Analysis Of IoT Authentication Schemes And Security Risks

Evolution of IoT and its Security Risks

Discuss about the Analysis of Authentication Techniques in Internet.

The paper is The involvement of Internet of Things in our day to day life is increasing day by day. It is getting involved in every aspects of our life. Its application ranges from smart homes to wearable devices and many more. This paper is generally associated with analysis of the different authentication schemes that has been proposed in the literature. Different authors working with the IoT and their security risks. Some of the utors who have worked with the similar paper includes  Yuchen Yang;  Longfei Wu  ;  Guisheng Yin ;  Lijie Li ;  Hongbin Zhao who have worked with the security and privacy issues related to the use of IoT and survey of the existing protocols and  open research issues done by Jorge Granjal ;  Edmundo Monteiro and  Jorge Sá Silva . There are also other journals and papers written by different authors about the internet of things and this paper has been created after taking help from those journals and papers. Along with this after taking assistance from the multi-criteria classification comparison and analysis of the existing protocol has been done by showing the advantages and disadvantages as well. Research in the field of IoT along with the authors of this paper have been published by Cyber Security in Networking Conference (CSNet) which acts as a very important source in collection of data regarding this new IoT technology. Other authors whose works have been cited in this paper helps a lot in understanding the different authentication factors needed. Along with which the security and the privacy issues which might arise due to various threats can also be known very easily and how those threats can be eliminated.

The IoT platform has gradually evolved along with time. The report mainly discusses about the evolvement of IoT in today’s world.  Its vast functionalities and applications has grew up in last few decades and has been integrated in various domains. A revolutionary transformation has been demonstrated regarding the concept of man-to-man communication tool into all-to-all communication model. Which initially leads to lot of challenges and risks [1]. For the hackers IoT turns out to be a new and attractive environment where they can perform all their unethical actions and develop a scope for the expansion of their network. The paper is associated with providing of different types of authentication schemes that has been proposed in the literature. By application of a multi-criteria classification the report has been comparing and analyzing the protocols which are existing along with showing the advantages as well as the disadvantages [4].

Authentication Schemes and their Classification

The report also analyses the Authentication scheme as well which involves the “taxonomy of IoT authentication schemes” and “Analysis of IoT Authentication Schemes”. The taxonomy of the authentication scheme presents a wide classification. Along with this the table provided below also summarizes outcomes of the analysis for different types of authentication process. The table contains the authentication schemes which is classified according to different criteria’s along with the main strengths as well as the weakness the table of the authentication protocols has been made by using of multiple criteria and this criteria’s are based upon the similarities and the commonalities along with the important features of the existing authentication scheme as well.     

Encryption and authentication can be a vital process in saving of the personal information present in the IoT devices. Almost every vendor software lack in this type of security feature. Few thing in which there is a need of focusing involves encryption which is the easiest way to fix errors and there is only need of wrapping all the communication or the storage in the SSL or in some other algorithm [5]. Secondly algorithm, which is somewhat very hard to fix especially for eth IoT devices but certainly use of biometric would greatly help. Another way of securing the IoT is by application of industry standard methodology which would be responsible for the application of various security standards at the beginning of the process not at the end. One such example which contains some best practices for addressing this is the Open Web Application Security Project or OWASP. Encryption can act as a very useful way in securing the data stored. IoT is responsible for leading to an era of omnipresence of smart connected devices. It is highly impractical for the determination of the trustworthiness of every single device [10]. Most of the access breach occurs due to use of easy passwords which can be guessed very easily. There should exists certain criteria’s which would help the user in having a highly protected password this might including of capital words in the password, or use of symbols and many more. Along with the password used for accessing should also be changed in frequent interval of time [3].

This paper is generally associated with analyzing the existing authentication and access control methods along with designing of a feasible method for the Internet of Things. Before wide deployment of the IoT there is an essential need of considering the security and the privacy issues.  The report also consists of the definition of Internet of Things which states that various smart devices are forming a global and internet based information service platform which is known as the IoT. Generally IoT is considered to be an architecture which is based upon the existing data communication tool.  The authors of this field mainly includes Luigi Atzori , Antonio Iera , Giacomo Morabito who have been working on conducting a survey over the IoT so as to analyze the different aspects of IoT. Other authors like Rolf H.Weber has reviewed the need of legal environment for the IoT devices. He has also been working on the new security and privacy challenges related to IoT. There are also author authors who have been working in this field. This paper was published in the 32^nd International Conference on Distributed Computing Systems Workshops along with other similar types of research paper.                                          

Feasible Methods for Securing IoT Devices

The report discusses the most challenging topics in an interconnected IoT system of miniaturized “things” are security and privacy aspects. Before the IoT existed, the corrupted digital systems were mostly unable to act in the physical world. This is expected to change dramatically and dangerously now that corrupted digital systems can operate in and influence the physical world. Along with this, it is also discussed that the authentication and access control technologies are also known as the central elements which are responsible for addressing the security as well as the Privacy problems that exist in the computer networks [2]. They are also capable of preventing any type of unauthorized user to gain access of the resources along with prevention of the legitimate users to access the resources in an unauthorized manner and enable legitimate users to access resources in an authorized manner.

The design has also been discussed in brief. The design section consists of the description of the architecture of the design, authentication protocol, access control and lastly the security analysis. In the security analysis portion, the author analyzes their proposed protocol so as to check whether it is secure or not. According to the conclusion drawn from the literature, the architecture has been designed. According to the conclusion, it can be stated that things or objects will become the end nodes in the environment of the internet. Along with this, they are also having a unique goal address and besides this, they are also capable of communicating with each other over the internet. The example of the architecture has also been provided. Secondly, the report also describes how the authentication protocol acts along with providing some of the relevant terms that can be used. After that, the author describes the access control process [2]. Access control algorithm is generally associated with deciding the fact whether a new connection is to be accepted or not whenever the assurance regarding the quality of the connection has been ensured. Access control part also contains a section where two types of call have been described. The features of the network differ accordingly in IoT. Lastly, in the security analysis portion, the protocol is tested against different types of attack like the eavesdropping attack, man-in-the-middle attack, key control attack and replay attack. Lastly, the report concludes with the fact that the proposed model is protected against the different types of attack [2].

Design and Security Analysis of Proposed Protocol

The model can be included by having a backup system which can greatly help in times of security hazards. The backup can help in getting back to data very easily whenever a security breach occurs along with this there should also exist some plan for the protecting the IoT from any type of security breach. Along with there should also exist a two-step verification process. This would initially help in adding of another layer for the protection of the data [4]. Above all, there should also exist a constant process of testing. Testing should be always done as more and more types of attacks are being invented by the hackers so as to perform all their unethical works. Another thing that is to be done is consulting with an expert. Many traditional industries have not thought of the security but not due to rising threats they have started of thinking about the security. There should also exist an added web application firewall as well as real time backups.

Looking into the emergence of IoT technology in today’s world it can be concluded that it is increasing day by day.  Remaining secure, vigilant and resilient is one of the import factor in IoT world. These are first three principles which should be considered while thing about the security of the system. Along with this, the security risks associated with the IoT is also increasing day by day [9]. The hackers pose a great amount threat to the IoT devices so the main question which arises is whether the IoT devices that we are using in day to day activity is safe or not. Every IoT requires at least one personal information of the user and that information might be very much vital for the user. Breach of that type of information can cause a huge amount of problem for the user.

The second question that arises after reviewing the first paper is that how much secure are the authentication schemes. And if those authentication schemes are effective or not. Secondly, another question that arises is that what would be affected if those authentication schemes fail. There are many cases when the authentication schemes get breaches by the hackers. Talking about the hackers, another question that exists is in what ways a hacker attacks the system and would the hacker be doing with the information that they get after breaching the system [6]. There are several ways by which the hackers attacks the system and besides this new ways are being invented by the hackers for breaching the system. The most important questions amongst all is is the use of IoT technology is secure at all or not. There exists various weak points in an IoT device so the question is how much are the developers of the devices working on it so as to protect the data. The security features of the devices are not only to be maintained by the developer but also by the user as well.

Conclusion

In the second literature the model which has been propose has tested it against different types of devices like eavesdropping attack, man-in-the-middle attack, key control attack and replay attack but the question is if the model is at all secure against any type of attacks other than the attacks which has been discussed in the report. The authentication protocol used by the author is also a primitive one so another question that exists is if the model is secure against any type of new attack or not [8]. The paper has the main focus of establishing a simple and efficient secure key which would be based upon the EE or the Elliptical Curve Cryptosystem. And the model has also made use of the RBAC or role based access control for the purpose of designing the access control policy.  RBAC based authorization methodology has been adopted by making use of the IoT’s particular roles and the applications in association with the IoT network [7]. The security and privacy level of this model has led to the development of a question that is what is the level of security and privacy of this model. Lastly the question that that arises is how much are the users aware of the IoT technology that they are using. There exists many ways in which the data can be protected along with the growth of the technology and the rising threats. Firstly the thing which is to be considered is staying educated on the latest security policies. The number of users who are authorized to gain access of the system should also be limited and taken care of along with changing of passwords at regular intervals.

References

[1] El-hajj, M., Chamoun, M., Fadlallah, A., & Serhrouchni, A. (2017, October). Analysis of authentication techniques in Internet of Things (IoT). In Cyber Security in Networking Conference (CSNet), 2017 1st (pp. 1-3). IEEE.

[2] Liu, J., Xiao, Y., & Chen, C. P. (2012, June). Authentication and access control in the internet of things. In Distributed Computing Systems Workshops (ICDCSW), 2012 32nd International Conference on (pp. 588-592). IEEE.

[3] Borgohain, T., Borgohain, A., Kumar, U., & Sanyal, S. (2015). Authentication systems in Internet of Things. arXiv preprint arXiv:1502.00870.

[4] e Silva, E. D. O., de Lima, W. T. S., Ferraz, F. S., & do Nascimento Ribeiro, F. I. (2017). Authentication and the Internet of Things. ICSEA 2017, 4(6), 45.

[5] Kothmayr, T., Schmitt, C., Hu, W., Brünig, M., & Carle, G. (2013). DTLS based security and two-way authentication for the Internet of Things. Ad Hoc Networks, 11(8), 2710-2723.

[6] He, D., & Zeadally, S. (2015). An analysis of rfid authentication schemes for internet of things in healthcare environment using elliptic curve cryptography. IEEE internet of things journal, 2(1), 72-83.

[7] Lee, J. Y., Lin, W. C., & Huang, Y. H. (2014, May). A lightweight authentication protocol for internet of things. In Next-Generation Electronics (ISNE), 2014 International Symposium on (pp. 1-2). IEEE.

[8] Hummen, R., Ziegeldorf, J. H., Shafagh, H., Raza, S., & Wehrle, K. (2013, April). Towards viable certificate-based authentication for the internet of things. In Proceedings of the 2nd ACM workshop on Hot topics on wireless network security and privacy (pp. 37-42). ACM.

[9] Zhao, K., & Ge, L. (2013, December). A survey on the internet of things security. In Computational Intelligence and Security (CIS), 2013 9th International Conference on (pp. 663-667). IEEE.

[10] Sicari, S., Rizzardi, A., Grieco, L. A., & Coen-Porisini, A. (2015). Security, privacy and trust in Internet of Things: The road ahead. Computer networks, 76, 146-164.