Security and Privacy in the Internet of Things: Threats, Requirements, and Countermeasures

Abstract

The Internet of Things connects vast numbers of devices to networks, and the security and privacy of these devices and the data they carry are among the most pressing concerns of the field; this paper reviews the threats,requirements, and countermeasures. It describes the characteristics of theInternet of Things that make security difficult: the severe resource constraints of devices, which limit the cryptography they can perform; their physical accessibility and heterogeneity; their large numbers and long, poorly updatable lifetimes; and their often weak default configurations. It surveys the threats at each layer of the architecture, from physical tampering and node capture at the perception layer, through eavesdropping, interception, and denial of service at the network layer, to data breaches and weak authentication at the application layer. It sets out the security requirements, of confidentiality, integrity, availability, authentication, authorization, and privacy, and the countermeasures that address them, including lightweight cryptography, secure communication, device identity, secure boot and signed updates, access control, and intrusion detection, organised as defence in depth. It discusses the protection of privacy and the emerging approaches of hardware security and machine-learning-based detection. The study finds that securing the Internet of Things requires layered countermeasures adapted to the constraints of devices, and that it is limited by resource constraints, the difficulty of updates, and fragmentation. It notes that specific technologies and standards are representative of an evolving field. It concludes with the outlook. Certain figures are illustrative. KEYWORDS: IoT Security, Privacy, Authentication, LightweightCryptography, Denial of Service, Secure Boot, Over-the-Air Updates, Defence in Depth, Intrusion Detection