Keywords

1 Introduction

The Internet of Things is a rather straight forward concept: it entails linking all physical places and things on the planet to the internet. IoT is one of the impending ideas of mechanical advancement in the field of organizations, which is help not just in the modern turn of events yet additionally in the everyday existence of an individual. The internet of Things (IoT), is an arranged interconnection of ordinary items of sensors fully intent on interfacing with everything [1]. The methods of protection employed to secure internet-connected or network-based devices are referred to as IoT security. The internet of things (IoT) refers to a situation in which all objects are connected to the internet via information sensing devices for intelligent identification and management [2]. The essential objective of this article is to give a comprehension of IoT security concerns. A human with a heart monitor implant, a farm animal with a biochip transponder, or some other man-made object with a specific IP address and the ability to link to the network for data transmission can all considered things in the internet of things [3]. This paper discusses a high-level overview of the Internet of Things, including its architecture, threats, and security issues. Concerns about security issues theoretically, these problems are investigated using criteria such as authenticity, integrity, availability, and confidentiality. To show the on-going study, we use to filter the number of publications from 2013 to 2018. The various publications in emerging IoT applications are shown in Fig. 1. Many engineering opportunities have arisen because of the rapid growth of IoT technology. The rapid development of IoT technology has generated numerous engineering and scientific opportunities as well as challenges. It calls for increased research efforts from a variety of industries, including academia, business, and government. The combined efforts of these sectors should inevitably result in the creation of new protocols, architectures, and services that are desperately needed to meet the IoT's challenges. The paper is organized as; the architecture of IoT has been presented in Sect. 2. The security risks are discussed in Sect. 3. Section 4 focuses on the security issues, parameters, and solutions that IoT faces. Finally, Sect. 5 summarizes the paper with a conclusion (Table 1).

Fig. 1
The bar graph represents the number of publications in I o T technology. There are 6 bars that indicate years from 2013 to 2018.

The number of publications in the areas of IoT protocols, security, and emerging applications is increasing

Full size image
Table 1 A comparison of previous papers
Full size table

2 IoT Architecture

The principal concepts of the Internet of Things are characterized by the four-layer architecture. The phrase "internet of things" is made up of two words: "interconnected networks" and "things," which demonstrate certain artifacts. However, at the point when these two terms are combined, they form a “global network of networks. Interconnected objects, each with its unique address, are based on a protocol for regular communication [4]. The layered architecture of IoT is described in this paper, which gives an idea of the fundamental architecture of IoT. The perception layer, Network layer, procession layer and Application layer are the layers that make up IoT [5, 6]. As seen in Fig. 1, all four layers have a large amount of data and different enabling technologies and functionality.

  1. (i)

    The perception layer: The principal layer of IoT engineering is this. An assortment of sensors and actuators are utilized in the insight layer to gather helpful data like temperature, dampness content, interloper location, vibrations, etc.

  2. (ii)

    The network layer: The layer ties the vision and middleware layers, as the name infers. It utilizes organizing advances like 3G, 4G, UTMS, Wi-Fi, and others to get information from the discernment layer and move it to the middleware layer.

  3. (iii)

    The procession layer: The Middleware Layer contains progressed highlights like stockpiling, calculation, handling, and activity taking. It saves all information and sends it to the suitable PC dependent on the gadget's location and name.

  4. (iv)

    The application layer: Given data assembled from the middleware layer, the application layer handles all application measures. Sending messages, setting off cautions, security frameworks, turning on or off gadgets, brilliant watches, shrewd horticulture, and different assignments are all important for this application.

The list of several IoT technologies used to complete our analysis of the IoT architecture models. Similar layers of architecture (Table 2).

Table 2 IoT technologies
Full size table

3 IoT Challenges

3.1 Security Threats and Challenges in the Internet of Things

There are three types of IoT risks:

  1. 1.

    Risks that is characteristic of any device on the internet.

  2. 2.

    Risks associated with IoT device.

  3. 3.

    Protection to ensure that no damage is caused, for example, by misuse of actuators.

Standard security rehearses, for instance, getting open ports on contraptions to have a spot with the essential arrangement (for example, a fridge related to the Internet to send alerts about the thing stock and temperature may use an unsteady SMTP labourer and can be sabotaged by a botnet). We will shortly audit some principle challenges.

Scalability:

Scalable security solutions are needed to handle a great number of IoT nodes.

Connectivity:

Another difficulty in IoT communications is to connect various ML / Devices with different capabilities in a safe manner.

End-to-End Security:

OSCORE involves the use of a key exchange protocol to create a security context. However, this protocol should take into account the needs of restricted scenarios (e.g., LPWAN), as well as end-device computation and storage limitations [13].

Authentication and Trust:

This forestalls a certainty connection between IoT elements from being formed, which is essential for IoT applications requiring specially appointed contact, such as the Smart City scene, between IoT components.

Identity Protection:

Management of identity is a challenge because bad security practices are often enforced. For instance, a common mistake is the use of clear text/Base64 encoded device/machine-to-machine (M2M) IDs/passwords.

Attack-Resistant Security Solutions:

IoT system diversity results in a need for security solutions that are attack-resistant and lightweight. They are defenceless against asset enervation assaults because IoT gadgets have restricted processing assets.

3.2 Threats and Attacks on IoT Security

To underline security risks in IoT, its shortened form has been presented as Interconnection of Dangers (IoT). Undoubtedly, IoT gadgets are especially powerless against actual attacks, programming attacks, side-channel attacks, etc. as introduced in Table 3.

Table 3 Security threats to IoT devices
Full size table

Present IoT platforms are made up of a range of technology solutions from different vendors. Any of these frameworks are a diverse blend of segments repurposed from existing answers for use in uniquely fabricated stages in the expectation that the parts can cooperate securely.

3.2.1 Attack Classification for IoT Interaction Stage

An IoT approach can be thought of as a five-phase series, starting with data collecting and ending with data transmission to end users. Table 4 indicates the spectrum of assaults categorized for the five IoT phases: interpretation of data, storage, smart processing, transmission of data and end-to-end delivery [7].

Table 4 Taxonomy of attacks based on IoT process phases
Full size table

3.2.2 Categorization of Attacks Based on IoT Architecture

There are different IoT models of architecture, as mentioned in Sect. 2. In general, four layers are believed to have the IoT architecture, presented in Fig. 2. At the awareness, network, and service levels, we will take a quick look at the biggest security threats. Table 5 summarizes the most significant security issues in the IoT provided as four-layer architecture (Fig. 2).

Fig. 2
The startup design process presented has four layers which are believed to have the I o T architecture.

Architecture of IoT

Full size image
Table 5 Top Ten Vulnerabilities in IoT
Full size table

3.2.2.1 Threats to Security at the Sensing and Perception Layer

It should be customized and introduced into the actual gadgets to authorize IoT security. This implies IoT gadgets should have the option to demonstrate their character, hold their realness, sign, and encode their information to keep up with believability, and to ensure protection by confining information that is saved locally. The situation security model should be adequately unbending to forestall unapproved use while as yet being sufficiently adaptable to work with secure specially appointed interchanges with people and different gadgets on an impermanent premise [8].

Harm to Physicality:

Some attackers can lack technological expertise and the destruction of devices limits their attacks. As device enclosures are often not tamperproof, it is possible to open the devices, access their hardware through probes, and pin headers.

Capturing Node:

Instead of destroying them, the information stored on the devices will be stolen by an active attacker.

Attack of the Sinkhole:

They become defenceless against sinkhole assault if sensors are left unattended for significant stretches in the organization.

Attack Selective Routing:

Malicious nodes can pick, drop packets, thus selectively filtering thus, some packets are selectively filtered, and the rest enabled.

Witch Strike:

On the off chance that a noxious IoT hub exploits a genuine hub's disappointment, If rouge IoT hub exploits a genuine hub's disappointment, this attack occurs.

3.2.2.2 Security Threats

Layers of Network and Service Support

The IoT management framework is defined by the administration support layer (Fig. 2) and is liable for installing gadgets and clients, executing approaches and guidelines, and coordinating computerization across gadgets. At this stage, role-based access control to monitor the identity of users and devices and the actions they are allowed to take is important.

Attack by Man-in-the-Middle (MITM):

Assault by Man-in-the-Middle (MITM). The Man-in-the-middle assault is a representation of the IoT's latent capacity snooping. Since device authentication requires device identity sharing, identity theft involves identity theft. All dangers of assaults on IoT frameworks should go through the mist layer in the center, which can detect and mitigate suspicious activities before they reach the device [12].

Attack Replay:

This data might be ridiculed, adjusted, or replayed during the exchanging of character-related information or various certificates inside the IoT.

Denial of Service Attack:

An interloper could dodge the firewall and dispatch a refusal of administration (DoS) assault, delivering the route administration difficult to reach, or convey a bogus message, driving the driver as plate [11]. In addition, most IoT developers have an embedded programming history, which makes them unaware of IoT programming and risks. Attackers could gain access to the keen home arrange and send mass messages to shrewd gadgets, like Solicitation To Send (RTS)/ Clear To Send (CTS) [15].

4 IoT Security parameters

Protection must be handled from the initial design to the services operating in the IoT lifecycle. For example, during device manufacturing, the execution of safety highlights should start.

Code marking and code confusion are a few stages that makers should take to guarantee that their device is not compromised or that a malicious user does not insert unauthorized code. Data confidentiality, safety, and trust are the key security criteria in IoT scenarios, as shown in Fig. 3. Protection is required for IoT systems as a result of IoT security issues. As a result, based on conventional security criteria, it is vital to fabricate a protected web arrangement of things, which are as per the following [19]:

Fig. 3
The image represents data confidentiality, safety, and trust are the key security criteria in I o T scenarios.

Security requirements in the internet of things

Full size image

4.1 IoT Solutions

The engineering of the IoT is a major method of planning the various components of the IoT so it can give network benefits and fulfil future requirements. Sensors, actuators, entryways, conventions, cloud administrations, organizations, and application workers are all essential for the IoT design, which are coordinated in different geographies to speak with each other [16]. The term "Internet of Things" refers to a large and diverse ecosystem that encompasses a wide range of connectivity kinds and application cases. As a result, discussing the IoT ecosystem as a whole is ineffective, and understanding IoT requires breaking it down into layers [20]. The fourth industrial revolution will be built on sensors and actuators. They have already altered how people view their surroundings. From urban planning to social consciousness, sensor-enabled smart cities are paving the way for a more sustainable future [21].

The following are the primary IoT phases (layers) that include the IoT architecture solution (Fig. 4).

Fig. 4
The startup design process has the primary IoT phases (layers) that include the I o T architecture solution.

Solutions of IoT

Full size image
  1. i.

    Sensors/Actuators

    The instruments that can emit, receive and process data over the network are sensors or actuators. This includes GPS, electrochemistry, gyros copy, RFID, etc. Most of the sensors need connectivity through gateways to the sensors. A Local Area Network (LAN) or Personal Area Network may be used for connecting sensors or actuators. The sensor is in charge of detecting and collecting the analogy signals that represent environmental data. Analog signals are converted to digital data by the analog-to-digital converter, which then passes the data to the processing unit [22].

  2. ii.

    Gateways and Data Acquisition

    Because these sensors and actuators generate vast volumes of data, high-speed gateways and networks need to transfer data. The type of this network may be Local Area Network (LAN, such as Ethernet, Wi-Fi and so forth), Wide Area Network (WAN like 5G, GSM and so on). This framework was created to allow for the capture of multimodal data from a variety of sources and data providers, as well as to address current connectivity and communication challenges [23].

  3. iii.

    Edge IT

    Edge is the equipment and programming entryway in IoT Engineering that investigates and pre-measures information before moving it to the cloud. Edge figuring is a moderately late idea in the registering scene. It brings distributed computing administrations and utilities nearer to the end client, and quick handling and application reaction times portray it [24].

  4. iv.

    Data Center/Cloud

    Management Systems that process information through analytics, system management, and security controls are part of the Data Center or Cloud. A server farm is an area where establishments' PCs and related hardware, like peripherals, are kept up. Universities, businesses, national laboratories, hospitals, research institutes, government agencies, and other institutions could be among them [25].

5 Conclusion

The design of IoT security allows for a free, widespread infrastructure with interoperability. We conclude this paper by stating that, following the identification of the key IoT-enabling technologies, challenges, parameters, and solutions, The creation of the network architecture and framework to efficiently handle future IoT applications is the next step. Furthermore, IoT systems are implementing a variety of important technological advancements in a variety of industries. To safeguard their connected devices from malicious assaults, several suppliers and enterprises implement a variety of restrictions. More privacy and security issues have been raised as more of these gadgets are connected to our private networks and the Internet. When it comes to protecting IoT-based systems and devices, security should be a primary focus. To secure their systems from potential threats, businesses should consider implementing numerous levels of protection. IoT data may be processed using modern analytical tools like Artificial Intelligence and Machine Learning to improve security. Blockchain is a promising solution for data security in IoT-enabled ecosystems, as it eliminates the need for central permission in the IoT network.