Time and Increased Revenues:Internet of Things provides improved response time, thus reducing the time taken to do any job. The baseline is that with reduced time and increased efficiency, the revenue collection maximized with the introduction of IoT.It will also help create new business ideas and provide the ‘X Factor’ to the business, which will help you gain a strategic advancement over the competitors. It seems every road from IoT leads to increased revenue.
INTERNET OF THINGS(IoT) PROTOCOLS FOR ACCESS NETWORKS
IoT devices communication and network access protocols are many and each system use different access protocols depending on distance,message latency,user numbers,network system and so on and in this article we will discuss some of these protocols
- Bluetooth:Bluetooth is designed to support a wide range of achievable ranges between two devices, providing developers tremendous flexibility to create wireless solutions that best meet the needs of their target use case.it uses the 2.4 GHz ISM spectrum band (2400 to 2483.5 MHz), which enables a good balance between range and throughput.Bluetooth specifies that devices must be able to achieve a minimum receiver sensitivity of -70 dBm to -82 dBm, depending on the PHY used.Bluetooth supports transmit powers from -20 dBm (0.01 mW) to +20 dBm (100 mW).Bluetooth devices typically achieve an antenna gain in the range of –10 dBi to +10 dBi. Standard:Bluetooth 4.2 core specification;Frequency:4GHz (ISM);Range: 50-150m (Smart/BLE);Data Rates: 1Mbps (Smart/BLE)
- Zigbee: Zigbee is an IEEE 802.15.4-based specification for a suite of high-level communication protocols used to create personal area networks with small, low-power digital radios, such as for home automation, medical device data collection, and other low-power low-bandwidth needs, designed for small scale projects which need wireless connection.Standard: ZigBee 3.0 based on IEEE802.15.4;Frequency:4GHz;Range: 10-100m;Data Rates: 250kbps.
- Z-Wave: Z-Wave is a low-power RF communications technology that is primarily designed for home automation for products such as lamp controllers and sensors among many others. Optimized for reliable and low-latency communication of small data packets with data rates up to 100kbit/s, it operates in the sub-1GHz band and is impervious to interference from WiFi and other wireless technologies in the 2.4-GHz range such as Bluetooth or ZigBee. It supports full mesh networks without the need for a coordinator node and is very scalable, enabling control of up to 232 devices. Z-Wave uses a simpler protocol than some others, which can enable faster and simpler development, but the only maker of chips is Sigma Designs compared to multiple sources for other wireless technologies such as ZigBee and others. Standard:Z-Wave Alliance ZAD12837 / ITU-T G.9959;Frequency: 900MHz (ISM);Range: 30m;Data Rates:6/40/100kbit/s.
- 6LowPAN: 6LoWPAN is an acronym of IPv6 over Low -Power Wireless Personal Area Networks;The 6LoWPAN concept originated from the idea that "the Internet Protocol could and should be applied even to the smallest devices," and that low-power devices with limited processing capabilities should be able to participate in the Internet of Things.6LowPAN is a network protocol that defines encapsulation and header compression mechanisms. The standard has the freedom of frequency band and physical layer and can also be used across multiple communications platforms, including Ethernet, Wi-Fi, 802.15.4 and sub-1GHz ISM. Standard:RFC6282;Frequency: (adapted and used over a variety of other networking media including Bluetooth Smart (2.4GHz) or ZigBee or low-power RF (sub-1GHz)
- Thread:Thread is an IPv6-based, low-power mesh networking technology for IoT products, intended to be secure and future-proof. The Thread protocol specification is available at no cost;Thread is a low-power wireless mesh networking protocol, based on the universally-supported Internet Protocol (IP), and built using open and proven standards;Thread enables device-to-device and device-to-cloud communications and reliably connects hundreds (or thousands) of products and includes mandatory security features;Thread networks have no single point of failure, can self-heal and reconfigure when a device is added or removed, and are simple to setup and use;Thread is based on the broadly supported IEEE 802.15.4 radio standard, which is designed from the ground up for extremely low power consumption and low latency.;Thread was designed with the Internet’s proven, open standards to create an Internet Protocol version 6 (IPv6) based mesh network, with 6LoWPAN as its Standard: Thread, based on IEEE802.15.4 and 6LowPAN; Frequency: 2.4GHz (ISM).
- WiFi:Wireless Fidelity,wireless network uses radio waves; Standard:Based on 802.11n (most common usage in homes today);Frequencies:4GHz and 5GHz bands;Range: Approximately 50m;Data Rates: 600 Mbps maximum, but 150-200Mbps is more typical, depending on channel frequency used and number of antennas (latest 802.11-ac standard should offer 500Mbps to 1Gbps).
- Cellular:A cellular network or mobile network is a communication network where the last link is wireless. The network is distributed over land areas called " cells ", each served by at least one fixed-location transceiver , but more normally, three cell sites or base transceiver stations;Any IoT application that requires operation over longer distances can take advantage of GSM/3G/4G/5G cellular communication capabilities;Standard:GSM/GPRS/EDGE (2G), UMTS/HSPA (3G), LTE (4G), Frequencies: 900/1800/1900/2100MHz, Range: 35km max for GSM; 200km max for HSPA, Data Rates (typical download): 35-170kps (GPRS), 120-384kbps (EDGE), 384Kbps-2Mbps (UMTS), 600kbps-10Mbps (HSPA), 3-10Mbps (LTE).
- NFC:NFC(Near Field Communication) is a technology that enables simple and safe two-way interactions between electronic devices,one of which is usually a portable device such as a smartphone, allowing consumers to perform contactless payment transactions, access digital content and connect electronic devices. Essentially it extends the capability of contactless card technology and enables devices to share information at a distance that is less than 4cm. Standard:ISO/IEC 18000-3,Frequency:56MHz (ISM),Range: 10cm,Data Rates: 100–420kbps
- Sigfox: Sigfox is a LPWAn communication technology and network dedicated to IoT and the LPWAn caracteristics : communicating Low Power (25mW) and Wide Area (60km)its modulation is DBPSK for Differential Binary Phase Shift-Keying; The idea for Sigfox is that for many M2M applications that run on a small battery and only require low levels of data transfer, then WiFi’s range is too short while cellular is too expensive and also consumes too much power. Sigfox uses a technology called Ultra Narrow Band (UNB) and is only designed to handle low data-transfer speeds of 10 to 1,000 bits per second. It consumes only 50 microwatts compared to 5000 microwatts for cellular communication, or can deliver a typical stand-by time 20 years with a 2.5Ah battery while it is only 0.2 years for Standard: Sigfox; Frequency: 900MHz ; Range: 30-50km (rural environments), 3-10km (urban environments) Data Rates: 10-1000bps.
- Neul: Neul is the Gaelic world meaning 'cloud' Neul leverages very small slices of the TV White Space spectrum to deliver high scalability, high coverage, low power and low-cost wireless networks. Systems are based on the Iceni chip, which communicates using the white space radio to access the high-quality UHF spectrum, now available due to the analogue to digital TV transition.Standard:Neul; Frequency: 900MHz (ISM), 458MHz (UK), 470-790MHz (White Space); Range: 10km; Data Rates: Few bps up to 100kbps.
- LoRaWAN: The LoRaWAN® specification is a Low Power, Wide Area (LPWA) networking protocol designed to wirelessly connect battery operated ‘things’ to the internet in regional, national or global networks, and targets key Internet of Things (IoT) requirements such as bi-directional communication, end-to-end security, mobility and localization Standard: LoRaWAN; Frequency: Various; Range: 2-5km (urban environment), 15km (suburban environment); Data Rates: 0.3-50 kbps.
INTERNET OF THINGS(IoT) THREATS
Threats |
security vulnerabilities |
Countermeasures(Ensuring...) |
Insecure Web Interface |
i. Account Enumeration
ii. Weak Default Credentials
iii. Credentials Exposed in Network Traffic
iv. Cross-site scr ipting (XSS)
v. SOL-Injection
vi. Session Management
vii. Weak Account Lockout Settings. |
i. Default passwords and ideally default user-names to be changed during initial setup
ii. password recovery mechanisms are robust and do not supply an attacker with information indicating a valid account
iii. web interface is not susceptible to XSS, SQLi or CSRF
iv. Do not expose credentials in internal or external network traffic
v. weak passwords are not allowed
vi. account lockout after 3-5 failed login attempts. |
Insufficient Authentication/Authorization |
i. Lack of Password Complexity
ii. Poorly Protected Credentials
iii. Lack of Two Factor Authentication
iv. Insecure Password Recovery
v. Privilege Escalation
vi. Lack of Role Based Access Control. |
i. The strong passwords are required
ii. granular access control is in place
iii. credentials are properly protected
iv. Try implement two factor authentication
v. Secure password recovery mechanisms
vi. re-authentication is required for sensitive features
vii. configuring password controls options availability. |
Insecure Network Services |
i. Vulnerable Services
ii. Buffer Overflow
iii. Open Ports via UPnP
iv. Exploitable UDP Services
v. Denial-of-Service
vi. DoS via Network Device Fuzzing. |
i. only necessary ports are exposed and available
ii. services are not vulnerable to buffer overflow and fuzzing attacks
iii. services are not vulnerable to DoS attacks
iv. Do not expose network ports or services to the internet via UPnP for example. |
Lack of Transport Encryption
|
i. Unencrypted Services via the Internet
ii. Unencrypted Services via the Local Network
iii. Poorly Implemented SSL/TLS
iv. Misconfigured SSL/TLS. |
i. Encrypt data using protocols such as SSL and TLS while transiting networks
ii. Use other industry standard encryption techniques to protect data transfer if SSL or TLS are unavailable
iii. Use only accepted encryption standards and avoid using proprietary encryption protocols. |
Privacy Concerns |
i. Collection of Unnecessary Personal Information. |
i. Collect only data critical to the functionality of the device
ii. try not to collect sensitive data)
iii. Collect DE-identified or anonymized data
iv. Collect data properly protected with encryption
v. properly protect personal information of the device and all of its components
vi. Ensuring only authorized individuals have access to collected personal information
vii. Ensuring that retention limits are set for collected data
viii. Provide end-users some "Notice and Choice" if data collected is more than what would be expected from the product.
|
Insecure Cloud Interface
|
i. Account Enumeration
ii. No Account Lockout
iii. Credentials Exposed in Network Traffic. |
i. Change default passwords and ideally default user-names during initial setup
ii. Disallow user accounts to be enumerated using functionality such as password reset mechanisms
iii. account lockout after 3- 5 failed login attempts
iv. Ensuring the cloud-based web interface is not susceptible to XSS, SQLi or CSRF
v. Do not expose credentials over the internet
vi. Implement two factor authentication. |
Insecure Mobile Interface
|
i. Account Enumeration
ii. No Account Lockout
iii. Credentials Exposed in Network Traffic. |
i. Change default passwords and ideally default user-names during initial setup
ii. Disallow user accounts to be enumerated using functionality such as password reset mechanisms
iii. account lockout after an 3-5 failed login attempts
iv. Do not expose credentials while connected to wireless networks
v. Try implement two factor authentication. |
Insufficient Security Configuration ability
|
i. Lack of Granular Permission Model
ii. Lack of Password Security Options
iii. No Security Monitoring
iv. No Security Logging. |
i. Be able to separate normal users from administrative users
ii. Be able to encrypt data at rest or in transit
iii. Be able to force strong password policies
iv. Be able to enable logging of security events
v. Be able to notify end users of security events. |
Insecure Software/ Firmware |
i. Encryption Not Used to Fetch Updates
ii. Update File not Encrypted
iii. Update Not Verified before Upload
iv. Firmware Contains Sensitive Information
v. No Obvious Update Functionality. |
i. Ensuring the device has the ability to update
ii. Ensuring the update file is encrypted using accepted encryption methods
iii. Ensuring the update file is transmitted via an encrypted connection
iv. the update file should not expose sensitive data
v. sign and verify update before the update can be uploaded and applied
vi. secure the update server. |
Poor Physical Security |
i. Access to Software via USB Ports
ii. Removal of Storage Media. |
i. Ensuring data storage medium cannot be easily removed
ii. Ensuring stored data is encrypted at rest
iii. Ensuring USB ports or other external ports cannot be used to maliciously access the device
iv. Ensuring device cannot be easily disassembled
v. Ensuring only required external ports such as USB are required for the product to function
vi. Ensuring the product has the ability to limit administrative capabilities. |
CONCLUSION
The Internet of Things (IoT) is a network of physical objects or people called "things" that are embedded with software, electronics, network, and sensors which allows these objects to collect and exchange data.Four Key components of IoT framework are Sensors/Devices,Connectivity,Data Processing and User Interface where different devices can communicate each through various network access protocols for example WiFi,Bluetooth,Cellular,Neul,LoRaWAN,Sigfox,NFC and so many other protocol discussed in the article. Moreover we also seen different Security, Privacy, Complexity and Compliance as key challenges of IoT and stated what to do about such threats as solution.
REFERENCES
[1] Madakam, S., Ramaswamy, R. and Tripathi, S. (2015) Internet of Things (IoT): A Literature Review. Journal of Computer and Communications, 3, 164-173. https://doi.org/10.4236/jcc.2015.35021
[2]https://internetofthings.net/internet-of-things-advantages-disadvantages/
[3]IoT protocols https://www.rs-online.com/designspark/eleven-internet-of-things-iot-protocols-you-need-to-know-about
[4] Bluetooth https://www.bluetooth.com/bluetooth-technology/range/
[5] Thread protocol https://www.threadgroup.org/what-Is-thread
[6] LoRaWAN introduction https://lora-alliance.org/about-lorawan
[7] LoRaWAN security white-paper https://lora-alliance.org/sites/default/files/2019-05/lorawan_security_whitepaper.pdf
[8] IoT Threats and countermeasures https://www.cso.com.au/article/575407/internet-things-iot-threats-countermeasures/
[9] Engin Leloglu.(2017)A Review of Security Concerns in Internet of Things. R&D Department, Vestel Electronic Inc., Manisa, Turkey,2017. http://dx.doi.org/10.4236/jcc.2017.51010
[10] Meenakshi Sharma. Stages of IoT architecture https://www.marlabs.com/blog-stages-of-iot-architecture/
> Computer and Education