Web of Things: Security Challenges and Mechanisms

Abstract

Web of things (WoT) is an improved and most promising infrastructure of the internet of things (IoT) which permits the smart things to not only integrate to the internet but also to the web. It allows the users to share and create content as well as provide capabilities for data aggregation and analysis through a network to become part of the World Wide Web (W3). Despite these advances, it has shown several security challenges that need to be addressed for the successful deployment of WoT on a commercially variable and large scale. In this paper, authors have analyzed the most noticeable security challenges related to WoT such as unauthorized access, eavesdropping, denial of service attack, tempering, and impersonating, through an analysis of already published empirical studies. Further, we have discussed some of the available mechanisms to overcome security related issues while taking into account the network size and mobility. Authors have used Threat analysis and attack modeling methods to inform the users about defensive measures and to prevent security threats from taking advantage of system flaws Authors have provided the necessary insight into how security can be improved by using certain existing mechanisms and algorithms. The findings of the study revealed that security mechanisms to secure WoT are still immature and future research is required to resolve these challenges. INDEX TERMS Web of things, internet of things, security challenges, security mechanisms, World Wide Web, security analysis, attack modelling I.

A Survey on the Web of Things

“…Security is a key requirement for most of WoT systems, and it is also a wide area including issues of authorization to WT functionalities, protection of the underlying Thing, WT data integrity, and confidentiality, just to name a few. At the same time, we remark that most of the WoT security challenges recall the same challenges that affect the IoT and the Web in general, and for which many solutions have been proposed so far [45] [87] [126]. This holds in particular for the W3C WoT, since, as highlighted in [154], "The Web of Things is descriptive, not prescriptive, and so is generally designed to support the security models and mechanisms of the systems it describes, not introduce new ones".…”

Security issues of the Web of Things: challenges and solutions

“…Unauthorized Access: Unauthorized users can access a WoT devices of another person's account through bypassing the different authentication and authorization methods, and then get the possibility to modify any private data stored at the WoT device [12].…”

“…Eavesdropping: It is a type of man-in-the-middle attack in which confidentiality can be compromised as traffic flows between different objects. By which an attacker can have access to the credentials of the victim by stealing information such as login, and password [12].…”

“…Usually, this information is saved in cookies, which is hidden in URL query strings used to enhance the functionality and control of the application. A tampering attack can be made by a malicious person who wants to modify the application to his advantage or by an attacker who wants to harm a third party by using a man-in-a-middle attack [12].…”

“…Table 1 summarizes this section, giving the benefits and proposed solutions for each security mechanism. • User-centric model [12].…”