A survey on Iot security: Application Areas, Security Threats, and Solution Architectures
tải về 6.16 Mb. Chế độ xem pdf
|
thong-tin-so bao-cao-qpsk-1 - [cuuduongthancong.com]
| D. SECURITY ISSUES AT GATEWAYS
Gateway is a broad layer that has an important role in con- necting multiple devices, people, things and cloud services. Gateways also help in providing hardware and software solutions for IoT devices. Gateways are used for decrypting and encrypting IoT data and translating protocols for com- munication between different layers [36]. IoT systems today are heterogeneous including LoraWan, ZigBee, Z-Wave and TCP/IP stacks with many gateways in between. Some of the security challenges for IoT gateway are discussed below. 1. Secure On-boarding: When a new device or sensor is installed in an IoT system, it is imperative to protect encryption keys. Gateways act as an intermediary be- tween the new devices and the managing services, and all the keys pass through the gateways. The gateways are susceptible to man-in-the-middle attacks and eaves- dropping to capture the encryption keys, especially during the on-boarding process. 2. Extra Interfaces: Minimizing the attack surface is an important strategy that needs to be kept in mind while installing the IoT devices [37]. Only the necessary interfaces and protocols should be implemented by an IoT gateway manufacturer. Some of the services and functionalities should be restricted for end-users to avoid backdoor authentication or information breach. 3. End-to-End Encryption: True end-to-end application layer security is required to ensure the confidentiality of the data [38]. The application should not let anyone other than the unique recipient to decrypt the encrypted messages. Although Zigbee and Zwave protocols sup- port encryption, this is not end-to-end encryption, be- cause, in order to translate the information from one protocol to another, the gateways are required to de- crypt and re-encrypt the messages. This decryption at the gateway level makes the data susceptible to data breaches. 4. Firmware updates: Most IoT devices are resource constrained, and therefore they do not have an user interface or the computation power to download and install the firmware updates. Generally, gateways are used to download and apply the firmware updates. The current and new version of the firmware should be recorded, and validity of the signatures should be checked for secure firmware updates. tải về 6.16 Mb. Chia sẻ với bạn bè của bạn:
|