This Document Briefly summarizes the Security and Privacy Concern Evaluation of Internet of Things (IoT)’s Three Domain Architecture. The Security implementation challenges faced
by IoT devices are addressed along with newly Added Requirement for these devices. The Architecture which we will be using throughout our analysis is explained so as to a novice
user. We will summarize the possible attacks and countermeasures for each and every domain followed by a developer friendly checklist to be followed for security.
Every wondered how to make your code physically interact with things in the real world? Got a home automation project in mind? In this presentation we will cover:
o) How to get started with Raspberry Pi and C#
o) The numerous sensors and actuators you can control
o) How to navigate basic electronics
o) Different interfaces and how to program them
o) Demonstrations of devices at work
o) Azure IoT Hub to control your code from the cloud and receive live inputs from your device in a Blazor application
John Staveley presented on using satellite communications for telemetry data collection. He outlined objectives of capturing temperature and counter data at regular intervals and maximizing receipt back to the data center. The presentation covered calculating satellite pass predictions, hardware and software setup using an Arduino, transmitting payloads to the Kineis satellites, processing the incoming data with Azure functions, and analyzing reception rates with different transmission scenarios. Future developments discussed extracting more data from messages and receiving messages from satellites.
Every wondered how to make your code physically interact with things in the real world? Got a home automation project in mind? In this presentation we will cover:
o) How to get started with Raspberry Pi and C#
o) The numerous sensors and actuators you can control
o) How to navigate basic electronics
o) Different interfaces and how to program them
o) Demonstrations of devices at work
o) Azure IoT Hub to control your code from the cloud
In this presentation John will show how Azure Devops can be used to automate the deployment and security checks of a website in the Azure cloud. In this presentation we will go through how a variety of tools are used to gain security insights into your code and deployed environment. We will explore how this relates to the pull security left philosophy from DevSecOps. After the presentation you will have gained a good insight into all the tools you can use to improve the security of your deployed code base.
Shameful secrets of proprietary network protocolsSlawomir Jasek
There is a big bunch of tools offering HTTP/SSL traffic interception. However, when it comes to penetration tests of specialized embedded software or thick clients, we often encounter proprietary protocols with no documentation at all. Binary TCP connections, unlike anything, impossible to be adapted by a well-known local proxy. Without disassembling the protocol, pentesting the server backend is very limited. Though, based on our experience, it very often hides a shameful secret - completely unsecured mechanisms breaking all secure coding practices.
To demonstrate, we will show a few case-studies - most interesting examples from real-life industry software, which in our opinion are a quintessence of "security by obscurity". We will challenge the security of proprietary protocols in pull printing solutions, FOREX trading software, remote desktops and home automation technologies.
This document discusses using a hierarchical certificate authority with elliptic curve cryptography to improve security in ZigBee networks. It begins with an overview of the Internet of Things and wireless sensor networks. It then discusses ZigBee protocols and vulnerabilities in key distribution and management. The document proposes a solution using a hierarchical certificate authority to calculate, store, and distribute certificates with elliptic curve cryptography to nodes in the network. This is intended to provide a more secure, reliable, and scalable approach for authentication in 802.15.4 networks.
This document proposes using certificate authorities and elliptic curve cryptography to improve security in Zigbee wireless sensor networks. It summarizes Zigbee vulnerabilities like insecure key distribution and lack of key revocation. It then describes a proposed solution where a key distribution center uses ECC to establish session keys between nodes, improving security over the standard Zigbee approach. Finally, it recommends an innovative hybrid solution combining certificate authorities and ECC to further reduce vulnerabilities when nodes enter or exit large-scale IoT networks.
Every wondered how to make your code physically interact with things in the real world? Got a home automation project in mind? In this presentation we will cover:
o) How to get started with Raspberry Pi and C#
o) The numerous sensors and actuators you can control
o) How to navigate basic electronics
o) Different interfaces and how to program them
o) Demonstrations of devices at work
o) Azure IoT Hub to control your code from the cloud and receive live inputs from your device in a Blazor application
John Staveley presented on using satellite communications for telemetry data collection. He outlined objectives of capturing temperature and counter data at regular intervals and maximizing receipt back to the data center. The presentation covered calculating satellite pass predictions, hardware and software setup using an Arduino, transmitting payloads to the Kineis satellites, processing the incoming data with Azure functions, and analyzing reception rates with different transmission scenarios. Future developments discussed extracting more data from messages and receiving messages from satellites.
Every wondered how to make your code physically interact with things in the real world? Got a home automation project in mind? In this presentation we will cover:
o) How to get started with Raspberry Pi and C#
o) The numerous sensors and actuators you can control
o) How to navigate basic electronics
o) Different interfaces and how to program them
o) Demonstrations of devices at work
o) Azure IoT Hub to control your code from the cloud
In this presentation John will show how Azure Devops can be used to automate the deployment and security checks of a website in the Azure cloud. In this presentation we will go through how a variety of tools are used to gain security insights into your code and deployed environment. We will explore how this relates to the pull security left philosophy from DevSecOps. After the presentation you will have gained a good insight into all the tools you can use to improve the security of your deployed code base.
Shameful secrets of proprietary network protocolsSlawomir Jasek
There is a big bunch of tools offering HTTP/SSL traffic interception. However, when it comes to penetration tests of specialized embedded software or thick clients, we often encounter proprietary protocols with no documentation at all. Binary TCP connections, unlike anything, impossible to be adapted by a well-known local proxy. Without disassembling the protocol, pentesting the server backend is very limited. Though, based on our experience, it very often hides a shameful secret - completely unsecured mechanisms breaking all secure coding practices.
To demonstrate, we will show a few case-studies - most interesting examples from real-life industry software, which in our opinion are a quintessence of "security by obscurity". We will challenge the security of proprietary protocols in pull printing solutions, FOREX trading software, remote desktops and home automation technologies.
This document discusses using a hierarchical certificate authority with elliptic curve cryptography to improve security in ZigBee networks. It begins with an overview of the Internet of Things and wireless sensor networks. It then discusses ZigBee protocols and vulnerabilities in key distribution and management. The document proposes a solution using a hierarchical certificate authority to calculate, store, and distribute certificates with elliptic curve cryptography to nodes in the network. This is intended to provide a more secure, reliable, and scalable approach for authentication in 802.15.4 networks.
This document proposes using certificate authorities and elliptic curve cryptography to improve security in Zigbee wireless sensor networks. It summarizes Zigbee vulnerabilities like insecure key distribution and lack of key revocation. It then describes a proposed solution where a key distribution center uses ECC to establish session keys between nodes, improving security over the standard Zigbee approach. Finally, it recommends an innovative hybrid solution combining certificate authorities and ECC to further reduce vulnerabilities when nodes enter or exit large-scale IoT networks.
More and more IoT vulnerabilities are found and showcased at security events. From connected thermostats to power plants!
Insecurity became the favorite subject for creating catchy IoT headlines: "Connected killer toaster", "Fridges changed into spamming machines","Privacy concerns around connected home".
We will explore the five challenges one has to face when building a secure IoT solution:
- hardware security: how to avoid rogue firmwares and keep your security keys safe?
- upgrade strategy: you can't secure what you can't update!
- secure transport: no security without secure transports.
- security credentials distribution: how to distribute security keys to a fleet with millions of devices?
- cloud vulnerability mitigation, how to keep your fleet of devices safe from the next Heartbleed?
Current enterprise infrastructure provides solutions for handling application security but are they really matching the IoT challenge? Could running a PKI client on a low power wireless sensor node be an option?
Despite those difficulties, we will show how a modern IoT device management standard like Lightweight M2M with DTLS is the way for building a secur-first IoT solutions. It provides a solution for upgrading your device, distributing your security keys and comes with a full range of cryptography cipher suites, from PSK algorithm for very constrained devices to high level of security using X.509 certificates.
Furthermore for adding security to your solution we will present you ready to use opensource libraries for implementing secure IoT servers and devices. The way for quickly releasing your next catchy connected product.!
Ultimately we will showcase Wakaama and Leshan, the Eclipse IoT Lightweight M2M implementation maybe your next best friend in the troubled water of Internet-Of-Things security!
Hacktivity 2016: The real risks of the IoT security-nightmare: Hacking IP cam...Zoltan Balazs
IoT security poses serious risks due to vulnerabilities in many IoT devices that are never patched by manufacturers. Common excuses for the poor security of IoT devices are shown to be invalid, as attacks can bypass passwords, networks, and firewalls using techniques like UPnP, IPv6, WebRTC, and DNS rebinding. Lessons for home users include disconnecting devices when not in use, changing passwords, filtering connections and protocols, and monitoring networks. Lessons for vendors are to implement secure development practices, automatic updates, and optional cloud connections. Governments should regulate vendors to protect users and incentivize more secure practices.
DEF CON 23: Internet of Things: Hacking 14 DevicesSynack
DEF CON 23
Internet of Things: Hacking 14 Devices
It is easy to find poorly designed devices with poor security, but how do the market leading devices stack up? Are they more secure than a Linux-powered rifle? This presentation documents our effort to assess the state of security of top selling Internet of Things Devices.
We procured 14 of the leading “connected home” IoT devices and tore them down, all the way from software to hardware and compared their relative security. This talk will demonstrate techniques useful for assessing any IoT device, while showing how they were applied across a wide range of devices.
Attend for stories of device rooting, SSL interception, firmware unpacking, mobile app vulnerabilities and more. Stay to find out why your favorite new gadget might just be a backdoor into your home. If you own (or are considering buying) one of the following devices, come and find out how secure it actually is!
Devices:
Dlink DCS-2132L
Dropcam Pro
Foscam FI9826W
Simplicam
Withings Baby Monitor
Ecobee
Hive
Honeywell Lyric
Nest Thermostat
Nest Protect
Control4 HC-250
Lowes Iris
Revolv
SmartThings
Samsung Smart Refrigerator (model RF28HMELBSR)
Samsung LED Smart TV (model UN32J5205AFXZA)
REASON:
The best thing about this talk is that it covers a large number of devices, all devices which are among the industry leaders for their category.
While we have published the high level findings from assessing these devices, this talk will include full technical details on how to attack each of these devices, and full tech details on any of the vulns which we found. Those details have not yet been released, and will be of interest to anyone who owns or wants to hack any of these devices.
Enabling Data Protection through PKI encryption in IoT m-Health DevicesCharalampos Doukas
Short presentation about a gateway-based solution for medical data encryption and the Internet of Things. Paper presented at 12th IEEE International Conference on BioInformatics and BioEngineering
IoT security is a nightmare. But what is the real risk?Zoltan Balazs
1) IoT security is a major issue as many devices have poor security and will never receive patches. This leaves them vulnerable to attacks over the internet or through home networks.
2) There are many risks even for devices that are behind routers or firewalls due to issues like UPnP, IPv6, cloud connections, and protocol tunneling that can bypass network protections.
3) Home users should take steps like disconnecting devices when not in use, changing passwords, filtering incoming connections, and monitoring their network to improve their security, but there are no complete solutions given flaws in IoT design and updates.
PLNOG15: Simplifying network deployment using Autonomic networking and Plug-a...PROIDEA
1) Autonomic networking and plug-and-play technologies simplify network deployment by automating configuration tasks and enabling zero-touch provisioning of devices.
2) They provide secure bootstrap and join processes for devices using techniques like the Autonomic Control Plane and domain certificates to securely establish management connectivity without manual configuration.
3) Combining autonomic networking with trusted boot and device attestation establishes a foundation for secure-by-default networks that automatically secure devices and the control plane when devices join the network.
This document provides an overview of Azure Sphere, a new solution from Microsoft for creating highly secured, connected microcontroller (MCU) devices. It discusses the opportunity and risks of IoT, introduces the seven properties of highly secured devices, and describes the key components of Azure Sphere including the secured MCU, secured operating system, and secured cloud services. It also covers the Azure Sphere developer tools and SDK, partner ecosystem, and provides a recap of the overall solution.
Slide deck for talk at IETF#92 (Dallas, March 2015) at the IETF Light-Weight Implementation Guidance (lwig) working group about the performance of cryptographic algorithms on ARM processors.
Are you ready for Microsoft Azure Sphere?Mirco Vanini
Azure Sphere is Microsoft's solution for highly securing IoT devices. It includes Azure Sphere certified chips, the Azure Sphere operating system, and the Azure Sphere Security Service. Together, these provide devices with 10 years of ongoing security updates directly from Microsoft. Azure Sphere aims to empower organizations to securely connect devices and build new IoT solutions with built-in security through its end-to-end platform. The current Azure Sphere development kit uses the MT3620 chip and provides tools to simplify and streamline IoT development.
This document provides a deep dive into Brillo and Weave, including:
1. The code structure and hardware access layer used in Brillo.
2. Code labs that help teach Brillo and Weave development through examples.
3. Details on logging, monitoring, and analytics capabilities in Brillo.
ACSAC2020 "Return-Oriented IoT" by Kuniyasu SuzakiKuniyasu Suzaki
Side of "Reboot-Oriented IoT: Life Cycle Management in Trusted Execution Environment for Disposable IoT devices" ACSAC (Annual Computer Security Applications Conference) 2020
Slides prepared for the worksop at the Macao Polytechnic Institute on 5th April, 2016.
Please get examples from the following URL:
https://github.com/kotobuki/esp8266_examples
This document summarizes information about Zigbee wireless communication protocols. It begins by defining IoT and OT, then discusses wireless communication protocols commonly used in IoT like BLE, Zwave, Zigbee, 6LoWPAN, RFID and NFC. It provides details about Zigbee such as its support for mesh networks, low power usage, security features and typical use cases. The document also lists known vulnerabilities in Zigbee implementations and tools that can be used for Zigbee pentesting like KillerBee and hardware devices. It concludes with suggestions for developing custom vulnerable IoT devices and references for further reading.
Today connected devices are everywhere, where we expect a massive growth over the upcoming years. What are connected devices (IOT)? It connects people to machines, machines to machines and shares data both people and machines create. However, why should you care about security?
This presentation walks you through why connected devices (IOT) are being targeted, what typically goes wrong during development making these devices vulnerable to attacks and whats next...
Azure Sphere is a new solution from Microsoft that provides highly secured, connected microcontroller units (MCUs). It consists of specialized MCU chips secured by Microsoft technology, a secured operating system, and cloud security services. The solution aims to address security issues that have affected IoTs by implementing seven key properties for security, including hardware root of trust, small trusted computing base, and failure reporting. It offers long-term security updates through 2028. Microsoft is working with partners to implement Azure Sphere's security technology into their chips to help manufacturers create secure, connected devices.
Authorization for Internet of Things using OAuth 2.0Hannes Tschofenig
The document discusses authorization for internet of things devices using OAuth 2.0. It outlines design patterns like backend data portability and device-to-device communication. It then describes the architecture involving clients, authorization servers, resource servers, and devices. Finally, it provides an overview of relevant standards organizations and technologies like OAuth, COSE, OpenID Connect, and FIDO that can help address IoT security challenges.
This document provides an introduction to the Internet of Things (IoT). It discusses that IoT allows us to receive more data, control devices remotely, and automate processes. The IoT ecosystem consists of sensors that collect data, local processing and storage, a network to transmit data, cloud computing for storage and analysis. Early IoT projects used microcontrollers like Arduino and full computers like Raspberry Pi. Common IoT hardware now includes a variety of boards and modules. Software is used for prototyping, professional programming, and collecting/analyzing data from IoT devices.
The document provides an overview of Azure Sphere, a new solution from Microsoft for creating highly secured, connected microcontroller (MCU) devices. Azure Sphere includes secured MCUs with built-in Microsoft security technology, a secured operating system, and security provided by Microsoft's cloud services. It allows manufacturers to more easily create IoT devices that are protected against common security vulnerabilities and threats.
Security for automation in Internet of Things by using one time passwordSHASHANK WANKHADE
The document discusses improving security for automation in the Internet of Things using one-time passwords. It proposes generating one-time passwords using AES algorithms to provide highly authorized authentication and access to equipment. The proposal includes using elliptic curve cryptography to generate one-time passwords and extending the AES symmetric encryption scheme with Lamport's one-time password algorithm. It analyzes the performance and security of the proposed scheme, finding it can be implemented in IoT networks to provide two-factor authentication between devices, applications, and their communications securely and efficiently with a smaller key size and lower computational requirements compared to other existing one-time password schemes.
How Automated Vulnerability Analysis Discovered Hundreds of Android 0-daysPriyanka Aash
Death from a million bugs. Android has become one of the world’s most deployed operating systems. Recently researchers have been focused on uncovering vulnerabilities in the Android smartphone ecosystem. This session will present newly developed automated vulnerability analysis techniques that resulted in the discovery of hundreds of previously unknown vulnerabilities.
Learning Objectives:
1: Learn how to use automated vulnerability analysis to ID security bugs at scale.
2: Learn about state-of-the-art and novel techniques for automated vulnerability analysis.
3: Learn proven techniques to find vulnerabilities in bootloaders, kernel drives and apps.
(Source: RSA Conference USA 2018)
This document discusses IoT security. It begins by defining IoT security as protecting IoT systems, servers, networks, and devices. It then explains that IoT security is needed because IoT devices collect and store valuable data, making the systems vulnerable. The document outlines several challenges facing IoT systems, such as unpredictable device behavior, similar device designs, and lack of alerts. It also discusses threats like malware, information theft, and vulnerabilities. Finally, the document provides recommendations for improving IoT security, including encryption, updates, and network access control.
The internet of things (io t) : IoT academy AnkitThakkar46
The Internet of things (IoT) is a system of interrelated computing devices, mechanical and digital machines provided with unique identifiers (UIDs) and the ability to transfer data over a network without requiring human-to-human or human-to-computer interaction.
More and more IoT vulnerabilities are found and showcased at security events. From connected thermostats to power plants!
Insecurity became the favorite subject for creating catchy IoT headlines: "Connected killer toaster", "Fridges changed into spamming machines","Privacy concerns around connected home".
We will explore the five challenges one has to face when building a secure IoT solution:
- hardware security: how to avoid rogue firmwares and keep your security keys safe?
- upgrade strategy: you can't secure what you can't update!
- secure transport: no security without secure transports.
- security credentials distribution: how to distribute security keys to a fleet with millions of devices?
- cloud vulnerability mitigation, how to keep your fleet of devices safe from the next Heartbleed?
Current enterprise infrastructure provides solutions for handling application security but are they really matching the IoT challenge? Could running a PKI client on a low power wireless sensor node be an option?
Despite those difficulties, we will show how a modern IoT device management standard like Lightweight M2M with DTLS is the way for building a secur-first IoT solutions. It provides a solution for upgrading your device, distributing your security keys and comes with a full range of cryptography cipher suites, from PSK algorithm for very constrained devices to high level of security using X.509 certificates.
Furthermore for adding security to your solution we will present you ready to use opensource libraries for implementing secure IoT servers and devices. The way for quickly releasing your next catchy connected product.!
Ultimately we will showcase Wakaama and Leshan, the Eclipse IoT Lightweight M2M implementation maybe your next best friend in the troubled water of Internet-Of-Things security!
Hacktivity 2016: The real risks of the IoT security-nightmare: Hacking IP cam...Zoltan Balazs
IoT security poses serious risks due to vulnerabilities in many IoT devices that are never patched by manufacturers. Common excuses for the poor security of IoT devices are shown to be invalid, as attacks can bypass passwords, networks, and firewalls using techniques like UPnP, IPv6, WebRTC, and DNS rebinding. Lessons for home users include disconnecting devices when not in use, changing passwords, filtering connections and protocols, and monitoring networks. Lessons for vendors are to implement secure development practices, automatic updates, and optional cloud connections. Governments should regulate vendors to protect users and incentivize more secure practices.
DEF CON 23: Internet of Things: Hacking 14 DevicesSynack
DEF CON 23
Internet of Things: Hacking 14 Devices
It is easy to find poorly designed devices with poor security, but how do the market leading devices stack up? Are they more secure than a Linux-powered rifle? This presentation documents our effort to assess the state of security of top selling Internet of Things Devices.
We procured 14 of the leading “connected home” IoT devices and tore them down, all the way from software to hardware and compared their relative security. This talk will demonstrate techniques useful for assessing any IoT device, while showing how they were applied across a wide range of devices.
Attend for stories of device rooting, SSL interception, firmware unpacking, mobile app vulnerabilities and more. Stay to find out why your favorite new gadget might just be a backdoor into your home. If you own (or are considering buying) one of the following devices, come and find out how secure it actually is!
Devices:
Dlink DCS-2132L
Dropcam Pro
Foscam FI9826W
Simplicam
Withings Baby Monitor
Ecobee
Hive
Honeywell Lyric
Nest Thermostat
Nest Protect
Control4 HC-250
Lowes Iris
Revolv
SmartThings
Samsung Smart Refrigerator (model RF28HMELBSR)
Samsung LED Smart TV (model UN32J5205AFXZA)
REASON:
The best thing about this talk is that it covers a large number of devices, all devices which are among the industry leaders for their category.
While we have published the high level findings from assessing these devices, this talk will include full technical details on how to attack each of these devices, and full tech details on any of the vulns which we found. Those details have not yet been released, and will be of interest to anyone who owns or wants to hack any of these devices.
Enabling Data Protection through PKI encryption in IoT m-Health DevicesCharalampos Doukas
Short presentation about a gateway-based solution for medical data encryption and the Internet of Things. Paper presented at 12th IEEE International Conference on BioInformatics and BioEngineering
IoT security is a nightmare. But what is the real risk?Zoltan Balazs
1) IoT security is a major issue as many devices have poor security and will never receive patches. This leaves them vulnerable to attacks over the internet or through home networks.
2) There are many risks even for devices that are behind routers or firewalls due to issues like UPnP, IPv6, cloud connections, and protocol tunneling that can bypass network protections.
3) Home users should take steps like disconnecting devices when not in use, changing passwords, filtering incoming connections, and monitoring their network to improve their security, but there are no complete solutions given flaws in IoT design and updates.
PLNOG15: Simplifying network deployment using Autonomic networking and Plug-a...PROIDEA
1) Autonomic networking and plug-and-play technologies simplify network deployment by automating configuration tasks and enabling zero-touch provisioning of devices.
2) They provide secure bootstrap and join processes for devices using techniques like the Autonomic Control Plane and domain certificates to securely establish management connectivity without manual configuration.
3) Combining autonomic networking with trusted boot and device attestation establishes a foundation for secure-by-default networks that automatically secure devices and the control plane when devices join the network.
This document provides an overview of Azure Sphere, a new solution from Microsoft for creating highly secured, connected microcontroller (MCU) devices. It discusses the opportunity and risks of IoT, introduces the seven properties of highly secured devices, and describes the key components of Azure Sphere including the secured MCU, secured operating system, and secured cloud services. It also covers the Azure Sphere developer tools and SDK, partner ecosystem, and provides a recap of the overall solution.
Slide deck for talk at IETF#92 (Dallas, March 2015) at the IETF Light-Weight Implementation Guidance (lwig) working group about the performance of cryptographic algorithms on ARM processors.
Are you ready for Microsoft Azure Sphere?Mirco Vanini
Azure Sphere is Microsoft's solution for highly securing IoT devices. It includes Azure Sphere certified chips, the Azure Sphere operating system, and the Azure Sphere Security Service. Together, these provide devices with 10 years of ongoing security updates directly from Microsoft. Azure Sphere aims to empower organizations to securely connect devices and build new IoT solutions with built-in security through its end-to-end platform. The current Azure Sphere development kit uses the MT3620 chip and provides tools to simplify and streamline IoT development.
This document provides a deep dive into Brillo and Weave, including:
1. The code structure and hardware access layer used in Brillo.
2. Code labs that help teach Brillo and Weave development through examples.
3. Details on logging, monitoring, and analytics capabilities in Brillo.
ACSAC2020 "Return-Oriented IoT" by Kuniyasu SuzakiKuniyasu Suzaki
Side of "Reboot-Oriented IoT: Life Cycle Management in Trusted Execution Environment for Disposable IoT devices" ACSAC (Annual Computer Security Applications Conference) 2020
Slides prepared for the worksop at the Macao Polytechnic Institute on 5th April, 2016.
Please get examples from the following URL:
https://github.com/kotobuki/esp8266_examples
This document summarizes information about Zigbee wireless communication protocols. It begins by defining IoT and OT, then discusses wireless communication protocols commonly used in IoT like BLE, Zwave, Zigbee, 6LoWPAN, RFID and NFC. It provides details about Zigbee such as its support for mesh networks, low power usage, security features and typical use cases. The document also lists known vulnerabilities in Zigbee implementations and tools that can be used for Zigbee pentesting like KillerBee and hardware devices. It concludes with suggestions for developing custom vulnerable IoT devices and references for further reading.
Today connected devices are everywhere, where we expect a massive growth over the upcoming years. What are connected devices (IOT)? It connects people to machines, machines to machines and shares data both people and machines create. However, why should you care about security?
This presentation walks you through why connected devices (IOT) are being targeted, what typically goes wrong during development making these devices vulnerable to attacks and whats next...
Azure Sphere is a new solution from Microsoft that provides highly secured, connected microcontroller units (MCUs). It consists of specialized MCU chips secured by Microsoft technology, a secured operating system, and cloud security services. The solution aims to address security issues that have affected IoTs by implementing seven key properties for security, including hardware root of trust, small trusted computing base, and failure reporting. It offers long-term security updates through 2028. Microsoft is working with partners to implement Azure Sphere's security technology into their chips to help manufacturers create secure, connected devices.
Authorization for Internet of Things using OAuth 2.0Hannes Tschofenig
The document discusses authorization for internet of things devices using OAuth 2.0. It outlines design patterns like backend data portability and device-to-device communication. It then describes the architecture involving clients, authorization servers, resource servers, and devices. Finally, it provides an overview of relevant standards organizations and technologies like OAuth, COSE, OpenID Connect, and FIDO that can help address IoT security challenges.
This document provides an introduction to the Internet of Things (IoT). It discusses that IoT allows us to receive more data, control devices remotely, and automate processes. The IoT ecosystem consists of sensors that collect data, local processing and storage, a network to transmit data, cloud computing for storage and analysis. Early IoT projects used microcontrollers like Arduino and full computers like Raspberry Pi. Common IoT hardware now includes a variety of boards and modules. Software is used for prototyping, professional programming, and collecting/analyzing data from IoT devices.
The document provides an overview of Azure Sphere, a new solution from Microsoft for creating highly secured, connected microcontroller (MCU) devices. Azure Sphere includes secured MCUs with built-in Microsoft security technology, a secured operating system, and security provided by Microsoft's cloud services. It allows manufacturers to more easily create IoT devices that are protected against common security vulnerabilities and threats.
Security for automation in Internet of Things by using one time passwordSHASHANK WANKHADE
The document discusses improving security for automation in the Internet of Things using one-time passwords. It proposes generating one-time passwords using AES algorithms to provide highly authorized authentication and access to equipment. The proposal includes using elliptic curve cryptography to generate one-time passwords and extending the AES symmetric encryption scheme with Lamport's one-time password algorithm. It analyzes the performance and security of the proposed scheme, finding it can be implemented in IoT networks to provide two-factor authentication between devices, applications, and their communications securely and efficiently with a smaller key size and lower computational requirements compared to other existing one-time password schemes.
How Automated Vulnerability Analysis Discovered Hundreds of Android 0-daysPriyanka Aash
Death from a million bugs. Android has become one of the world’s most deployed operating systems. Recently researchers have been focused on uncovering vulnerabilities in the Android smartphone ecosystem. This session will present newly developed automated vulnerability analysis techniques that resulted in the discovery of hundreds of previously unknown vulnerabilities.
Learning Objectives:
1: Learn how to use automated vulnerability analysis to ID security bugs at scale.
2: Learn about state-of-the-art and novel techniques for automated vulnerability analysis.
3: Learn proven techniques to find vulnerabilities in bootloaders, kernel drives and apps.
(Source: RSA Conference USA 2018)
This document discusses IoT security. It begins by defining IoT security as protecting IoT systems, servers, networks, and devices. It then explains that IoT security is needed because IoT devices collect and store valuable data, making the systems vulnerable. The document outlines several challenges facing IoT systems, such as unpredictable device behavior, similar device designs, and lack of alerts. It also discusses threats like malware, information theft, and vulnerabilities. Finally, the document provides recommendations for improving IoT security, including encryption, updates, and network access control.
The internet of things (io t) : IoT academy AnkitThakkar46
The Internet of things (IoT) is a system of interrelated computing devices, mechanical and digital machines provided with unique identifiers (UIDs) and the ability to transfer data over a network without requiring human-to-human or human-to-computer interaction.
“The Internet of Things (IoT) is a system of
interrelated computing devices, mechanical and
digital machines, objects, animals or people that
are provided with unique identifiers and the
ability to transfer data over a network without
requiring human-to-human or
human-to-computer interaction.”
Final Research Project - Securing IoT Devices What are the Challe.docxvoversbyobersby
Final Research Project - Securing IoT Devices: What are the Challenges?
Internet security, in general, is a challenge that we have been dealing with for decades. It is a regular topic of discussion and concern, but a relatively new segment of internet security is getting most attention—internet of things (IoT). So why is internet of things security so important?
The high growth rate of IoT should get the attention of cybersecurity professionals. The rate at which new technology goes to market is inversely proportional to the amount of security that gets designed into the product. According to IHS Markit, “The number of connected IoT devices worldwide will jump 12 percent on average annually, from nearly 27 billion in 2017 to 125 billion in 2030.”
IoT devices are quite a bit different from other internet-connected devices such as laptops and servers. They are designed with a single purpose in mind, usually running minimal software with minimal resources to serve that purpose. Adding the capability to run and update security software is often not taken into consideration.
Due to the lack of security integrated into IoT devices, they present significant risks that must be addressed. IoT security is the practice of understanding and mitigating these risks. Let’s consider the challenges of IoT security and how we can address them.
Some security practitioners suggest that key IoT security steps include:
1. Make people aware that there is a threat to security;
2. Design a technical solution to reduce security vulnerabilities;
3. Align the legal and regulatory frameworks; and
4. Develop a workforce with the skills to handle IoT security.
Final Assignment - Project Plan (Deliverables):
1) Address each of the FOURIoT security steps listed above in terms of IoT devices.
2) Explain in detail, in a step-by-step guide, how to make people more aware of the problems associated with the use of IoT devices.
Bottom of Form
Top of Form
Bottom of Form
I have to create a matrix with unique pointers and do the following :
1.Matrix a, b
2.Matrix c(b)
3.Matrix d=a
4.Matrix e=a+b
Every element from matrix is a unique pointer. First, I have to create a class matrix with constructor destructor(rule of 5 if it is possible).
At first in main, I have to create 2 object a, b, Matrix type.
At 2.I have to create another object c that have as constructor the object b
3.to copy all element from matrix a to d
4.To add Matrix a with Matrix b and the sum to be copy in Matrix e
IoT References:
https://www.techrepublic.com/article/how-to-secure-your-iot-devices-from-botnets-and-other-threats/
https://www.peerbits.com/blog/biggest-iot-security-challenges.html
https://www.bankinfosecurity.asia/securing-iot-devices-challenges-a-11138
https://www.sumologic.com/blog/iot-security/
https://news.ihsmarkit.com/press-release/number-connected-iot-devices-will-surge-125-billion-2030-ihs-markit-says
https://cdn.ihs.com/www/pdf/IoT_ebook.pdf
https://go.armis.com/hubfs/Buyers%E2%80%99%20G ...
IoT References:
https://www.techrepublic.com/article/how-to-secure-your-iot-devices-from-botnets-and-other-threats/
https://www.peerbits.com/blog/biggest-iot-security-challenges.html
https://www.bankinfosecurity.asia/securing-iot-devices-challenges-a-11138
https://www.sumologic.com/blog/iot-security/
https://news.ihsmarkit.com/press-release/number-connected-iot-devices-will-surge-125-billion-2030-ihs-markit-says
https://cdn.ihs.com/www/pdf/IoT_ebook.pdf
https://go.armis.com/hubfs/Buyers%E2%80%99%20Guide%20to%20IoT%20Security%20-Final.pdf
https://www.techrepublic.com/article/smart-farming-how-iot-robotics-and-ai-are-tackling-one-of-the-biggest-problems-of-the-century/
Video Resources:What is the Internet of Things (IoT) and how can we secure it?
https://www.youtube.com/watch?v=H_X6IP1-NDc
What is the problem with IoT security? - Gary explains
https://www.youtube.com/watch?v=D3yrk4TaIQQ
What are the Challenges of IoT Security?
IoT has many of the same security challenges that other systems have. There are, however, some challenges that are unique to IoT.
1. Embedded Passwords. Embedding passwords in IoT devices make it easy for remote support technicians to access devices for troubleshooting and simplifies the installation of multiple devices. Of course, it also simplifies access to devices for malicious purposes.
2. Lack of device authentication. Allowing IoT devices access to the network without authenticating opens the network to unknown and unauthorized devices. Rogue devices can serve as an entry point for attacks or even as a source of attacks.
3. Patching and upgrading. Some IoT devices do not provide a simple (or any) means to patch or upgrade software. This results in many IoT devices with vulnerabilities continuing to be in use.
4. Physical hardening. Physical access to IoT devices can introduce risk if those devices are not hardened against physical attack. Such an attack may not be intended to damage the device, but rather to extract information. Simply removing a microSD memory card to read its contents can give an attacker private data, as well as information such as embedded passwords that may allow access to other devices.
5. Outdated components. When vulnerabilities are discovered in hardware or software components of IoT devices, it can be difficult and expensive for manufacturers or users to update or replace them. As with patches, this results in many IoT devices with vulnerabilities continuing to be used.
6. Device monitoring and management. IoT devices do not always have a unique identifier that facilitates asset tracking, monitoring, and management. IT personnel do not necessarily consider IoT devices among the hosts that they monitor and manage. Asset tracking systems sometimes neglect to include IoT devices, so they sit on the network without being managed or monitored.
Most of these issues can be attributed to security being an afterthought (if a thought at all) in the design and manufacturing of IoT devices. Even tho ...
Final Research Project - Securing IoT Devices What are the Challe.docxtjane3
Final Research Project - Securing IoT Devices: What are the Challenges?
Internet security, in general, is a challenge that we have been dealing with for decades. It is a regular topic of discussion and concern, but a relatively new segment of internet security is getting most attention—internet of things (IoT). So why is internet of things security so important?
The high growth rate of IoT should get the attention of cybersecurity professionals. The rate at which new technology goes to market is inversely proportional to the amount of security that gets designed into the product. According to IHS Markit, “The number of connected IoT devices worldwide will jump 12 percent on average annually, from nearly 27 billion in 2017 to 125 billion in 2030.”
IoT devices are quite a bit different from other internet-connected devices such as laptops and servers. They are designed with a single purpose in mind, usually running minimal software with minimal resources to serve that purpose. Adding the capability to run and update security software is often not taken into consideration.
Due to the lack of security integrated into IoT devices, they present significant risks that must be addressed. IoT security is the practice of understanding and mitigating these risks. Let’s consider the challenges of IoT security and how we can address them.
Some security practitioners suggest that key IoT security steps include:
1. Make people aware that there is a threat to security;
2. Design a technical solution to reduce security vulnerabilities;
3. Align the legal and regulatory frameworks; and
4. Develop a workforce with the skills to handle IoT security.
Final Assignment - Project Plan (Deliverables):
1) Address each of the FOURIoT security steps listed above in terms of IoT devices.
2) Explain in detail, in a step-by-step guide, how to make people more aware of the problems associated with the use of IoT devices.
Bottom of Form
Top of Form
Bottom of Form
IoT References:
https://www.techrepublic.com/article/how-to-secure-your-iot-devices-from-botnets-and-other-threats/
https://www.peerbits.com/blog/biggest-iot-security-challenges.html
https://www.bankinfosecurity.asia/securing-iot-devices-challenges-a-11138
https://www.sumologic.com/blog/iot-security/
https://news.ihsmarkit.com/press-release/number-connected-iot-devices-will-surge-125-billion-2030-ihs-markit-says
https://cdn.ihs.com/www/pdf/IoT_ebook.pdf
https://go.armis.com/hubfs/Buyers%E2%80%99%20Guide%20to%20IoT%20Security%20-Final.pdf
https://www.techrepublic.com/article/smart-farming-how-iot-robotics-and-ai-are-tackling-one-of-the-biggest-problems-of-the-century/
Video Resources:What is the Internet of Things (IoT) and how can we secure it?
https://www.youtube.com/watch?v=H_X6IP1-NDc
What is the problem with IoT security? - Gary explains
https://www.youtube.com/watch?v=D3yrk4TaIQQ
What are the Challenges of IoT Security?
IoT has many of the same security challenges that other systems have. There are, howe.
Final Research Project - Securing IoT Devices What are the Challe.docxlmelaine
Final Research Project - Securing IoT Devices: What are the Challenges?
Internet security, in general, is a challenge that we have been dealing with for decades. It is a regular topic of discussion and concern, but a relatively new segment of internet security is getting most attention—internet of things (IoT). So why is internet of things security so important?
The high growth rate of IoT should get the attention of cybersecurity professionals. The rate at which new technology goes to market is inversely proportional to the amount of security that gets designed into the product. According to IHS Markit, “The number of connected IoT devices worldwide will jump 12 percent on average annually, from nearly 27 billion in 2017 to 125 billion in 2030.”
IoT devices are quite a bit different from other internet-connected devices such as laptops and servers. They are designed with a single purpose in mind, usually running minimal software with minimal resources to serve that purpose. Adding the capability to run and update security software is often not taken into consideration.
Due to the lack of security integrated into IoT devices, they present significant risks that must be addressed. IoT security is the practice of understanding and mitigating these risks. Let’s consider the challenges of IoT security and how we can address them.
Some security practitioners suggest that key IoT security steps include:
1. Make people aware that there is a threat to security;
2. Design a technical solution to reduce security vulnerabilities;
3. Align the legal and regulatory frameworks; and
4. Develop a workforce with the skills to handle IoT security.
Final Assignment - Project Plan (Deliverables):
1) Address each of the FOURIoT security steps listed above in terms of IoT devices.
2) Explain in detail, in a step-by-step guide, how to make people more aware of the problems associated with the use of IoT devices.
Bottom of Form
Top of Form
Bottom of Form
IoT References:
https://www.techrepublic.com/article/how-to-secure-your-iot-devices-from-botnets-and-other-threats/
https://www.peerbits.com/blog/biggest-iot-security-challenges.html
https://www.bankinfosecurity.asia/securing-iot-devices-challenges-a-11138
https://www.sumologic.com/blog/iot-security/
https://news.ihsmarkit.com/press-release/number-connected-iot-devices-will-surge-125-billion-2030-ihs-markit-says
https://cdn.ihs.com/www/pdf/IoT_ebook.pdf
https://go.armis.com/hubfs/Buyers%E2%80%99%20Guide%20to%20IoT%20Security%20-Final.pdf
https://www.techrepublic.com/article/smart-farming-how-iot-robotics-and-ai-are-tackling-one-of-the-biggest-problems-of-the-century/
Video Resources:What is the Internet of Things (IoT) and how can we secure it?
https://www.youtube.com/watch?v=H_X6IP1-NDc
What is the problem with IoT security? - Gary explains
https://www.youtube.com/watch?v=D3yrk4TaIQQ
What are the Challenges of IoT Security?
IoT has many of the same security challenges that other systems have. There are, howe ...
This document discusses security issues in Internet of Things (IoT). It begins with an introduction to IoT, explaining how IoT works and its key features such as connectivity, analytics, integration and artificial intelligence. It then discusses security layers in IoT, including perception, network, application and support layers. It outlines common security threats at each layer like eavesdropping, denial of service attacks, and malware. The document also covers IoT security challenges, advantages and disadvantages of IoT.
IoT References:
https://www.techrepublic.com/article/how-to-secure-your-iot-devices-from-botnets-and-other-threats/
https://www.peerbits.com/blog/biggest-iot-security-challenges.html
https://www.bankinfosecurity.asia/securing-iot-devices-challenges-a-11138
https://www.sumologic.com/blog/iot-security/
https://news.ihsmarkit.com/press-release/number-connected-iot-devices-will-surge-125-billion-2030-ihs-markit-says
https://cdn.ihs.com/www/pdf/IoT_ebook.pdf
https://go.armis.com/hubfs/Buyers%E2%80%99%20Guide%20to%20IoT%20Security%20-Final.pdf
https://www.techrepublic.com/article/smart-farming-how-iot-robotics-and-ai-are-tackling-one-of-the-biggest-problems-of-the-century/
Video Resources:What is the Internet of Things (IoT) and how can we secure it?
https://www.youtube.com/watch?v=H_X6IP1-NDc
What is the problem with IoT security? - Gary explains
https://www.youtube.com/watch?v=D3yrk4TaIQQ
Final Research Project - Securing IoT Devices: What are the Challenges?
Internet security, in general, is a challenge that we have been dealing with for decades. It is a regular topic of discussion and concern, but a relatively new segment of internet security is getting most attention—internet of things (IoT). So why is internet of things security so important?
The high growth rate of IoT should get the attention of cybersecurity professionals. The rate at which new technology goes to market is inversely proportional to the amount of security that gets designed into the product. According to IHS Markit, “The number of connected IoT devices worldwide will jump 12 percent on average annually, from nearly 27 billion in 2017 to 125 billion in 2030.”
IoT devices are quite a bit different from other internet-connected devices such as laptops and servers. They are designed with a single purpose in mind, usually running minimal software with minimal resources to serve that purpose. Adding the capability to run and update security software is often not taken into consideration.
Due to the lack of security integrated into IoT devices, they present significant risks that must be addressed. IoT security is the practice of understanding and mitigating these risks. Let’s consider the challenges of IoT security and how we can address them.
Some security practitioners suggest that key IoT security steps include:
1. Make people aware that there is a threat to security;
2. Design a technical solution to reduce security vulnerabilities;
3. Align the legal and regulatory frameworks; and
4. Develop a workforce with the skills to handle IoT security.
Final Assignment - Project Plan (Deliverables):
1) Address each of the FOURIoT security steps listed above in terms of IoT devices.
2) Explain in detail, in a step-by-step guide, how to make people more aware of the problems associated with the use of IoT devices.
Bottom of Form
Top of Form
Bottom of Form
Personal data breaches and securing IoT devices
· By Damon Culbert (2019)
The Internet of Things (IoT) is taking the world b.
The document discusses security and privacy challenges in the Internet of Things (IoT). It notes that while IoT provides opportunities in areas like smart cities and healthcare, the large number of interconnected devices also creates security and privacy risks if systems are hacked. Specifically, attacks could allow unauthorized access to personal health information or manipulation of devices like insulin pumps. The document outlines various technical challenges to IoT security like device diversity, limited bandwidth, physical access to devices, and lack of global standards. It stresses that security needs to be a priority throughout the entire IoT product lifecycle from design to maintenance.
12 IoT Cyber Security Threats to Avoid - CyberHive.pdfonline Marketing
As IoT (Internet of Things) devices weave into the fabric of our daily lives, from smart thermostats to connected cars, the need for robust IoT cyber security measures has never been more pressing. Let’s dive into 12 IoT cyber security threats that pose significant risks and offer guidance on navigating these digital waters safely. please visit: https://www.cyberhive.com/insights/12-iot-cyber-security-threats-to-avoid/
IRJET- Multifactor Authentication in IoT Devices for Ensuring Secure Cloud St...IRJET Journal
This document proposes using multifactor authentication and encryption to improve security for IoT devices and cloud storage in smart banking. It discusses challenges with IoT and cloud security and proposes a solution that uses multifactor authentication through a mobile app to access IoT devices and encrypted cloud storage. The multifactor authentication would include passwords, one-time passwords by SMS, and fingerprint biometrics. Data transmitted from IoT devices to the cloud would be encrypted using AES encryption. This approach aims to securely authenticate users and protect sensitive banking and transaction data.
Internet of things are exploding. This whitepaper would help product developers to understand the Security and Privacy issues, their impact and a recommendation for embedding the best practices during PDLC.
The document discusses several cybersecurity challenges posed by the growing Internet of Things (IoT), including the large number of connected devices that can be vulnerable to attacks, lack of security updates for devices, and supply chain risks. It outlines solutions such as implementing strong authentication, encryption, blockchain technology, AI for threat detection, privacy by design, and supply chain transparency. Overall, the document emphasizes that securing the IoT will require cooperation across industry and government to establish security best practices and standards for IoT device manufacturers.
The Internet of Things (IoT) is one of the most active and fascinating innovations in information and communications technology.
https://www.infosectrain.com/courses/iot-bootcamp-certification-training/
The Internet of Things (IoT) hacking is the hacking of IoT devices. IoT is a network of devices embedded with sensors, software, and other technologies to connect and exchange data and information with other devices and systems over the Internet. It primarily refers to the fast-expanding network of linked devices that use embedded sensors to collect and exchange data in real-time. Although IoT hacking is a relatively new phenomenon, it has already shown a vast capacity for destruction in a relatively short period.
The document discusses cybersecurity challenges posed by the growing Internet of Things (IoT) ecosystem and potential solutions. It addresses issues such as the lack of security protocols across diverse IoT devices, which can lead to data theft and infrastructure attacks. Other challenges involve limited device processing power, lack of software updates, and supply chain vulnerabilities. Solutions proposed include implementing encryption, device authentication, blockchain technology, AI for threat detection, privacy by design, and cooperation across industries to establish standards. Overall, the document emphasizes that all stakeholders must work together to develop comprehensive security solutions for IoT.
KSI for IoT Security - Turning Defence Into Offence - Guardtime WhitepaperMartin Ruubel
The document discusses Internet of Things (IoT) security. It defines IoT as physical objects containing technology to communicate and interact with their environment. The economic impact of IoT is estimated to be $6.2 trillion annually by 2025. IoT security faces challenges as it cuts across IT, operational technology, and telecommunications networks. The document proposes an approach using Guardtime's Keyless Signature Infrastructure (KSI) to securely integrate IoT across systems by verifying data integrity and authenticating devices. KSI would address constraints of real-time networks and help mitigate security risks like sensor network attacks.
The document requests that study notes not be shared on messaging apps like WhatsApp or Telegram, as the organization generates revenue from ads on its website and app. This revenue funds new study materials and improves existing ones. If people do not use the website and app directly, it hurts the organization's revenue and may force it to close down services. It humbly requests that people stop sharing study materials on other apps and instead share the website URL.
Similar to Internet of things (IoT) Architecture Security Analysis (20)
Foundations for New Champlain Bridge Corridor ProjectDaksh Raj Chopra
In this presentation, we constructed 15 temporary bent foundations for the New Champlain Bridge. The presentation is about the project management done for this project.
This document discusses the Maggi noodles quality management case in India. It describes how Maggi was founded in Switzerland in the late 19th century and was later acquired by Nestle. In 2015, samples of Maggi noodles in India were found to contain illegal levels of lead and MSG contrary to packaging. This led to a nationwide recall of Maggi noodles in India and significant financial losses for Nestle India. After the case, changes were made at Nestle India including appointing an Indian managing director for the first time in 17 years and plans to relaunch Maggi by November 2015 after clearing additional tests.
Simulation of a Wireless Sub Network using QualNETDaksh Raj Chopra
This report has two scenarios - First one having 2 connections, UDP and TCP. Another scenario has 4 TCP connections having a comparison with and without fading.
This document describes an electronic travel aid device for the blind using ultrasonic sensors to detect obstacles. It consists of an ultrasonic sensor that transmits ultrasound beams to detect objects within 2-3 meters. The distance to objects is categorized into discrete levels of 1, 2, or 3 meters which are indicated to the user via tactile vibrators. The device also detects water pits using audio signals to inform users. It aims to provide mobility information to visually impaired people to help them safely navigate environments.
This document discusses self-organizing maps (SOM), an unsupervised machine learning technique that projects high-dimensional data into a low-dimensional space. SOM creates a map that clusters similar data items together and separates dissimilar items. It is useful for data mining, data analysis, and pattern recognition. The document provides examples of using SOM to cluster metallic elements based on their physical properties and cluster different soil types based on their spectral properties with increasing noise.
This document provides a training report for a 6-week internship at Appin Technology Lab on embedded systems. It includes an acknowledgment section thanking guides and mentors. The report then covers the company profile, project undertaken which was a DTMF controlled home automation system, introduction to the project explaining home automation, modular description of the system, design, coding, test cases, industry applications, and future enhancements. It also includes data sheets and sections on DTMF signaling technology.
- Microcontrollers are small computers contained on a single chip that contain a processor core, memory, and input/output interfaces. They are used in automatically controlled embedded systems.
- The AVR is a family of microcontrollers developed by Atmel in the 1990s. It uses RISC architecture and is commonly used in hobbyist and commercial projects due to its low cost and availability.
- Code is burned onto AVR microcontrollers using a software program called Atmel Studio, which allows writing code in C or assembly language. The program is then loaded onto the microcontroller through its pins.
This document describes a DTMF-based home appliance control system that allows wireless control of devices in a home using a user console with numbered keys. The system uses a DTMF decoder, microcontroller, and wireless transmitter and receiver to encode and transmit user selections via DTMF signals and control appliances accordingly. Key components include an AT89S52 microcontroller, MT8870 DTMF decoder, relays, LEDs, buttons, and other basic electronic components. When a key is pressed, the DTMF signal is encoded and transmitted to the receiver, then decoded by the microcontroller to trigger the correct appliance, allowing remote control of devices like lights and appliances from anywhere.
Comparative analysis between traditional aquaponics and reconstructed aquapon...bijceesjournal
The aquaponic system of planting is a method that does not require soil usage. It is a method that only needs water, fish, lava rocks (a substitute for soil), and plants. Aquaponic systems are sustainable and environmentally friendly. Its use not only helps to plant in small spaces but also helps reduce artificial chemical use and minimizes excess water use, as aquaponics consumes 90% less water than soil-based gardening. The study applied a descriptive and experimental design to assess and compare conventional and reconstructed aquaponic methods for reproducing tomatoes. The researchers created an observation checklist to determine the significant factors of the study. The study aims to determine the significant difference between traditional aquaponics and reconstructed aquaponics systems propagating tomatoes in terms of height, weight, girth, and number of fruits. The reconstructed aquaponics system’s higher growth yield results in a much more nourished crop than the traditional aquaponics system. It is superior in its number of fruits, height, weight, and girth measurement. Moreover, the reconstructed aquaponics system is proven to eliminate all the hindrances present in the traditional aquaponics system, which are overcrowding of fish, algae growth, pest problems, contaminated water, and dead fish.
Using recycled concrete aggregates (RCA) for pavements is crucial to achieving sustainability. Implementing RCA for new pavement can minimize carbon footprint, conserve natural resources, reduce harmful emissions, and lower life cycle costs. Compared to natural aggregate (NA), RCA pavement has fewer comprehensive studies and sustainability assessments.
Redefining brain tumor segmentation: a cutting-edge convolutional neural netw...IJECEIAES
Medical image analysis has witnessed significant advancements with deep learning techniques. In the domain of brain tumor segmentation, the ability to
precisely delineate tumor boundaries from magnetic resonance imaging (MRI)
scans holds profound implications for diagnosis. This study presents an ensemble convolutional neural network (CNN) with transfer learning, integrating
the state-of-the-art Deeplabv3+ architecture with the ResNet18 backbone. The
model is rigorously trained and evaluated, exhibiting remarkable performance
metrics, including an impressive global accuracy of 99.286%, a high-class accuracy of 82.191%, a mean intersection over union (IoU) of 79.900%, a weighted
IoU of 98.620%, and a Boundary F1 (BF) score of 83.303%. Notably, a detailed comparative analysis with existing methods showcases the superiority of
our proposed model. These findings underscore the model’s competence in precise brain tumor localization, underscoring its potential to revolutionize medical
image analysis and enhance healthcare outcomes. This research paves the way
for future exploration and optimization of advanced CNN models in medical
imaging, emphasizing addressing false positives and resource efficiency.
Embedded machine learning-based road conditions and driving behavior monitoringIJECEIAES
Car accident rates have increased in recent years, resulting in losses in human lives, properties, and other financial costs. An embedded machine learning-based system is developed to address this critical issue. The system can monitor road conditions, detect driving patterns, and identify aggressive driving behaviors. The system is based on neural networks trained on a comprehensive dataset of driving events, driving styles, and road conditions. The system effectively detects potential risks and helps mitigate the frequency and impact of accidents. The primary goal is to ensure the safety of drivers and vehicles. Collecting data involved gathering information on three key road events: normal street and normal drive, speed bumps, circular yellow speed bumps, and three aggressive driving actions: sudden start, sudden stop, and sudden entry. The gathered data is processed and analyzed using a machine learning system designed for limited power and memory devices. The developed system resulted in 91.9% accuracy, 93.6% precision, and 92% recall. The achieved inference time on an Arduino Nano 33 BLE Sense with a 32-bit CPU running at 64 MHz is 34 ms and requires 2.6 kB peak RAM and 139.9 kB program flash memory, making it suitable for resource-constrained embedded systems.
Batteries -Introduction – Types of Batteries – discharging and charging of battery - characteristics of battery –battery rating- various tests on battery- – Primary battery: silver button cell- Secondary battery :Ni-Cd battery-modern battery: lithium ion battery-maintenance of batteries-choices of batteries for electric vehicle applications.
Fuel Cells: Introduction- importance and classification of fuel cells - description, principle, components, applications of fuel cells: H2-O2 fuel cell, alkaline fuel cell, molten carbonate fuel cell and direct methanol fuel cells.
Literature Review Basics and Understanding Reference Management.pptxDr Ramhari Poudyal
Three-day training on academic research focuses on analytical tools at United Technical College, supported by the University Grant Commission, Nepal. 24-26 May 2024
Internet of things (IoT) Architecture Security Analysis
1. Concordia Institute for Information System Engineering (CIISE)
Concordia University
Internet of Things(IoT)
Three Domain Architecture Security Analysis
INSE-6150 PROJECT REPORT
Submitted to: Prof. Dr. Jeremy Clark
Date: 04/27//2018
MANAV CHAWLA & DAKSH RAJ CHOPRA
chawlamanav@hotmail.com dakshchopra15@gmail.com
40058312 40054446
2. IoT Three Domain Architecture Security Analysis
Abstract
This Document Briefly summarizes the Security and Privacy Concern Evaluation of Internet
of Things (IoT)’s Three Domain Architecture. The Security implementation challenges faced
by IoT devices are addressed along with newly Added Requirement for these devices. The
Architecture which we will be using throughout our analysis is explained so as to a novice
user. We will summarize the possible attacks and countermeasures for each and every
domain followed by a developer friendly checklist to be followed for security.
Introduction
Smart Devices are a part of everybody’s life now, Five years back we never pictured our
home making decisions on our own, Devices reading our thoughts and making decision
based on our schedule but today We cannot go out without Google Assistant pinging us up
at 9:00 am with work directions or my smart watch reminding me to drink water. Internet of
Things is Interconnection of Network of these cyber physical devices or so called smart
devices with the aim to make them smarter. Controlling them via apps is just a start and data
analytics to improve the product so as to create a product that knows me better than anyone
else. Human’s behaviour is sometimes so predictable and sometimes hard to guess. Your
device will know you better than your friend soon. main usage of smart devices is for
personal growth and for ease of use. IoT will help you save time for eg:- say you are out of
milk, your fridge will alert the Grocery store and they make the item ready to be picked up,
your phone sends you the location of the store and your car drive itself to that store while
you sit back and eat your nutella.
3. Motivation
Hacking via your smart device is one thing and using your Toaster to do this is the next big
Thing, The Sandwich it makes might be burned but you can depend on it to exploit that
buffer overflow bug. We are into an era of Internet of Thing (IoT), where everything is
digitally connected to gather information and help making appliances systematic and easy to
use for us. Just like guns were created for peace, and the world does its job to think critically
and creatively, There always are consequences of what we made and how the world
perceive it . Attackers have created their way through these smart devices as well. The
Power of these Devices and their capability are limited thus these are more prone to
Attackers as the level of security is offers is Not as much as our smartphones.The following
address the few issues we have faced in the Past Times.
So let's start with the consumer issues we face in IoT. With no encryption and zero
authentication check, the attacker can use reverse engineering and send commands to the
API which people generally don’t check . Attacker was able to read the packets and camera
system was compromised. As the devices have no firewall attached, The attacker
manipulated these devices to perform DoS attack on Dyn registrar bringing websites like
twitter down in 2015. .This is the time when should think about the importance of security in
IoT. The data going through all the devices. Where are they storing this data? Do they
encrypt this data?. Generally, On the local network, if you just know the user ID, you have
the access to the data. Data leakage amongst the devices is very common in the recent past
times. Adding encryption to the data adds a little cost to product, which the company
generally wants to avoid. IoT devices are generally made by the startups which are crowd
funded or on a very little budget. They want to invest more on the device than to spend on its
security.
The Future is unpredictable but statistics are never wrong , we can still guess what the future
holds for smart devices:-
● Even today it is not easy to keep just two devices a Mobile and a PC fully updated all
the time with the latest version of OS and Application, just imagine a situation when
we are loaded with many devices around us and keeping them free from the security
bugs.
● The volume of data will be so much that it would be difficult to track and identify the
suspicious traffic over the network. Missing such incidents will make a huge dent over
the larger network.
● Even today the number of cyber attacks are so much that there is not even one day
when we don’t have an attempt to barge the internet security. With the rise of IoT,
such phishing and attacks will be definitely on the rise.
● IPv6 is still not fully perfected even though it has been there for quite some time,
leave apart its complete implementation. With IoT in place, the threat is new and
unknown. We might something that has much higher and effective security than that
of IPv6.
There are more reasons yet to be found as security and exploit goes hand to hand
which we have witnessed over the past decade.
4. IoT security challenges
IoT though being a computer system has some limitation and scalability issues which makes
it somewhat different than the challenges faced by a smartphone or Computer. It already
faces the challenges of current cyber Security along with that some specific IoT challenges
are worth mentioning. IoT has unique characteristics and constraints when it comes to
designing efficient defensive mechanisms against cyber-security threats that can be
summarized by the following:
● IoT relies on microcontrollers with limited memory and computational power. This often
makes it impractical to implement approaches designed for powerful computers. This in
turn requires constrained IoT devices to be hidden behind secure gateways.
● Anything that is exposed to the Internet must be securely software upgradable. Proper
Signature and encryption with high speed data delivery has so much constrain on the
small computational device
● Threats based upon gaining physical access to IoT devices. The size of certain smart
devices are smaller than a computer or even a smart phone while other could be
secure at your place.
● User experience must be good enough to avoid becoming a weak link in the chain.
● The necessity of keeping up to date with security best practices.Our smart devices OS
and computer OS provide tons of Updates ust to keep us secure is it feasible for small
cheaper smart device to follow this process as a single person is soon going to own 5
smart device each,
● Lots of sensors will generate a vast amount of data although this varies by domain but
the big data generated and used for analytics has various privacy and security
challenges that should be kept feasible for the near future.
IoT Security Requirements
IoT Security Demands Some new Requirements along with those CyberSecurity
Requirements of Confidentiality, Integrity, Authentication,Availability and Authorization.These
are mentioned and Explained below:-
● Freshness: The data generated should be fresh i.e. the attacker must not be able to
return an entity into its old state using old data.
● Non-repudiation: It ensures that an entity cannot deny an action that it has performed.If
an object forwarded a message it has to Accept it.
● Forward Secrecy: It ensures that after we leave the department, we should not be able
to hear communication happening inside the department.
● Backward Secrecy: It ensures that any new object that joins the network, it will not be
able to communication that happened before its joining.
5. The Three Domain Architecture
In Order to Understand the possible attacks and Exploits the architecture we are using for
our evaluation must be clear. Evaluating IoT security is a very vast domain, so as to To
achieve end-to-end security within an IoT solution, security must be a priority across all of
the layers of our IoT architecture. Adopting a multi-tiered architecture allows you to focus on
improving your understanding about how all of the most important aspects of the architecture
operate independently before you integrate them within your IoT application.
For our analysis we are considering the three Domain Architecture:-
1. Device Domain - This Domain is made up all the Smart Devices, These Devices
are expected to change their Environment over time. SMart Devices Senses all the data and
they forward the data to Edge Domain, This Domain also have actuators Responsible for
acting on the decisions made.
2. Edge Domain - Devices in this domain are allocated one or more smart
devices.Edge Domain Devices are typically responsible for performing operations on the
data collected included preprocessing, filtering and Aggregation.As Devices change there
location over time edge domain devices are also connected to each other so as to
coordinate the smart object.
3. Cloud Domain - Cloud Domain is composed of large number of servers that have
dedicated Virtual Machines(VMs) for each device and they are generally powerful system
created to perform analytics. They have dashboards(or device management pages) for each
device as well.
6. Attacks on IoT
Cloud Domain Attacks
On Cloud Servers , each Application is Dedicated one or more VMs where each VMs is
assigned to one or more servers in the data center and gets certain CPU and memory
resources allocation.HyperVisor is Responsible for monitoring those VMs and allocates the
shared hardware. It also Creates logical separation among VMs and also from the
underlying hardware.
Cloud
The Following attacks are possible on this domain:-
1. Hidden-Channel Attacks: VMs Share some hardware Components among each other
majorly the cache. So possibility for data breach and leakage among VMs is high .
Steps Followed:-
A. Map Target VM: The Attacker try to locate the VM’s exact zone and server. The
attacker rents VM in the same cluster using external IP
B. Malicious VM placement:The attacker places a malicious VM drive and traceroute to
determine whether the location is correct or not, else released the VM and send
another one.
C. Cross VM-Data leakage: Attacker uses cache and side channel time attack to
Determine the Memory address used by Targeted VM.
2. VM Migration Attacks: Data center supports live VM Migration service from one server to
another.
A. Control Plane attack: By exploiting the Bug in the migration module software, the
attacker can hack the server and take control over the module.migration module is
responsible for handling the migration process.The attacker either moves more VMs
than the capacity of server causing Denial of service or the attacker advertise high
resource availability of one of the server he already controls causing all VMs to
follow.
B. Data Plane attacks: Attacker targets the network links over which the VM is moved
from one server to another this can be done by packet sniffing or Man in the middle
attack.
3. Theft-of-Service Attack: Malicious VM Demands more resources than the share it is
supposed to obtain causing other VMs performance degrade.
4. VM Escape Attack: Malicious VM gain root access by exploiting software bug and
breaking the isolation.VM escape the hypervisor layer and now have the full access.
7. 5. Insider Attack: Data centre administrator have ability to access and modify collected data.
Extremely sensitive data require extra care and cannot be placed in the hands of third party
centres.
We tested our Attacks on the basis of the requirements of IoT and here is the summary
Attack
Security Violation
Hidden Channel
ATtack
VM Migration
Attacks
Theft-of Service
Attack
VM escape
Attack
Insider Attack
Confidentiality
Integrity
Availability
Non-Repudiation
Edge Domain Devices
Edge Devices or fog devices collects the sensing data that is reported from a set of smart
objects. The fog device performs different operations on the collected data. Edge Devices
share a lot of attacks and issues faced by Cloud domain
The following Privacy or security concerns are applicable to this domain:-
1. Authentication and Trust: The identity of the owner of the fog device is the major concern,
whether is should be trusted or not by the smart device, the smart device .As the location
of smart device is not fixed and different fog devices are assigned to it over time.Selecting
a trustworthy fog device is a hard decision.
2. Migration Security attack : similar to the cloud domain, but the risk is higher here as
migration is over the Internet not the VPN.
3. DoS Attack: Fog devices does not generally have firewalls and has limited resources and
power, thus attacking devices are way easier.
4. Container Threat: A fog device may choose container over a VM so as to serve more
Smart Device,Container share same Operating System among the different devices. THis
raises more security concerns for data leakage and Hijacking.
Attack
Security Violation
Authentication
and Trust
Migration
Security Attack
DoS Attack Container
Threat
Confidentiality
Integrity
Availability
Authentication
8. Devices Domain Attacks
Smart Devices consist of sensors that view the world as some numerical equation. The data
is collected and sent to the fog devices, fog device perform some processing and send
response to actuators which are responsible for performing some action like changing
temperature or simple beep. Smart Device send data directly to fog devices or in a multi-hop
fashion by using other smart devices.
The Following Attacks are possible in Device domain layer:-
1. Jamming Attack : When Malicious user called jammer emits a signal that interferes with
the legitimate signal.The Signal degrades the quality of signal if receiver is attacked or
blocks the signal from transmitting if sender is jammed. The physical layer in the OSI
stack of the device is the target for this attack.
2. Vampire Attack: Certain smart devices like smart watch , fitness bands and other wireless
devices have very limited battery life, Vampire Attacks as the name suggests drain the
battery by making the device misbehave in a way that consumes extra power.
a. Denial of Sleep: smart devices are designed with a capability to switch to sleep
mode when not in use, in this exploit the attacker prevents the smart device to enter
into deep sleep mode.
b. Flooding attack: Adversary floods the smart device(multihop) with packets to be
delivered to the fog device, making it consume extra amount of battery.
c. Carrousel Attack: If SOurce Routing is Supported, the Attacker makes the packet to
route back and forth from the same target leading to power waste.
d. Stretch Attack: If Source Routing is not supported then attacker can still select the
longest possible path covering every node in order to increase the power
consumption of theses devices.
3. Selective-Forwarding Attack: Smart Devices Does not generally have high transmission
rate, thus they rely on the multihop networks for delivery of packets to fog device. A
malicious object is placed in the hop network and this object is expected to forward only a
portion of packet to next hop causing it to resend again and again.
4. Sinkhole Attack: A Malicious object portray as having the shortest path to fog device,
causing other device to use his pathway and then the attacker can look into the packets if
sent unencrypted or can perform selective forwarding attack.
Attack
Security Violation
Jamming Attack Vampire Attack Selective
Forwarding Attack
Sinkhole Attack
Confidentiality
Availability
Freshness
9. Preventive Measures of IoT Attacks
Cloud Domain Measures
The following measures or defense can be used against Hidden-Channel Attacks:-
1. Hard Isolation: The basic idea behind this preventive technique is to maintain high levels
of isolation among the VMs. One way to do this is to complete isolate the cache dedicated
for each VM, without being said this is really hard to achieve because the data in the
cloud is shared and if this is not achieved there will be underutilization of servers in the
cloud. A better way to achieve hard isolation is by letting each cloud client specify a list of
trusted cloud users called the white list. The cloud client is fine with sharing the server
with only the VMs belonging to the whitelist users. New algorithms are needed in that
case to decide what sever each VM should be placed such that only VM belonging to
whitelist share the memory.
2. Cache Flushing: This technique flushes the shared cache every time the allocation of the
cache is switched from a VM to another. The downside of this countermeasure is that the
VMs running on the server will experience frequent performance degradation as the
shared cache will be emptied 8.5 Cloud Domain Attacks and Countermeasures 203 every
time a switch from a VM to another occurs, which increases the time needed to access
and fetch data due to higher cache misses.
3. Noisy Data Access Time: This technique adds random noise to the amount of time
needed to fetch data, which makes it hard to tell whether or not the data was fetched from
the cache or from the memory. This helps us in the way that the attacker won’t be able to
know if the data was fetched from another VM that shares the same server. But adding
noise to the data, it also adds time to fetch the data.
4. Limiting Cache Switching Rate: A relief system to constrain the measure of information
that can be spilled crosswise over VMs can be accomplished by constraining how
regularly the store is changed from a VM to another. The thought here is that if the store
isn't changed from a VM to another too early, at that point the VM that has the store will
adjust the substance of the where different lines of store will be supplanted different
circumstances. This makes it hard for another VM to achieve fine-grained information of
what information the past VM has gotten to while testing the reserve.
The following measures or defense can be used against VM Migration Attacks:-
1. Server Authentication: We need to authenticate the servers while the VM migration is
going on since in this process live data is transferred in some other VM. This is done by
transmitting the memory of one VM server to another. So, if no authentication is done
then the malicious attacker will be able to read all the content on this VM.
10. 2. Encrypting migrated memory pages: When the VM migration is going on, before doing
that we can encrypt the memory pages, which helps in the way that if attacker is seeing
the data in the migration process, it will be no use to him as all the memory pages will be
encrypted. This measure doesn’t affect the performance as much and will be a good
security measure for the migration.
The following measures or defense can be used against Theft-of-Service Attacks:-
1. Fine-grain sampling using high precision clocks: This measure helps in a way that since
the malicious attacker assigns more resources to the hypervisor totally than to share it.
So by using these high precision clocks we can do the sampling of resources to the
hypervisor by giving it a limited time for the resource allocation.
11. 2. Random sampling: This is another good technique to randomly allocate the resources to
the hypervisor so that no more resources can be added to it by anyone and everything
will be distributed evenly in the VM. It will help us if the attacker wants to give more
resources, he will not be able to do so.
The following measure can be used against VM escape Attacks:-
Add an isolation domain between the hypervisor and hardware: An example of such
techniques is CloudVisor which basically adds an extra isolation layer between the
hardware and the hypervisor through nested virtualization that prevents the malicious VM
from obtaining the root privileges even if it bypasses the hypervisor layer. Other
architecture solutions were also proposed to avoid VM Escape attacks.
The following measures or defense can be used against Insider Attacks:-
1. Homomorphic Encryption: It is a type of encryption that allows computations on
ciphertext, hence generating an encrypted result. So when it is decrypted, it matched the
result of operation as if they were performed on the plaintext. Applying this, in the IoT
allows cloud servers to perform the necessary processing operations on the encrypted
data that is collected from the smart devices without giving the cloud servers the ability to
interpret neither the input data nor the result as they are both encrypted using a secret
key that is not shared with the cloud. Only the smart objects and the user running the IoT
application can interpret these data as they have the key needed for decryption.
2. Secret storage through data chopping and permutation based on a secret key: Another
form of protection against insider attacks is to chop the data collected by the smart object
into multiple chunks and then to use a secret key to perform certain permutations on
those chunks before sending the data to the cloud servers. This allows storing the data on
the cloud servers in an uninterpretable form for the cloud administrators. Only authorized
entities that have the secret key can return the stored data to an interpretable form by
performing the correct permutations.
12. Edge Domain Measures
Edge devices uses the same VM or container concept of Cloud domain thus the same
measures can be used for Edge devices along with an Obfuscator device that prevents
Information leakage by by emitting signals that make it hard for an unauthorized receiver to
infer the amplitude, the frequency, and the time shift of the originally signals. The obfuscator
does not only prevent such leakages but also acts as a relay that rebroadcasts some of the
sent messages which increases the transmission rate between the sensing objects and the
fog domain.
Device Domain Measures
The following measures or defense can be used against Jamming Attack:-
1. Frequency Hopping: This is a technique when the sender and receiver switch from a
frequency to another in order to escape from any possible jamming signal. This switching
is based on a random sequence. If the attacker comes to know about this, he will try to
switch the frequency and collide with same frequency. But since it’s a 2 person game, the
chances of him colliding in the same frequency is very less.
2. Spread Spectrum: This technique uses a hopping sequence that converts the narrow
band signal into a signal with a very wide band, which makes it harder for malicious users
to detect or jam the resulting signal. This technique is also very efficient when the
transmitted data is protected by an error correction technique as it allows the
reconstruction of the original signal even if few bits of the transmitted data was jammed
by the attacker.
3. Directional Antennas: The use of directional antennas can mitigate jamming attacks from
being successful as the sender and receiver antennas will have less sensitivity to the
noise coming from the random directions that are different from the direction that
connects the sender and the receiver.
4. Jamming Detection: Different detective techniques were proposed in the literature to
detect jamming attacks. The receiver can detect that it is a victim of a jamming attack by
collecting features such as the received signal strength (RSS) and the ratio of corrupted
received packets. Advanced machine learning technique can then be used to differentiate
jamming attacks from the degradation caused by the poor quality of the channel due to
normal changes in the wireless link.
The following measures or defense can be used against Vampire Attack:-
1. Rate limitation: This technique is widely used in the datacenters on the hypervisor layer.
This is done to dedicate more resources to the rate limiters in the sense to enhance
performance and control the rate of traffic.
2. Monitor whether or not the forwarded packets are making progress towards their
destination: By this way, we can check if the packets being sent are received by the
receiver or not. If they are no making any progress then some on stealing packets in
between and data is being sent to the attacker.
The following measures or defense can be used against Selective Forwarding Attack:-
13. 1. Path Redundancy: The longer the path, more are the chances that there is a man in
middle to read all the data travelling in that path. Path redundancy helps in successful
packets sent to the receiver since, the distance is shot making it less vulnerable to any
attack.
2. Choose certain intermediate objects as checkpoints to acknowledge received packets:
This technique will ensure that the packets sent are received at every node. If there is a
reduction in received packets then keeping intermediate objects as checkpoints, we can
check where is the attacker and can fix that part.
The following measure can be used against Sinkhole Attack:-
Analyze the collected routing information from multiple objects: Another technique to
know about the packets received are equal to the packets sent from different objects in
the network.
Conclusion
Consumer should now indulge in simple practice to update passwords, softwares of these
current generation smart devices and manually check if its correct manufacturer version or
not.The user must also follow proper guidelines described by manufacturer for creating a
secure environment.
We have created a checklist practice for developer to follow based on Countermeasures to
be followed for up for upcoming products. The current Generation of IoT devices made the
manufacturers lot to learn from the security perspective, so for the next wave of devices the
following is a mandatory checklist:-
1. Authentication: Routers when first launched came with a default open link and
“admin“ password but now they are more secure by a complex set of initial password
because over the period of time the manufactures learned and implemented the
same should be followed for now smart devices.
2. Debug: Manufactures have bad habit of leaving debug access enabled on certain
devices with some hardcoded password and non standard port but attacks are one
step ahead it will eventually be discovered and exploited when physical access to
device is granted. So no debug mode.
3. Encryption: The world would be so simple if humans start trusting each other and we
stop investing in the cyber crime world probably in some parallel universe. Sending
unencrypted packets to other smart device/fog device or cloud device was a bad
idea. All communications between an IoT device and the cloud need to be
encrypted. Use SSL/TLS where appropriate.
4. Privacy: Ethical consideration is added whenever the term privacy is used. The data
stored in cloud server and used for analytics must be encrypted with the least amount
of personal data possible or better use links rather than real information.
5. Web Interface: Any web or app interface to communicate with the smart device must
be protected from other cyber security web attacks.
14. 6. Firmware updates: Frequent security patches are a must for current and future
generation devices. Bugs in code can be exploited and may cause security concerns.
Therefore all IoT devices should support Over-The-Air (OTA) updates along with
Signature verification.
The following covers enough for the next generation devices. The next gen devices will open
up new but hard to crack portals for attackers leading to more extended research on the
security of IoTs.
References
1. Ammar Rayes, Salam Samer (auth.), “Internet of Things From Hype to Reality: The Road
to Digitization [1 ed.]”
2. https://www.ibm.com/developerworks/library/iot-lp201-iot-architectures/
3. https://www.w3.org/Talks/2016/0614-iot-security.pdf
4. https://www.androidauthority.com/iot-security-gary-explains-727977/
5. https://medium.com/@Willitchang/bankex-iot-and-financial-revolution-660cc2e0584a
6. https://www.quora.com/Is-there-any-good-tutorial-resource-to-understand-Homomor
hic-Enc
7. ryption-from-scratch-OR-any-flow-of-background-study-to-understand-it
8. https://wso2.com/library/articles/2017/09/securing-communication-between-devices-and-t
he-iot-platform/
9. https://www.vmware.com/content/dam/digitalmarketing/vmware/en/pdf/techpaper/perform
ance/encrypted-vmotion-vsphere65-perf.pdf
10. https://en.wikipedia.org/wiki/Rate_limiting
11. https://en.wikipedia.org/wiki/Homomorphic_encryption