Apparatus: Reasoning About Security Requirements in the Internet of Things

Abstract

Abstract. Internet of Things (IoT) can be seen as the main driver towards an era of ubiquitous computing. Taking into account the scale of IoT, the number of security issues that emerge are unprecedented, therefore the need for proposing new methodologies for elaborating about security in IoT systems is undoubtedly crucial and this is recognised by both academia and the industry alike. In this work we present Apparatus, a conceptual model for reasoning about security in IoT systems through the lens of Security Requirements Engineering. Apparatus is architecture-oriented and describes an IoT system as a cluster of nodes that share network connections. The information of the system is documented in a textual manner, using Javascript Notation Object (JSON) format, in order to elicit security requirements. To demonstrate its usage the security requirements of a temperature monitor system are identified and a first application of Apparatus is exhibited.

A conceptual model to support security analysis in the internet of things

“…The presented model extends our previous work on the APPARATUS framework [31]. The initial model of APPARATUS consisted of two concepts.…”

“…The conceptual model enables reasoning about security in IoT systems using information retrieved by studying the hardware architecture of an IoT system. The proposed model is based on our previous work [31], which models the hardware architecture of an IoT system with its core concepts being the IoT node and the network connection. The architecture of a system offers valuable information for security analysis, such as the supported protocols of network connections between nodes or the flow of data inside a network domain.…”

“…The architecture of a system offers valuable information for security analysis, such as the supported protocols of network connections between nodes or the flow of data inside a network domain. On the other hand, [31] does not express certain aspects of a system, such as user interaction or authentication mechanisms. Thus, the proposed conceptual model aims to address the limitations of a hardware architectural approach by introducing non-hardware architectural concepts along with hardware architectural concepts.…”

“…-IoT systems are a network of various devices. Our initial attempt in [31] was to model an IoT system in a similar manner to a computer network. In our present work, we introduce concepts to express users, threat or security policies.…”

Supporting Privacy by Design Using Privacy Process Patterns

“…the selection of most suitable privacy enhancing technologies to apply in their context. PriS extended version is expressed in the JSON format, which is an Open Standard used to transmit data objects consisting of attribute-value pairs [32]. The attribute is immutable and corresponds to the concepts of the model.…”