A survey of security and privacy issues in the Internet of Things from the layered context <s> Security solutions in the Application Layer <s> Based on the Internet privacy protection mechanism with the characteristics of Internet of things, preference-based privacy protection mechanism for the Internet of things is proposed. This mechanism introduces the third party organization to evaluate the individual user's privacy preference and feedback the result to the SP, which provide the Internet of things to the user, SP offers the appropriate level of the privacy protection according to the privacy preference, the third party organization will offer supervision for the SP. This mechanism gives user the right of speak of privacy protection at some levels. <s> BIB001 </s> A survey of security and privacy issues in the Internet of Things from the layered context <s> Security solutions in the Application Layer <s> This paper describes a framework that allows fine-grained and flexible access control to connected devices with very limited processing power and memory. We propose a set of security and performance requirements for this setting and derive an authorization framework distributing processing costs between constrained devices and less constrained back-end servers while keeping message exchanges with the constrained devices at a minimum. As a proof of concept we present performance results from a prototype implementing the device part of the framework. <s> BIB002 </s> A survey of security and privacy issues in the Internet of Things from the layered context <s> Security solutions in the Application Layer <s> According to the European Union data protection legislation, privacy is a fundamental right that should be protected in the interaction of the citizen with the digital world. In the evolution of Internet towards new paradigms like Internet of Things (IoT), protection of privacy can be a challenging task because IoT connected objects can generate an enormous amount of data, some of which actually constitute personal data. In addition, it is difficult to control the flow of data when there is no user interface or adequate tools for the user. In this paper we describe an efficient solution to enforcement security policy rules that addresses this challenge, and takes a more general enterprise architecture approach for security and privacy engineering in IoT. This enforcement solution is based on a Model-based Security Toolkit named SecKit, and its integration with the MQ Telemetry Transport (MQTT) protocol layer, which is a widely adopted technology to enable the communication between IoT devices. In this paper, we describe the motivation and design of our enforcement solution, demonstrating its feasibility and the performance results in a case study. <s> BIB003 </s> A survey of security and privacy issues in the Internet of Things from the layered context <s> Security solutions in the Application Layer <s> Open authorization (OAuth) is an open protocol, which allows secure authorization in a simple and standardized way from third-party applications accessing online services, based on the representational state transfer (REST) web architecture. OAuth has been designed to provide an authorization layer, typically on top of a secure transport layer such as HTTPS. The Internet of Things (IoTs) refers to the interconnection of billions of resource-constrained devices, denoted as smart objects, in an Internet-like structure. Smart objects have limited processing/memory capabilities and operate in challenging environments, such as low-power and lossy networks. IP has been foreseen as the standard communication protocol for smart object interoperability. The Internet engineering task force constrained RESTful environments working group has defined the constrained application protocol (CoAP) as a generic web protocol for RESTful-constrained environments, targeting machine-to-machine applications, which maps to HTTP for integration with the existing web. In this paper, we propose an architecture targeting HTTP/CoAP services to provide an authorization framework, which can be integrated by invoking an external oauth-based authorization service (OAS). The overall architecture is denoted as IoT-OAS. We also present an overview of significant IoT application scenarios. The IoT-OAS architecture is meant to be flexible, highly configurable, and easy to integrate with existing services. Among the advantages achieved by delegating the authorization functionality, IoT scenarios benefit by: 1) lower processing load with respect to solutions, where access control is implemented on the smart object; 2) fine-grained (remote) customization of access policies; and 3) scalability, without the need to operate directly on the device. <s> BIB004 </s> A survey of security and privacy issues in the Internet of Things from the layered context <s> Security solutions in the Application Layer <s> The Internet of Things (IoT), which can be regarded as an enhanced version of machine-to-machine communication technology, was proposed to realize intelligent thing-to-thing communications by utilizing the Internet connectivity. In the IoT, “things” are generally heterogeneous and resource constrained. In addition, such things are connected to each other over low-power and lossy networks. In this paper, we propose an inter-device authentication and session-key distribution system for devices with only encryption modules. In the proposed system, unlike existing sensor-network environments where the key distribution center distributes the key, each sensor node is involved with the generation of session keys. In addition, in the proposed scheme, the performance is improved so that the authenticated device can calculate the session key in advance. The proposed mutual authentication and session-key distribution system can withstand replay attacks, man-in-the-middle attacks, and wiretapped secret-key attacks. <s> BIB005
The application layer includes smart devices that provide application specified services to the users. Each of these devices are usually simple, light weight and resource-constrained that are vulnerable to the attacks. Seitz et al. BIB002 discussed access control and authorization in interconnected devices and proposed a framework that supports flexible access control and authorization for devices with low memory and processing power. The proposed framework provides remarkable flexibility for the access control models and minimize the communication cost when processing the exchanged message between the constrained and less constrained servers. Cirani et al. BIB004 proposed IoT-OAS architecture to provide an authorization framework targeting HTTP/CoAP services, which can be integrated by invoking an external oauth-based authorization service (OAS). The proposed architecture is flexible and easy to integrate with external services and has the benefits in terms of low processing load, scalability and remote access customization. Park et al. BIB005 proposed an inter-device authentication techniques and session-key distribution framework for secure communication between the devices. The proposed technique is capable of estimating the session key in prior that prevented attacks such as man-in-the-middle and replay attacks. Neisse et al BIB003 proposed a security policy to address the privacy and security challenges for the communication between the devices. The proposed policy provided optimal communication between the IoT devices. Tao et al. BIB001 proposed a mechanism for privacy protection that is preference-based for the IoT. Data and information privacy is one of the major concern in the application layer. The proposed mechanism introduces a trusted third party that evaluate the privacy preference of the users. The evaluated results and feedback are then sent to the service provider of the Internet of Things (SP). SP ensure desirable level of user privacy according to their preference and the third party provide supervision to the SP. The authors 51 52 53 have proposed different frameworks as security solutions in the application layer. The author 51 52 have proposed access control models while in 52 authorization framework targeting HTTP/CoAP services is proposed. The security of the network cannot alone guarantee the security attack in the IoT so the devices should also be manufactured with built-in security and patches. The security of IoT Systems can be further enhanced by applying Machine Learning / Artificial Intelligence Techniques and jamming techniques (Jamming the signal of the malicious nodes). 