ADVANCE REQUIREMENT ENGINEERING

Research Paper
Submitted To: Dr Shahid N Bhatti
Abdul Basit Shahzad Enrollment No: 01-241182-002

11/17/2018

.
 Security Requirements and Privacy Issues in Internet of Things

Abdul Basit Shahzad

Department of Computer Science
Bahria University Islamabad

Abstract – There are large number of IoT devices

Now a day’s Internet of Things (IoT) are rapidly interconnected with the network to provide help
deploying in the real world. This rapid to individuals or large businesses. These devices
deployment of IoT devices including smart are bound to through data to server or made their
watches, sensors and other embedded devices data available to their subscribers (users). But
lead to a serious problem of security and privacy. providing this data to user in such a way that
Some of these devices are vulnerable to attacks security is not compromised is the main thing
hence privacy is compromised. Security of the from whom everyone should worry about.
IoT devices is very critical because it may
physically harm or even take a life of someone. If we take the example of safe home there are
The purpose of this study is to provide detail number of devices interconnected in the network.
knowledge of challenges of IoT device’s privacy This network sometimes have one or two devices
and the security requirements mixed with quality for whom not enough security measurements are
attributes, need to be considered at earlier stage taken because of that other devices in the
in order to avoid those challenges. network may also be compromised.

1 Introduction Water Pump

Internet of Things (IoT) has bombarded at
market in last few years which includes the wide
range of IoT devices and their managing
software built on different architecture and Laptop
separate set of requirements. And while Smart
designing these devices, most of the security Phone
requirements are not in the consideration.
Because of this, many security problems
occurred e.g. compromised anonymity, sensitive
data loss and many other security related issues. Fire Door Lock
Detector

Figure 1: Safe-Home with interconnected IoT

devices.
In the above figure laptop is connected with fire Defining the security and privacy requirements
detector and fire detector connected with door of the IoT system is not the easy task as there are
lock and other devices as well. If the hacker number of different issues analyzing these
gains access to the water pump he can eventually requirements [5]:
get access to door lock of the home and security
➢ Environment change is the key obstacle
is compromised as whole.
while specifying requirements for
The above mention problem become a security and privacy of IoT devices.
motivation to make the security requirements a ➢ Another challenge is how we can define
desirable part of the requirement elicitation that which data is restricted to whom,
process. when to restrict it and who can access
that data under what specific conditions.
2 Literature review ➢ Numbers of technologies are
Hewlett-Packard organizes the study [1] on interconnected to form an IoT system.
commercial devices of internet of Things in the When integrating those technologies in
year of 2014. This study states that about 80 our system there are a lot of risks
percent of commercial IoT devices the privacy of associated with them.
personal bio-data, also 80 percent of devices To achieve our ultimate goal of gaining security
unable to require a secure password to access, and privacy requirements we divide these
and 70 percent does not have encryption. requirements in number of quality attributes that
In 2003 there was one of the first attacks on the can address these requirements at both
monitoring components of USA nuclear power architecture and development level.
plant [2].
4 Architecture
R. H. Weber in his review of computer law and
This section presents a brief view of overall
security [3] explains the legal framework to deals
architecture of IoT network which help us to
with security concerns and privacy constraints of
critically evaluate the security concerns and
individuals and discuss the legislation of right to
privacy constraints on the devices connected to
information for everyone.
the network.
Research organized on the architecture of some
Four different components coordinate together to
trusted IoT systems elaborates the security
form an IoT system. Now we further explain the
aspects of the trusted user, perception and agent
interoperability and services of each component
modules.
[6].
3 Analysis of security i) IoT Device
requirements Any type of device with sensor, operating
With the evolution of IoT industry, the system, application software, and an interface for
manufacturers are facing number of challenges communication can be considered as IoT device.
with variety of aspects including standardization
of IoT, social and legal aspects of IoT and also These devices collect data from their working
the security and privacy concerns. environment and perform some necessary action
needed.
 ii) IoT services This attribute ensures that data should be up-to-
date after each message. This is also critical
User can access services of IoT from anywhere
attribute because system must have known the
they want because most of the services are
current state of every sensor or IoT device.
hosted at cloud. The role of these services is to
automate the IoT process and making decisions d) Consistency
on the basis of device data.
Integrity of the system is changed when data loss
iii) Bridge occurs in the transmission process or someone
intervenes to change the data after it is
The functionality of the bridge is to provide
dispatched from device. This will cause a false
gateway between the IoT device and the cloud
alarm or something even more dangerous.
service of IoT. Bridges are actually protocols
from which IoT devices and services can e) Authorization and access control
communicate with each other.
These two attributes ensure that only
iv) Controllers authenticated device access the data authorized
to it. No other data is displayed or accessed by
Controllers are responsible for controlling IoT
that IoT device that is not authorized to it.
devices. Mobile phone or laptops or tablets can
act as controllers of IoT devices that can give f) Exception Handling
command to IoT devices.
There must be mechanism defined in the IoT
devices to handle the known exceptions and
5 Security requirements and should continue to provide their services in
constraints adverse situations. Devices must be robust in
There are many things that should be considered nature to ensure exception handling.
while proposing the secure solution for IoT
system. g) Flexibility
The overall IoT system should have bit of
a) Device Anonymity
resilience so that when some of the
Hiding the source of the device or data is the interconnected devices are under attacked the
core concern about security to make secure IoT security and availability of the other devices
system. There should be a service in IoT system must not be compromised.
which deals with secrecy of origin of data.
h) Tempering
b) Data Safety
The attacker creates an extra activity which is not
Data protection is the most important attribute happened actually by gaining unauthorized
while discussing privacy. The information about access to the data. The purpose behind this is to
person such as e-health care device sending the create confusion or misleading the stakeholders
critical data of patient’s health to the doctor or of that IoT system by altering the correctness of
medical specialist should be secure at both nodes the message [7].
and must not be accessible by unauthorized
persons. To cope with this kind of situation an alteration
detection system is used to protect us from these
c) Live feed kind of attacks [8].
6 Future Directions gaining access to the large industry in near
To protect the IoT system from all kinds of the future.
above discussed security and privacy threats we
need an attack defending mechanism in which all 7 References
the layers of the entire IoT system is covered. [1] “Internet of Things research study,” 2014,
Here is the brief description of an attack accessed on 19-April2014. [URL]:
defending mechanism. https://www8.hp.com/us/en/hp-news/press-
release.html?id=1744676
Threats Precautions Layer
[2] K Poulsen, Slammer Worm and David-Besse
Reprograming Authorization Application Nuclear Plant, 2003.
[3] R. H. Weber. Internet of things - new security
Squeezing Spatial Physical
and privacy challenges. Computer Law &
retreating
Security Review, 2010.
Intrusion Intrusion Transport
Detection [4] L. Wen, X. Li and Z. Xuan. Architecture of
System trusted security system based on IoT. Intelligent
Electromagnetic Shielding Transport Computation Technology and Automation
interference (ICICTA), 2011.
Sink holing [9] Cryptographic Network
routing [5] Davor Svetinovic and Israa Alqassem.
protocol Taxonomy of Security and Privacy Requirements
Crash Error- MAC for the Internet of Things (IoT). Masdar Institute
correcting of Science and Technology Abu Dhabi, UAE.
code
Fabrication Filtering, Network [6] Mahmud Hossain, Maziar Fotouhi, and Ragib
Authentication Hasan. Towards an Analysis of Security Issues,
Challenges. Department of Computer Sciences
University of Alabama at Birmingham.
7 Conclusion [7] A. Zomaya and T. Zia. “Security issues in
Internet of things is mainly influenced by attacks wireless sensor networks.” in Proceedings of the
at various layers of its framework which is one of International Conference on Systems and
the common reasons of small scale development Networks Communications, ICSNC, 2006.
of IoT in industry. Although it is hard to attend
all the security and privacy concerns of an IoT [8] Y. Zhang and W. Lee, “Intrusion detection in
environment by in this paper, I have tried to wireless ad-hoc networks,” in Proceedings of the
survey the most important security concerns 6th annual international conference on Mobile
which includes confidentiality, end-to-end computing and networking. ACM, 2000, pp.
security, authentication and data safety. 275–283.

If these issues are addressed properly in [9] Sengul, Papadimitriou and Fessant.
development process of IoT system then these Cryptographic protocols to fight sinkhole attacks
system can transform the way of business by on tree based routing in WSN. In Secure
Network Protocols, 2009. 5th IEEE Workshop.