Risks of Trusting the Physics of Sensors

Kevin Fu,Wenyuan Xu

DOI: https://doi.org/10.1145/3176402

IF: 22.7

2018-01-01

Communications of the ACM

Abstract:Protecting the Internet of Things with embedded security.

What problem does this paper attempt to address?

Sensor-based IoT Data Privacy Protection

Xiaoyu Ji,Wenjun Zhu,Shilin Xiao,Wenyuan Xu

DOI: https://doi.org/10.1038/s44287-024-00073-2

2024-01-01

Abstract:Sensors are extensively used in the Internet of Things (IoT) applications, enhancing daily convenience but also raising concerns about privacy leakage. To address this, we advocate for protecting data privacy at the moment it is generated by sensors, rather than trying to secure it afterwards.
Rethinking IoT Security: Understanding and Mitigating Out-of-Band Vulnerabilities

Wenyuan Xu

DOI: https://doi.org/10.1145/3579856.3596442

2023-01-01

Abstract:Vulnerabilities pose a significant challenge in ensuring cybersesecurity for information systems. In the past, vulnerabilities were mainly associated with functional defects in system software and hardware, known as "in-band vulnerabilities," whereby "band" refers to the functional domain. However, with the rapid development of the Internet of Things (IoT), new security issues have emerged that traditional vulnerability categorization may not fully cover. IoT devices rely on sensors and actuators to interact with the real world, but this interaction process between physical and digital systems has created defects that are difficult to analyze and detect. These defects include unintentional coupling effects of sensors from ambient analog signals or abnormal channels that were not intentionally designed, collectively known as "out-of-band vulnerabilities." Various security incidents have highlighted the prevalence of out-of-band vulnerabilities in IoT systems, and their activation can result in serious consequences. To address this issue, we propose a vulnerability categorization framework that includes out-of-band vulnerabilities and provides examples for each category. Our talk highlights the need to shift the research paradigm for system security to encompass both in-band and out-of-band vulnerabilities in the intelligence era. Finally, we explore potential solutions for mitigating out-of-band vulnerabilities and securing IoT devices.
SoK: A Minimalist Approach to Formalizing Analog Sensor Security.

Chen Yan,Hocheol Shin,Connor Bolton,Wenyuan Xu,Yongdae Kim,Kevin Fu

DOI: https://doi.org/10.1109/sp40000.2020.00026

2020-01-01

Abstract:Over the last six years, several papers demonstrated how intentional analog interference based on acoustics, RF, lasers, and other physical modalities could induce faults, influence, or even control the output of sensors. Damage to the availability and integrity of sensor output carries significant risks to safety-critical systems that make automated decisions based on trusted sensor measurement. Established signal processing models use transfer functions to express reliability and dependability characteristics of sensors, but existing models do not provide a deliberate way to express and capture security properties meaningfully. Our work begins to fill this gap by systematizing knowledge of analog attacks against sensor circuitry and defenses. Our primary contribution is a simple sensor security model such that sensor engineers can better express analog security properties of sensor circuitry without needing to learn significantly new notation. Our model introduces transfer functions and a vector of adversarial noise to represent adversarial capabilities at each stage of a sensor's signal conditioning chain. The primary goals of the systematization are (1) to enable more meaningful quantification of risk for the design and evaluation of past and future sensors, (2) to better predict new attack vectors, and (3) to establish defensive design patterns that make sensors more resistant to analog attacks.
Efficient Fault-Tolerant Information Barrier Coverage in Internet of Things

Shibo He,Jiming Chen,Yuanchao Shu,Xianbin Cui,Kun Shi,Chunjuan Wei,Zhiguo Shi

DOI: https://doi.org/10.1109/twc.2021.3089039

IF: 10.4

2021-01-01

IEEE Transactions on Wireless Communications

Abstract:Information barrier coverage has been widely adopted to prevent unauthorized invasion of important areas in Internet of Things. As sensors are typically placed outdoors, they are susceptible to getting faulty. Previous works assumed that faulty sensors are easy to recognize, e.g., they may stop functioning or output apparently deviant sensory data. In practice, there exist multiple types of fault that sensors may have during operation. It is, thereby, difficult to recognize faulty sensors as well as their invalid output and attain accurate intrusion detection. We, in this paper, propose a novel fault-tolerant intrusion detection algorithm (TrusDet) based on trust management to address this challenging issue. TrusDet comprises of three steps: i) sensor-level detection, ii) sink-level decision by collective voting, and iii) trust management and fault determination. In the Step i) and ii), TrusDet divides the surveillance area into a set of fine-grained subareas and exploits temporal and spatial correlation of sensory output among sensors in different subareas to yield a more accurate and robust performance of information barrier coverage. In the Step iii), TrusDet builds a trust management based framework to determine the confidence level of sensors being faulty. We implement TrusDet on HC-SR501 infrared sensors, and design hardware and software to build a practical detection system. Extensive experimental results and simulation results validate the information coverage model and demonstrate that TrusDet has a very low false alarm rate.
Security Architecture on the Trusting Internet of Things

Bing Zhang,Xinxin Ma,Zhiguang Qin

2011-01-01

Abstract:⎯By analyzing existed Internet of Things’ system security vulnerabilities, a security architecture on trusting one is constructed. In the infrastructure, an off-line identity authentication based on the combined public key (CPK) mechanism is proposed, which solves the problems about a mass amount of authentications and the cross-domain authentication by integrating nodes’ validity of identity authentication and uniqueness of identification. Moreover, the proposal of constructing nodes’ authentic identification, valid authentication and credible communication connection at the application layer through the perception layer impels the formation of trust chain and relationship among perceptional nodes. Consequently, a trusting environment of the Internet of Things is built, by which a guidance of designing the trusted one would be provided. Index Terms⎯Combined public key, elliptic curves cryptography, Internet of Things, radio frequency identification, security system, trusting system.
Securing Wireless Communications of the Internet of Things from the Physical Layer, An Overview

Junqing Zhang,Trung Q. Duong,Roger Woods,Alan Marshall

DOI: https://doi.org/10.3390/e19080420

2017-08-17

Abstract:The security of the Internet of Things (IoT) is receiving considerable interest as the low power constraints and complexity features of many IoT devices are limiting the use of conventional cryptographic techniques. This article provides an overview of recent research efforts on alternative approaches for securing IoT wireless communications at the physical layer, specifically the key topics of key generation and physical layer encryption. These schemes can be implemented and are lightweight, and thus offer practical solutions for providing effective IoT wireless security. Future research to make IoT-based physical layer security more robust and pervasive is also covered.

Cryptography and Security,Information Theory
Building Touch-Less Trust in IoT Devices

Steve Kerrison

2024-09-30

Abstract:Trust mechanisms for Internet of Things (IoT) devices are commonly used by manufacturers and other ecosystem participants. However, end users face a challenge in establishing trust in devices, particularly as device encounters become more frequent thanks to the proliferation of new and unique products. Communication or even physical interaction with a device can expose a user to various threats, such as biometric theft or exploit of their own device. To address this, we propose a mechanism for verifying the integrity and trustworthiness of an IoT device before physical interaction or any significant communication has taken place.

Cryptography and Security
When Your Thing Won't Behave: Security Governance in the Internet of Things

Brennecke, Martin,Fridgen, Gilbert,Radszuwill, Sven,Sedlmeir, Johannes

DOI: https://doi.org/10.1007/s10796-024-10511-z

2024-08-25

Information Systems Frontiers

Abstract:In the Internet of Things (IoT), interconnected smart things enable new products and services in cyber-physical systems. Yet, smart things not only inherit information technology (IT) security risks from their digital components, but they may also aggravate them through the use of technology platforms (TPs). In the context of the IoT, TPs describe a tangible (e.g., hardware) or intangible (e.g., software and standards) general-purpose technology that is shared between different models of smart things. While TPs are evolving rapidly owing to their functional and economic benefits, this is partly to the detriment of security, as several recent IoT security incidents demonstrate. We address this problem by formalizing the situation's dynamics with an established risk quantification approach from platforms in the automotive industry, namely a Bernoulli mixture model. We outline and discuss the implications of relevant parameters for security risks of TP use in the IoT, i.e., correlation and heterogeneity, vulnerability probability and conformity costs, exploit probability and non-conformity costs, as well as TP connectivity. We argue that these parameters should be considered in IoT governance decisions and delineate prescriptive governance implications, identifying potential counter-measures at the individual, organizational, and regulatory levels.

computer science, information systems, theory & methods
Wireless Communication and Security Issues for Cyber–Physical Systems and the Internet-of-Things

Andreas Burg,Anupam Chattopadhyay,Kwok-Yan Lam

DOI: https://doi.org/10.1109/jproc.2017.2780172

IF: 20.6

2018-01-01

Proceedings of the IEEE

Abstract:Wireless sensors and actuators connected by the Internet-of-Things (IoT) are central to the design of advanced cyber–physical systems (CPSs). In such complex, heterogeneous systems, communication links must meet stringent requirements on throughput, latency, and range, while adhering to tight energy budget and providing high levels of security. In this paper, we first summarize wireless communication principles from the perspective of the connectivity needs of IoT and CPS. Based on these principles, we then review the most relevant wireless communication standards before focusing on the key security issues and features of such systems. In particular, the gap between the security features in the communication standards used in CPSs and IoT and their actual vulnerabilities are pointed out with practical examples and recent attacks. We emphasize the need for a more in-depth study of the security issues across all the protocol layers, including both logical layer security and physical layer security.

engineering, electrical & electronic
Security and privacy in the Internet of Things: threats and challenges

Youakim Badr,Xiaoyang Zhu,Mansour Naser Alraja

DOI: https://doi.org/10.1007/s11761-021-00327-z

2021-10-01

Service Oriented Computing and Applications

Abstract:In the past few years, the Internet of Things (IoT) has emerged, grown and gradually affected the daily lives of human beings in many new application domains, ranging from wearable devices, smart manufacturing, to smart homes and ambient intelligence just to mention a few. However, realizing the full potential of IoT while ensuring user security and privacy remains an open research challenge. Existing security solutions and techniques are mainly conceived for centralized and distributed information systems and are not directly applicable to IoT-based systems. In fact, IoT systems have unconventional characteristics such as intermittent connectivity, high scalability, dynamic changes and limited resources and thus require a paradigm shift to develop innovative security and privacy solutions. In this survey, we firstly give an overview of security and privacy in IoT. After defining the context of IoT systems, we identify four main characteristics, which imply unprecedented threats and challenges to existing security solutions and techniques. From the perspective of these characteristics and IoT security requirements, we identify and elaborate specific threats and challenges related to the radio-frequency identification (RFID), wireless sensor networks (WSNs) and mobile delay tolerant networks (MDTNs), which are building blocks in many IoT-based systems. In addition, we discuss potential countermeasures to handle IoT threats and challenges.
Research on Technology of Embedded System Security Protection Component

Wei Liu,Haihang Niu,Weifeng Luo,Wei Deng,Haitao Wu,Shanglin Dai,Zhongwei Qiao,Wei Feng

DOI: https://doi.org/10.1109/aeeca49918.2020.9213603

2020-01-01

Abstract:With the development of the Internet of Things (IoT), it has been widely deployed. As many embedded devices are connected to the network and massive amounts of security-sensitive data are stored in these devices, embedded devices in IoT have become the target of attackers. The trusted computing is a key technology to guarantee the security and trustworthiness of devices’ execution environment. This paper focuses on security problems on IoT devices, and proposes a security architecture for IoT devices based on the trusted computing technology. This paper implements a security management system for IoT devices, which can perform integrity measurement, real-time monitoring and security management for embedded applications, providing a safe and reliable execution environment and whitelist-based security protection for IoT devices. This paper also designs and implements an embedded security protection system based on trusted computing technology, containing a measurement and control component in the kernel and a remote graphical management interface for administrators. The kernel layer enforces the integrity measurement and control of the embedded application on the device. The graphical management interface communicates with the remote embedded device through the TCP/IP protocol, and provides a feature-rich and user-friendly interaction interface. It implements functions such as knowledge base scanning, whitelist management, log management, security policy management, and cryptographic algorithm performance testing.
Securing Real-Time Internet-of-Things

Chien-Ying Chen,Monowar Hasan,Sibin Mohan

DOI: https://doi.org/10.3390/s18124356

2018-12-11

Abstract:Modern embedded and cyber-physical systems are ubiquitous. A large number of critical cyber-physical systems have real-time requirements (e.g., avionics, automobiles, power grids, manufacturing systems, industrial control systems, etc.). Recent developments and new functionality requires real-time embedded devices to be connected to the Internet. This gives rise to the real-time Internet-of-things (RT-IoT) that promises a better user experience through stronger connectivity and efficient use of next-generation embedded devices. However RT- IoT are also increasingly becoming targets for cyber-attacks which is exacerbated by this increased connectivity. This paper gives an introduction to RT-IoT systems, an outlook of current approaches and possible research challenges towards secure RT- IoT frameworks.

Networking and Internet Architecture,Cryptography and Security
A Roadmap Towards Resilient Internet of Things for Cyber-Physical Systems

Denise Ratasich,Faiq Khalid,Florian Geissler,Radu Grosu,Muhammad Shafique,Ezio Bartocci

DOI: https://doi.org/10.1109/ACCESS.2019.2891969

2018-11-06

Abstract:The Internet of Things (IoT) is a ubiquitous system connecting many different devices - the things - which can be accessed from the distance. The cyber-physical systems (CPS) monitor and control the things from the distance. As a result, the concepts of dependability and security get deeply intertwined. The increasing level of dynamicity, heterogeneity, and complexity adds to the system's vulnerability, and challenges its ability to react to faults. This paper summarizes state-of-the-art of existing work on anomaly detection, fault-tolerance and self-healing, and adds a number of other methods applicable to achieve resilience in an IoT. We particularly focus on non-intrusive methods ensuring data integrity in the network. Furthermore, this paper presents the main challenges in building a resilient IoT for CPS which is crucial in the era of smart CPS with enhanced connectivity (an excellent example of such a system is connected autonomous vehicles). It further summarizes our solutions, work-in-progress and future work to this topic to enable "Trustworthy IoT for CPS". Finally, this framework is illustrated on a selected use case: A smart sensor infrastructure in the transport domain.

Emerging Technologies,Machine Learning,Networking and Internet Architecture
Sensor Security: Current Progress, Research Challenges, and Future Roadmap

Anomadarshi Barua,Mohammad Abdullah Al Faruque

DOI: https://doi.org/10.48550/arXiv.2208.09741

2022-08-21

Abstract:Sensors are one of the most pervasive and integral components of today's safety-critical systems. Sensors serve as a bridge between physical quantities and connected systems. The connected systems with sensors blindly believe the sensor as there is no way to authenticate the signal coming from a sensor. This could be an entry point for an attacker. An attacker can inject a fake input signal along with the legitimate signal by using a suitable spoofing technique. As the sensor's transducer is not smart enough to differentiate between a fake and legitimate signal, the injected fake signal eventually can collapse the connected system. This type of attack is known as the transduction attack. Over the last decade, several works have been published to provide a defense against the transduction attack. However, the defenses are proposed on an ad-hoc basis; hence, they are not well-structured. Our work begins to fill this gap by providing a checklist that a defense technique should always follow to be considered as an ideal defense against the transduction attack. We name this checklist as the Golden reference of sensor defense. We provide insights on how this Golden reference can be achieved and argue that sensors should be redesigned from the transducer level to the sensor electronics level. We point out that only hardware or software modification is not enough; instead, a hardware/software (HW/SW) co-design approach is required to ride on this future roadmap to the robust and resilient sensor.

Cryptography and Security
Understanding IoT Security Through the Data Crystal Ball: Where We Are Now and Where We Are Going to Be

Nan Zhang,Soteris Demetriou,Xianghang Mi,Wenrui Diao,Kan Yuan,Peiyuan Zong,Feng Qian,XiaoFeng Wang,Kai Chen,Yuan Tian,Carl A. Gunter,Kehuan Zhang,Patrick Tague,Yue-Hsun Lin

DOI: https://doi.org/10.48550/arXiv.1703.09809

2017-03-29

Abstract:Inspired by the boom of the consumer IoT market, many device manufacturers, start-up companies and technology giants have jumped into the space. Unfortunately, the exciting utility and rapid marketization of IoT, come at the expense of privacy and security. Industry reports and academic work have revealed many attacks on IoT systems, resulting in privacy leakage, property loss and large-scale availability problems. To mitigate such threats, a few solutions have been proposed. However, it is still less clear what are the impacts they can have on the IoT ecosystem. In this work, we aim to perform a comprehensive study on reported attacks and defenses in the realm of IoT aiming to find out what we know, where the current studies fall short and how to move forward. To this end, we first build a toolkit that searches through massive amount of online data using semantic analysis to identify over 3000 IoT-related articles. Further, by clustering such collected data using machine learning technologies, we are able to compare academic views with the findings from industry and other sources, in an attempt to understand the gaps between them, the trend of the IoT security risks and new problems that need further attention. We systemize this process, by proposing a taxonomy for the IoT ecosystem and organizing IoT security into five problem areas. We use this taxonomy as a beacon to assess each IoT work across a number of properties we define. Our assessment reveals that relevant security and privacy problems are far from solved. We discuss how each proposed solution can be applied to a problem area and highlight their strengths, assumptions and constraints. We stress the need for a security framework for IoT vendors and discuss the trend of shifting security liability to external or centralized entities. We also identify open research problems and provide suggestions towards a secure IoT ecosystem.

Cryptography and Security
The Internet of Things: Perspectives on Security from RFID and WSN

Ayush Shah,Ambar Pal,H. B. Acharya

DOI: https://doi.org/10.48550/arXiv.1604.00389

2016-04-04

Abstract:A massive current research effort focuses on combining pre-existing 'Intranets' of Things into one Internet of Things. However, this unification is not a panacea; it will expose new attack surfaces and vectors, just as it enables new applications. We therefore urgently need a model of security in the Internet of Things. In this regard, we note that IoT descends directly from pre-existing research (in embedded Internet and pervasive intelligence), so there exist several bodies of related work: security in RFID, sensor networks, cyber-physical systems, and so on. In this paper, we survey the existing literature on RFID and WSN security, as a step to compiling all known attacks and defenses relevant to the Internet of Things.

Networking and Internet Architecture,Cryptography and Security
A Survey on Sensor-based Threats to Internet-of-Things (IoT) Devices and Applications

Amit Kumar Sikder,Giuseppe Petracca,Hidayet Aksu,Trent Jaeger,A. Selcuk Uluagac

DOI: https://doi.org/10.48550/arXiv.1802.02041

2018-02-07

Abstract:The concept of Internet of Things (IoT) has become more popular in the modern era of technology than ever before. From small household devices to large industrial machines, the vision of IoT has made it possible to connect the devices with the physical world around them. This increasing popularity has also made the IoT devices and applications in the center of attention among attackers. Already, several types of malicious activities exist that attempt to compromise the security and privacy of the IoT devices. One interesting emerging threat vector is the attacks that abuse the use of sensors on IoT devices. IoT devices are vulnerable to sensor-based threats due to the lack of proper security measurements available to control use of sensors by apps. By exploiting the sensors (e.g., accelerometer, gyroscope, microphone, light sensor, etc.) on an IoT device, attackers can extract information from the device, transfer malware to a device, or trigger a malicious activity to compromise the device. In this survey, we explore various threats targeting IoT devices and discuss how their sensors can be abused for malicious purposes. Specifically, we present a detailed survey about existing sensor-based threats to IoT devices and countermeasures that are developed specifically to secure the sensors of IoT devices. Furthermore, we discuss security and privacy issues of IoT devices in the context of sensor-based threats and conclude with future research directions.

Cryptography and Security
Physical Layer Security for the Internet of Things: Authentication and Key Generation

Junqing Zhang,Sekhar Rajendran,Zhi Sun,Roger Woods,Lajos Hanzo

DOI: https://doi.org/10.1109/mwc.2019.1800455

IF: 12.777

2019-01-01

IEEE Wireless Communications

Abstract:A low-complexity, yet secure framework is proposed for protecting the IoT and for achieving both authentication and secure communication. In particular, the slight random difference among transceivers is extracted for creating a unique radio frequency fingerprint and for ascertaining the unique user identity. The wireless channel between any two users is a perfect source of randomness and can be exploited as cryptographic keys. This can be applied to the physical layer of the communications protocol stack. This article reviews these protocols and shows how they can be integrated to provide a complete IoT security framework. We conclude by outlining the future challenges in applying these compelling physical layer security techniques to the IoT.
Software-based security approach for networked embedded devices

José Ferreira,Alan Oliveira,André Souto,José Cecílio

DOI: https://doi.org/10.48550/arXiv.2303.07975

2023-03-14

Abstract:As the Internet of Things (IoT) continues to expand, data security has become increasingly important for ensuring privacy and safety, especially given the sensitive and, sometimes, critical nature of the data handled by IoT devices. There exist hardware-based trusted execution environments used to protect data, but they are not compatible with low-cost devices that lack hardware-assisted security features. The research in this paper presents software-based protection and encryption mechanisms explicitly designed for embedded devices. The proposed architecture is designed to work with low-cost, low-end devices without requiring the usual changes on the underlying hardware. It protects against hardware attacks and supports runtime updates, enabling devices to write data in protected memory. The proposed solution is an alternative data security approach for low-cost IoT devices without compromising performance or functionality. Our work underscores the importance of developing secure and cost-effective solutions for protecting data in the context of IoT.

Cryptography and Security
Trust-Based Attack and Defense in Wireless Sensor Networks: A Survey

Weidong Fang,Wuxiong Zhang,Wei Chen,Tao Pan,Yepeng Ni,Yinxuan Yang

DOI: https://doi.org/10.1155/2020/2643546

2020-09-10

Wireless Communications and Mobile Computing

Abstract:As a key component of the information sensing and aggregating for big data, cloud computing, and Internet of Things (IoT), the information security in wireless sensor network (WSN) is critical. Due to constrained resources of sensor node, WSN is becoming a vulnerable target to many security attacks. Compared to external attacks, it is more difficult to defend against internal attacks. The former can be defended by using encryption and authentication schemes. However, this is invalid for the latter, which can obtain all keys of the network. The studies have proved that the trust management technology is one of effective approaches for detecting and defending against internal attacks. Hence, it is necessary to investigate and review the attack and defense with trust management. In this paper, the state-of-the-art trust management schemes are deeply investigated for WSN. Moreover, their advantages and disadvantages are symmetrically compared and analyzed in defending against internal attacks. The future directions of trust management are further provided. Finally, the conclusions and prospects are given.

computer science, information systems,telecommunications,engineering, electrical & electronic

Risks of Trusting the Physics of Sensors

Sensor-based IoT Data Privacy Protection

Rethinking IoT Security: Understanding and Mitigating Out-of-Band Vulnerabilities

SoK: A Minimalist Approach to Formalizing Analog Sensor Security.

Efficient Fault-Tolerant Information Barrier Coverage in Internet of Things

Security Architecture on the Trusting Internet of Things

Securing Wireless Communications of the Internet of Things from the Physical Layer, An Overview

Building Touch-Less Trust in IoT Devices

When Your Thing Won't Behave: Security Governance in the Internet of Things

Wireless Communication and Security Issues for Cyber–Physical Systems and the Internet-of-Things

Security and privacy in the Internet of Things: threats and challenges

Research on Technology of Embedded System Security Protection Component

Securing Real-Time Internet-of-Things

A Roadmap Towards Resilient Internet of Things for Cyber-Physical Systems

Sensor Security: Current Progress, Research Challenges, and Future Roadmap

Understanding IoT Security Through the Data Crystal Ball: Where We Are Now and Where We Are Going to Be

The Internet of Things: Perspectives on Security from RFID and WSN

A Survey on Sensor-based Threats to Internet-of-Things (IoT) Devices and Applications

Physical Layer Security for the Internet of Things: Authentication and Key Generation

Software-based security approach for networked embedded devices

Trust-Based Attack and Defense in Wireless Sensor Networks: A Survey