UNIT 5 PPT.pptxThe Internet of Things (IoT) refers to a network of interconnected physical objects such as devices, machines, vehicles, or people embedded with sensors, software, and unique identifiers that enable them to collect, exchange, and process da

The Internet of Things (IoT) refers to a network of interconnected physical objects such as devices, machines, vehicles, or people embedded with sensors, software, and unique identifiers that enable them to collect, exchange, and process data over a network without requiring direct human-to-human or human-to-computer interaction.

1. IOT Security Fundamental idea - IoT will connect all objects around us to provide smooth communication Economic of scale in IoT presents new security challenges for global devices in terms of Authentication Addressing Embedded Security

2. IOT Security Devices like RFID and sensor nodes have no access control functionality Can freely obtain or exchange information from each other So authentication & authorization scheme must be established between these devices to achieve the security goals for IoT Privacy of things and security of data is one of the key challenges in the IoT

3. Vulnerabilities of IoT

4. Vulnerabilities of IoT Unauthorized Access One of the main threats is the tampering of resources by unauthorized access Identity- based verification should be done before granting the access rights Information corruption Device credential must be protected from tampering Secure design of access rights, credential and exchange is required to avoid corruption

5. DoS Attack Denial of Service (DoS) Makes an attempt to prevent authentic user from accessing services which they are eligible for For example, unauthorized user sends to many requests to server That flood the network and deny other authentic users from access to the network

6. DDoS Attack Distributed Denial of Service Type of DoS attack where multiple compromised systems are used to target single system causing DoS Compromised systems – usually infected with Trojan Victims of a DDoS attack consist of both End targeted systems All systems maliciously used and controlled by the hacker in the distributed attack

7. Security Requirements

8. Security Architecture for IoT

9. IoT Security Tomography Classified according to attacks addressing to different layers Transport Layer- sends wrong data and inject incorrect control packets Network Layer- routing loop,wormhole attack and network partitioning MAC layer- spoofing,buffer overflow, eavesdropping and os level threats. RF layer- complete jamming,eavesdropping,hardware/ sensor level threat

10. IoT Security Tomography

11. Key Elements of Security Authentication Access Control Data and Message Security Non-repudiation and Availability

12. Authentication Secure Entity Identification or Authentication Authentication is identity establishment between communicating devices or entities Entity can be a single user, a set of users, an entire organization or some networking device Identity establishment is ensuring that origin of electronic document & message is correctly identified

13. Access Control Also known as access authorization Principles is to determine who should be able to access what Prevents unauthorized use of resources To achieve access control, entity which trying to gain access must be authenticated first According to authentication, access rights can be modified to the individual

14. Data and Message Security Related with source authenticity, modification detection and confidentiality of data Combination of modification & confidentiality of message is not enough for data integrity But origin of authenticity is also important Location privacy is equally important risk in IoT Should not be any way for attacker to reveal identity or location information of device

15. Non-repudiation and Availability Non- repudiation is the security services for point-to- point communications Process by which an entity is prevented from denying a transmitted message So when message is sent, receiver can prove that initiating sender only sent that message Sender can prove that receiver got message To repudiate means to deny

16. Non- repudiation and Availability Availability is ensured by maintaining all h/w, repairing immediately whenever require Also prevents bottleneck occurrence by keeping emergence backup power systems And guarding against malicious actions like Denial of Service (DoS) attack

17. Security Model for IoT

18. Security model for IoT represents the security features that should be followed by an IoT application. The security model of IoT can be represented by a cube with three dimensions representing security – authorization, trust – repudiation and privacy – respondent. The intersection defines the specific characteristics of the IoT security model. security of the IoT based application focuses on Authorization, Identification and Authentication, Confidentiality, Integrity, Non- repudiation and Availability. Privacy focuses on Owner’s privacy, user’s privacy, Ethics of communication, Laws concerned and accused’s privacy. While trust focuses on Beliefs, credentials, delegation (allocations), recommendation and repudiation.

19. Challenges for Secure IoT Identity Management for IoT devices Secure interaction with and within IoT Privacy and Distributed access control Secure Data Management and Transfer End to End security (cryptographic encryption) Privacy Security Structure

20. Challenges for Secure IoT Identity Management for IoT devices IoT device needs a unique identity and identifier Provides Trust management and building circle of trust. Useful for authentication mechanisms. Secure interaction with and within IoT Physical and virtual movement of devices needs to be managed. Privacy and Distributed access control Identity of devices should be exchanged dynamically. Secure Data Management and Transfer Secure storage management, separate data auditing policies for devices.

21. Explain lifecycle of an IOT device.