3/17/2025

IoT Network Security

* The Internet of Things is the latest development in the long

and continuing revolution of computing and communications.

* The Internet of Things (IoT) is a term that refers to the

expanding interconnection of smart devices, ranging from
appliances to tiny sensors.

* IoT is perhaps the most complex and undeveloped area of

network security.

1
 3/17/2025

Applications of IoT
• Example of IoT application in our daily life.

What Are IoT Devices?

• An IoT device is simply an
electronic device that is connected
to the Internet.
• There are several basic properties
that qualify a device as an “IoT”
device:

1. A physical device/object
2. Contains controller(s),
sensor(s), and or actuator(s)
3. Connects to the Internet

• Examples: Amazon Alexa,

Samsung Smart TV, Google
Home, NEST Security Camera
• Generally labeled as “Smart
Devices”

2
 3/17/2025

IoT Benefits:
1- Lowering operating costs.

2- Increasing productivity.

3- Expanding markets.

4- Developing smart product /services.

5- Customer insight analytics.

IoT Security:

IT is based on a cyber security strategy to protect IoT devices and the

vulnerable networks they connect to from cyber attacks. IoT devices
have no built-in security.

Major Challenges in Security:

1- More devices, more problems

2- Device Updates issue
3- A trillion points of vulnerability
4- Data collection, protection and privacy
5- Trust and data integrity

3
 3/17/2025

Why is IoT Security so Important?

• IoT devices are typically not very secure.

• They use simple default passwords.

• Left on the corporate or home network visible to

other devices/servers/computers.

What is IoT?

IoT is the name for the inter-connection of devices to networks and the
internet, allowing devices to send and receive information from one
another.

Challenges with IoT Security:

1- No standards for IoT hardware and software.

2- Manufacturers are relied on for upgraded security and can stop
supporting security updates.
3- IoT devices can be small, inexpensive.
4- Minimum functionality can result in security being a 2nd priority.

4
 3/17/2025

Tamper Resistance and Detection:

An IoT ecosystem involves a large number of devices deployed in the

edge network and in the fog network. Two essential security measures in
such an environment are tamper resistance and tamper detection.

■ Tampering: An unauthorized modification that alters the intended

functioning of a system or device in a way that damages the security it
provides.

■ Tamper resistant: A characteristic of a system component that

provides inactive protection against an attack.

■ Tamper detection: Techniques to ensure that the overall system is

made aware of unwanted physical access.

Components of IoT-Enabled Things

5
 3/17/2025

Components of IoT-Enabled Things:

◆■ Sensor: A sensor measures some parameter of a physical, chemical, or biological

entity and delivers an electronic signal proportional to the observed characteristic, either
in the form of an analog voltage level or a digital signal. In both cases, the sensor
output is typically input to a microcontroller or other management element.

◆■ Actuator: An actuator receives an electronic signal from a controller and

responds by interacting with its environment to produce an effect on some parameter
of a physical, chemical, or biological entity.

◆■ Microcontroller: The “smart” in a smart device is provided by a deeply embedded

microcontroller.

◆■ Transceiver: A transceiver contains the electronics needed to transmit and receive

data. Most IoT devices contain a wireless transceiver, capable of communication using
Wi-Fi, ZigBee, or some other wireless scheme.

◆■ Power supply: Typically, this is a battery.

IoT devices also often contain a Radio-Frequency Identification (RFID) component.
RFID technology, which uses radio waves to identify items, is increasingly becoming
an enabling technology for IoT.

IoT and Cloud Context:

1- Edge: At the edge of a typical enterprise network is a network of IoT-enabled devices,
consisting of sensors , perhaps actuators and gateway (interconnects the IoT-enabled
devices with the higher-level communication networks).

2- Fog: the fog computing level is to convert network data flows into information that is
suitable for storage and higher level processing. Fog computing addresses the challenges
raised by the activity of thousands or millions of smart devices, including security, privacy,
network capacity constraints, and latency requirements. Examples of fog computing operations:
 Evaluation: Evaluating data for criteria as to whether it should be processed at a higher
level.
 Formatting: Reformatting data for consistent higher-level processing.
 Expanding/decoding: Handling cryptic data with additional context (such as the origin).
 Distillation/reduction: Reducing and/or summarizing data to minimize the impact of data
and traffic on the network and higher-level processing systems.
 Assessment: Determining whether data represent a threshold or alert; this could include
redirecting data to additional destinations.

3- Core: The core network, also referred to as a backbone network, connects geographically
dispersed fog networks as well as provides access to other networks that are not part of the
enterprise network.

4- Cloud: The cloud network provides storage and processing capabilities for the massive
amounts of collected data that originate in IoT-enabled devices at the edge.

6
 3/17/2025

The IoT/Cloud Context

IoT Security Objectives:

1- Restricting logical access to the IoT network. By using for example firewalls.

2- Restricting physical access to IoT network and components. By using for example
locks, card readers.

3- Protecting individual IoT components from misuse. By using for example: disabling
all unused ports and services, restricting IoT user privileges.

4- Preventing unauthorized modification of data.

5- Detecting security events and incidents. The object is to detect security events
early enough to break the attack chain before attackers attain their objectives.

6- Maintaining functionality during adverse conditions.

7- Restoring the system after an incident

7
 3/17/2025

IoT Gateway Security Functions

Gateway Security:
A key element in providing security in an IoT deployment is the
gateway.
The requirements are defined as being the functional requirements
during capturing, storing, transferring, collecting and processing the data
of things, as well as to the provision of services which involve things.
These requirements are related to all the IoT actors. The requirements
are:

1- Communication security.
2- Data management security.
3- Service provision security.
4- Integration of security policies and techniques.
5- Common authentication and authorization.
6- Security audit.

8
 3/17/2025

Specific security functions that the gateway should

Implement:

1- Support identification of each access to the connected devices.

2- Support authentication with devices.

3- Support common authentication with applications.

4- Support the security of the data.

5- Support mechanisms to protect privacy for devices and the gateway.

6- Support self-diagnosis and self-repair as well as remote maintenance.

7- Support firmware and software update.

8- Support auto configuration or configuration by applications.

IoT Security Environment

9
 3/17/2025

The IoT Security Environment:

1- User authentication and access control. A common approach to

access control is role-based access control (RBAC). RBAC systems
assign access rights to roles instead of individual users.

2- Tamper resistance and detection.

3- Data protection and confidentiality.

4- Internet protocol and network security. Protection of data in motion

from eavesdropping and snooping is essential between all levels.

AN OPEN-SOURCE IOT SECURITY MODULE:

MiniSec: an open-source security module that is part of the TinyOS

operating system. TinyOS is designed for small embedded systems with
tight requirements on memory, processing time, real-time response, and
power consumption. The main application of TinyOS is wireless sensor
networks. With sensor networks, the primary security concerns relate to
wireless communications.
MiniSec is designed to be a link-level module that offers a high level of
security, while simultaneously keeping energy consumption low and
using very little memory. MiniSec provides confidentiality,
authentication, and replay protection.

MiniSec has two operating modes:

1- Single-source communication. [unicast (MiniSec-U) ]

2- Multi-source broadcast communication. [broadcast (MiniSec-B ]

10
 3/17/2025

MiniSec is designed to meet the following requirements:

◆■ Data authentication: Enables a legitimate node to verify whether a message

originated from another legitimate node (i.e., a node with which it shares a secret key)
and was unchanged during transmission.

◆■ Confidentiality: A basic requirement for any secure communications system.

◆■ Replay protection: Prevents an attacker from successfully recording a packet

and replaying it at a later time.

◆■ Freshness: Because sensor nodes often stream time-varying measurements,

providing guarantee of message freshness is an important property. There are two types
of freshness: strong freshness and weak freshness. MiniSec provides a mechanism to
guarantee weak freshness, where a receiver can determine a partial ordering over
received messages without a local reference time point.

◆■ Low energy overhead: This is achieved by minimizing communication overhead

and by the use of only symmetric.

◆■ Resilient to lost messages: The relatively high occurrence of dropped packets in

wireless sensor networks requires a design that can allow high message loss rates.

Default Passwords
• A lot of devices come preconfigured with
simple default username/passwords.

• It is important to change these default

passwords to new secure ones as soon as you
get the device.

11
 3/17/2025

Real World
Examples: Mirai
• Botnet was created using IoT devices (Cameras, printers,
refrigerators, doorbells, baby monitors, etc.).

• Hundreds of thousands of devices infected.

• DDoS against (Domain Name System (DNS) service

provider).

• DNS translates an IP address to the website name (Netflix,

Twitter, AWS, Etsy, Paypal, etc.).

Case: Dyn Botnet DDoS Attack (Cont.)

12
 3/17/2025

IoT Security Measures:

A. Authentication and Access Control
- Strong authentication mechanisms, such as unique device credentials and secure access tokens, help
ensure that only authorized entities can access IoT devices.
- Access control mechanisms should be implemented to restrict device access to trusted users and networks.

B. Data Encryption and Integrity

- Data transmitted between IoT devices, gateways, and cloud services should be encrypted to prevent
unauthorized interception or tampering.
- Encryption protocols like Transport Layer Security (TLS) should be employed to protect data
confidentiality and integrity.

C. Over-the-Air (OTA) Updates and Patch Management

- Regular OTA updates should be provided to IoT devices to address security vulnerabilities and patch
software/firmware flaws.
- Robust patch management processes help ensure that devices remain secure against known exploits.

D. Network Segmentation and Firewalls

- IoT devices should be segregated into separate network segments to limit the impact of a compromised
device
- Firewalls should be implemented to filter incoming and outgoing traffic, preventing unauthorized access
to devices and networks.

E. Physical Security Measures

- Physical security measures, such as tamper-proofing, secure boot mechanisms, and hardware-based
security modules, should be implemented to protect IoT devices from physical attacks

Security requirement for

Smart Home
• Based on the type of threat and vulnerabilities.

– Confidentiality
• To preventing disclosure of information to unauthorized persons, parties or systems.

– Integrity
• To preventing modification of data transmitted in the network by unauthorized persons
or systems.

– Freshness
• Data freshness and key freshness - No old messages generated.

– Availability
• To ensuring that unauthorized persons or systems cannot deny access system resources
to authorized users.

– Authenticity
• To enclose the true identity of a system user or entity and mapping of this identity to a
system-internal principal.

13
 3/17/2025

Attack and Countermeasure

• Two type of attack

– Outside attack
• An outsider adversary or attacker is not a participant of
the network.

– Inside attack
• Inside attack consists of attacking nodes by running
malicious code in them.

Attack and Countermeasure in IoT

Outside Attack
• Eavesdropping
– Passively eavesdrop on the network communication and steal
the data.
– Difficult to detect
– Advanced techniques
• Send requests

• Denial of Service (DoS)

– To transmit signals
• To interfere with the radio frequencies.
– To generating collisions.

14
 3/17/2025

Attack and Countermeasure in IoT

Inside Attack
• Node Compromise
– Captured and compromised - Reprogrammed by an attacker.
– Use computing and radio power – Insert malicious code.

• Sinkhole and Wormhole Attacks

– Malicious node attracts network packets towards it by
spreading false routing information
• To reshapes the network's routing behaviour.

• Physical Attack
– To gain physical access to sensors.
– Destroy, stealing, malicious code and retrieve secret.

Solution of Threats
Type of threat Solution
• Eavesdropping • Strong encryption and
decryption technique
• Authentication and integrity
mechanisms

• Denial of Service (DoS) • Random back-offs - Decrease

the rate of collision
• Node Compromise • Verification process – Verify
memory of a sensor node by
calculate hash values

• Sinkhole and Wormhole • Unique symmetric shared key

Attacks with the base

• Physical Attack • Tamper proof hardware

15
3/17/2025

16