A survey of IoT protocols and their security issues through the lens of a generic IoT stack

Tournier, Jonathan; Lesueur, François; Mouël, Frédéric Le; Guyon, Laurent; Ben-Hassine, Hicham

doi:10.1016/j.iot.2020.100264

Cited by 79 publications

(48 citation statements)

References 63 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…3.3.1. Attacks in Physical, Data-Link, Network, and Transport Layers There are many works devoted to the attacks towards the layers and suggest the appropriate countermeasures [64][65][66][67]. Amongst the most common threats in physical and data-link layers is the denial of service (DoS) attacks.…”

Section: Protocols Attacksmentioning

confidence: 99%

Cyber Threats to Industrial IoT: A Survey on Attacks and Countermeasures

Τσίκνας¹,

Taketzis²,

Demertzis³

et al. 2021

Preprint

View full text Add to dashboard Cite

In today’s Industrial IoT (IIoT) environment, where different systems interact with the physical world, the state proposed by the Industry 4.0 standards can lead to escalating vulnerabilities, especially when these systems receive data streams from multiple intermediaries, requiring multilevel security approaches, in addition to link encryption. At the same time taking into account the heterogeneity of the systems included in the IIoT ecosystem and the non-institutionalized interoperability in terms of hardware and software, serious issues arise as to how to secure these systems. In this framework, given that the protection of industrial equipment is a requirement inextricably linked to technological developments and the use of the IoT, it is important to identify the major vulnerabilities, the associated risks and threats and to suggest the most appropriate countermeasures. In this context, this study provides a description of the attacks against IIoT systems, as well as a thorough analysis of the solutions against these attacks, as they have been proposed in the most recent literature.

show abstract

Section: Protocols Attacksmentioning

confidence: 99%

Cyber Threats to Industrial IoT: A Survey on Attacks and Countermeasures

Τσίκνας¹,

Taketzis²,

Demertzis³

et al. 2021

Preprint

View full text Add to dashboard Cite

show abstract

“…The massive development of IoT in recent times has exposed it to several different vulnerabilities and threats. In this context, several researches [4], [15]- [19] have been carried out to collect and provide taxonomies about cyber-security threats in IoT, mainly based on the architecture levels characterizing such environments. A recent detailed survey [4] has categorized IoT attacks into physical, network, software and data attacks, with a focus on Industrial IoT, also giving related countermeasures.…”

Section: Related Workmentioning

confidence: 99%

“…device property, information damage level, location, strategy, host-based, access level, communication stack protocols, protocol-based). Instead, [19] describes IoT attacks in general, regardless the underlying protocol. This approach exposes similar attacks to different IoT protocols, by adopting an approach focusing on packets, protocols or the whole system.…”

Section: Related Workmentioning

confidence: 99%

Exploiting Internet of Things Protocols for Malicious Data Exfiltration Activities

et al. 2021

View full text Add to dashboard Cite

Internet of Things is a widely adopted and pervasive technology, but also one of the most relevant in cyber-security, given the volume and sensitivity of shared data and the availability of affordable but insecure products. In this paper, we propose a novel cyber-threat exploiting the Message Queue Telemetry Transport (MQTT) protocol to implement a tunneling attack. In IoT networks, sensitive and critical information are exchanged between devices or external systems to perform data analysis. For this reason, a tunneling threat could be adopted by a malicious user to steal information. In this context, a tunneling system based on MQTT can be considered since this communication protocol could be allowed to pass through enterprise firewalls because it is widely adopted in this IoT world. An attacker can exploit the MQTT protocol for various purposes such as steal information or access to not-allowed websites/servers. In particular in this work, we contribute in two main points: initially we demonstrate how the proposed threat is able to encapsulate messages through the MQTT protocol, by also comparing it with other tunneling systems exploiting different communication protocols. Obtained results show that exploiting MQTT for tunneling purposes is a good choice, compared to other communication protocols, especially for payloads up to 3000 bytes. Then, we propose and validate an initial machine learning based approach able to detect the proposed MQTT tunnel, by comparing different detection algorithms tested with and without a hyperparameter optimization, in terms of accuracy, F1 score and Receiver Operating Characteristic (ROC) curve. In this case, obtained results show that some algorithms are able to identify the attack, with an accuracy exceeding 95%, while others lack of such capability.

show abstract

“…The IoT is globally connected networks, which are associated with each other via the Internet [1]. IoT is rapidly growing, as the number of devices increases in the network [2]. IoT broadens the likelihood of the Internet and makes it unavoidable [3].…”

Section: Introductionmentioning

confidence: 99%

Efficient Key Management System Based Lightweight Devices in IoT

Priyadharshini¹,

Geetha²

2022

Intelligent Automation &Amp; Soft Computing

View full text Add to dashboard Cite

The Internet of Things (IoT) has changed our lives significantly. Although IoT provides new opportunities, security remains a key concern while providing various services. Existing research methodologies try to solve the security and time-consuming problem also exists. To solve those problems, this paper proposed a Hashed Advanced Encryption Standard (HAES) algorithm based efficient key management system for internet-based lightweight devices in IoT networks. The proposed method is mainly divided into two phases namely Data Owner (DO) and Data User (DU) phase. The DO phase consists of two processes namely authentication and secure data uploading. In authentication, the registration process consists of three phases namely KGC, SCC and DVC. In Key Generation Center (KGC), the device ID is converted into a 128-bit hash key using the Point on Curve based Fowler-Noll-Vo (PoC-FNV) algorithm. In DVC, the Data Access Policy (DAP) is created by using the selected attributes which is in turn selected by using the Chen Chaotic Chimp Optimization Algorithm(CCCOA). Thus, the authentication information is stored in the blockchain. If the person is an authorized, then the data is securely stored and uploaded into the cloud server using HAES. In the DU phase, the DU sends the data access request to the blockchain then the blockchain forwards the request to the DO, if the DO accepts the request then the DU obtains the data by using the DAP. Finally, the performance of the proposed method is compared with the existing methods and attains better result than the existing research methodologies.

show abstract

A survey of IoT protocols and their security issues through the lens of a generic IoT stack

Cited by 79 publications

References 63 publications

Cyber Threats to Industrial IoT: A Survey on Attacks and Countermeasures

Cyber Threats to Industrial IoT: A Survey on Attacks and Countermeasures

Exploiting Internet of Things Protocols for Malicious Data Exfiltration Activities

Efficient Key Management System Based Lightweight Devices in IoT

Contact Info

Product

Resources

About