Designing Security and Privacy Requirements in Internet of Things: A Survey

Abstract

The design and development process for the Internet of Things (IoT) applications is more complicated than that for desktop, mobile, or web applications. First, IoT applications require both software and hardware to work together across many different types of nodes with different capabilities under different conditions. Secondly, IoT application development involves different types of software engineers such as desktop, web, embedded and mobile to work together. Further, non-software engineering personal such as business analysts are also involved in the design process. In the addition to the complexity of having multiple software engineering specialists cooperating to merge different hardware and software component together, the development process required different software and hardware stacks to integrated together (e.g., different stacks from different companies such as Microsoft Azure, IBM Bluemix). Due to above complexities, more often non-functional requirements (such as security and privacy which are highly important in the context of IoT) tend to get ignored or treated as second class citizens in IoT application development process. In this paper, we have reviewed techniques, methods and tools that are being developed to support incorporating security and privacy requirements into traditional application designs. By doing so, we aim to explore how those techniques could be applicable to the IoT domain. During our review, we realised that by far the majority of the requirement engineering efforts are focused on security. In this paper, we primarily focused on two different aspects: (1) design notations, models, and languages that facilitate capturing non-functional requirements (i.e., security and privacy), and (2) proactive and reactive interaction techniques that can be used to support and augment the IoT application design process. Our goal is not only to analyse, compare and consolidate past research work but also to appreciate their findings and discuss their applicability towards the IoT.CCS Concepts: • Human-centered computing → Ubiquitous and mobile computing systems and tools; Visualization systems and tools; • Software and its engineering → Software design engineering; • Security and privacy → Security requirements;