Keywords

1 Introduction

The Internet of Things (IoT) can be defined as an integration of interconnected smart objects with embedded sensors, actuators, and processors for the purpose of exchanging data over the internet to accomplish intended objective. IoT is a seamless integration of virtual and real-world technologies working together in tandem. With more consumers and business enterprises embracing IoT technologies and solutions in real-time, more are the security concerns.

Secure communication, secure storage, and effective access control mechanism, are becoming the most pressing concerns associated with widespread application of IoT [1]. Since sensor networks are extremely vulnerable to attacks [2], it is critical to have a mechanism in place to safeguard the network, smart things, and users from all types of malicious attack, thereby creating a more robust environment. The challenging part is the execution of light and quick cryptography algorithm because of limited processing power, limited battery, and memory capacity of these devices.

Cryptographic algorithms, like, advance encryption standard (AES), Diffi-Hellman (DH), secure hash algorithm (SHA), and Rivest Shamir Adelman (RSA), among others, can be used to address IoT security issues such as IoT data confidentiality, authenticity, and credibility [3].

The remainder of the article is structured as follows: Sect. 2 delves into the three-layer IoT architecture. Section 3 highlights some of the threats and vulnerabilities in each layer followed by potential counter measures in Sect. 4. The articles concludes in Sect. 5.

2 The IoT Architecture

The IoT architecture is a framework that defines the connectivity, communicating protocols, configuration, and organizational structure of the network to be used by the Web-enabled smart devices. Sensors, protocols, actuators, cloud services, and layers all play a significant role in IoT architecture.

There is no single IoT architecture that is widely agreed upon. Researchers have suggested a variety of architecture. In the following subsections, the three-layer architecture on IoT is discussed.

2.1 Three-Layer Architectures

The IoT architecture [4] with three layers, namely the perception layer, network layer, and application layers as shown in Fig. 1 is the most basic architecture which was initially introduced by researchers for the purpose of study.

Fig. 1
figure 1

The three-layer IoT architecture

Full size image

2.1.1 Perception Layer

The perception layer is the lowest layer of the traditional three-layer IoT architecture that is responsible for hosting smart things [5]. The sensors in physical layer, senses certain physical parameters or detect other smart devices in the vicinity (such as the actuators, edge devices, and wireless sensors) to gather information from the surroundings (such as humidity, and temperature, and so on) and convert them in a digital streams. The primary function of this layer is to provide unique address identification and enable communication between low-range technologies such as RFID, near-field communication (NFC), Bluetooth, 6LoWPAN (low power personal area network) [6].

2.1.2 Network Layer

The network layer is the core layer of the conventional three-layer IoT architecture that is capable of forwarding data for specific services. It enables secure communication across smart things and with the cloud via IoT gateway video networking technologies such as wired, Wi-Fi and cellular technologies. This layer also ensures that each system has its unique addressing and routing capabilities for seamless integration of infinite number of devices into a single unified network. The IETF implementation of 6LoWPAN protocol for IPV6 for unique addressing of devices is one such work involved [7].

2.1.3 Application Layer

The application layer is the topmost layer of traditional IoT architecture responsible for providing its users, customized, application specific services such as, smart education, smart health, smart energy grid, smart transportation, and many more.

3 Security Issues of Three Layer Architecture

As more and more internet-enabled smart gadgets joins the IoT community, greater the security breaches and so the attacks at the aforementioned layers. Security requirements are different at different layers of the IoT architecture. Some of them are highlighted in the following subsections.

3.1 Threats and the Vulnerabilities of Perception Layer

Lightweight encryption algorithm, data protection of sensors, and management of keys are the security requirements for the perception layer. Some of the major security threats encountered in this layer include cyber-attack, malicious code injection, fake node, sensor data security, data access, and authentication issues, malware attacks [8]. If proper security procedures, algorithms, and technologies are not applied in real time, these attacks can disrupt any form of application in IoT architecture. Technology-related attack for this layer is summarized in Table 1.

Table 1 Attacks and possible solutions in perception layer
Full size table

3.2 Threats and the Vulnerabilities of Network Layer

Identity authentication, encryption mechanism, and communication protection are core requirements for network layer specifications. Denial of services (DoS), man in the middle attack, eavesdropping, RFID interference, node jamming in the WSN, and network congestion attack are other security challenges faced in this layer. Some of the attacks in network layer of three-layer IoT architecture with some possible solutions are listed in Table 2.

Table 2 Attacks and possible solutions in network layer
Full size table

3.3 Threats and the Vulnerabilities of Application Layer

Data exchange that protect user privacy and access controls are key security issues in application layer today. Some application layer threats include phishing, ransomware, and X scripts among others. Table 3 provides layer-wise attacks with some possible solutions.

Table 3 Attacks and possible solutions in Application layer
Full size table

4 Counter Measures

In addition to possible solutions listed in the above tables, below are mentioned some of the counter measures. These interventions, however, does not fully eliminate attacks, but they do help minimizes it to a great extent.

4.1 Authentication

Authentication in IoT community allows millions of IoT things to connect for effective and secure communication over an insecure network. The authentication process grants each IoT device in the IoT ecosystem with a unique id that can be authenticated when device attempts to communicate via a gateway or cloud server [35]. However, in IoT device authentication, efficient encrypted key generation and key communication is a challenging task due to lack of guaranteed authorization mechanisms. Authentication is important at any layer of IoT. To prevent DoS attacks, sensor nodes must authenticate themselves at the perception layer. In the network layer Wi-Fi, authentication methods guarantee the security of users’ data when it travels over insecure gateway [36]. Security patch update in application layer ensures reliable use of application specific devices. OpenID, a standard open, decentralized framework allows users to be authenticated by relying sites through a third-party provider.

4.2 Authorization and Access Control

Authorization involves security mechanisms to determine users/clients privilege levels to different resources while access control mechanisms guarantees access right of only authorized resources [37]. Installation and regulation of numerous authorization and access control mechanism is a challenge in a heterogeneous IoT network [38]. Authorization controls a device’s access throughout the network. Using authentication and access control the relationship between IoT devices is established to exchange appropriate information. OAuth, a standard authorization framework, will grant access to resource, data and features from one application to another through the use of access tokens. However, one challenge encountered by OAuth and Connect is that they have so far only been bound to HTTP, and HTTP is believed to be insecure for communications between IoT devices. Constrained application protocol and MQ telemetry transport are new class of protocols that promises to be better suited than HTTP.

4.3 Secure Architecture

Creating a framework that addresses the aforementioned security issues in an IoT environment is a daunting task. Any IoT architecture should be able to address previously stated security concerns and also the new challenges that comes with installation of IoT devices over software defined networks (SDN) and cloud infrastructure [39], which otherwise will invariably be passed down to the underlying IoT sensors. Furthermore, the difficulties of securely connecting smart IoT objects with cloud services would slew new security risks [40]. Finally, existing intrusion detection and prevention systems face a difficult challenge in detecting malicious traffic rerouted through heterogeneous networks (i.e., SDN, Cloud, and IoT) by unauthorized users [41].

4.4 Block Chain

The Blockchain, an emerging digital technology, has recently gained much popularity in providing secure IoT solutions that can significantly aid in achieving the Internet of Things vision in various ways, such as increasing decentralization capability, promoting interactions, validate new transaction models, and enable autonomous smart objects to seamlessly coordinate through peer-to-peer (P2P) network. The authors in [42] suggests a blockchain-based framework that enables smart devices with single-board computers (SBCs) to communicate with the cloud and send/receive transactions to other internet connected devices on the blockchain network for IoT data in real time. As a proof of concept, experts have conducted simple experiments using Arduino Uno board and Ethereum smart contracts to demonstrate how the platform can be used for MTM interaction and smart prognosis.

4.5 Cryptographic Algorithm/Encryption

Encryption is used to not only protect the data from being tampered with but also to preserve data confidentiality and integrity. Encryption can be accomplished in either of the two ways: node-to-node encryption or end-to-end encryption. Node-to-node encryption performs cipher text altercation at every node, making the network layer more stable. End-to-end encryption, on the other hand, is performed at the application layer where the recipient decrypts the encrypted data sent by the sender. Mathematical algorithm like cryptographic hash functions authenticates a message by generating message authentication codes (MACs). AES, 3DES, and blowfish are other approved symmetric-key algorithms used for encryption/decryption services covering data breaches and unauthorized disclosure of personal information. Among others Hummingbird, Simon and speck, TEA are suggested light weight cryptographic algorithm providing data security [43].

5 Conclusion

IoT is reshaping the next generation Internet. Beyond laptops and smart phones, the idea of connectivity is expanding towards smart cities, smart transport, smart homes, smart farming, connected vehicles, connected wearables, and connected healthcare among others. With the revolution in the usage of Internet-enabled smart gadget and smart decisions being made in real time, the security concerns has also increased many fold. Research in the field of IoT security is still in its infancy, which needs to be explored further to develop secure solutions for its applications. This survey paper not only elicits and explains in depth, different kind of attacks that occur at all the layer of three layer IoT security protocol stack—perception, networking and application layers—but also provide possible solutions that can be applied at these layers. The article may provide researchers with insight as well as an opportunity to work on developing advanced concepts and techniques to deal with the various attacks that exists in the layered IoT architecture.

Future research will be directed toward addressing the vulnerabilities of communication technologies on all the layers of three-layer IoT architecture and implementing secure authentication and authorization methods using encryption algorithm to prevent data from being tempered. This paper can also aid in doing a comparative study between different layered architecture and understand which would offer better service depending on the application need as a single architecture cannot cater to heterogeneous business requirement.