A survey of security and privacy issues in the Internet of Things from the layered context <s> 13 <s> In large-scale systems, user authentication usually needs the assistance from a remote central authentication server via networks. The authentication service however could be slow or unavailable due to natural disasters or various cyber attacks on communication channels. This has raised serious concerns in systems which need robust authentication in emergency situations. The contribution of this paper is two-fold. In a slow connection situation, we present a secure generic multi-factor authentication protocol to speed up the whole authentication process. Compared with another generic protocol in the literature, the new proposal provides the same function with significant improvements in computation and communication. Another authentication mechanism, which we name stand-alone authentication, can authenticate users when the connection to the central server is down. We investigate several issues in stand-alone authentication and show how to add it on multi-factor authentication protocols in an efficient and generic way. <s> BIB001 </s> A survey of security and privacy issues in the Internet of Things from the layered context <s> 13 <s> Cyber Physical Systems (CPS), widely used in pervasive computing, integrate computation in the cyber world with control of physical processes. Developing CPS is challenging because interactions between physical and cyber components are complex and often unpredictable. Traditional debugging techniques can detect bugs in the cyber world, but bugs introduced from physical components and induced by limitations in the software interface to physical hardware are still difficult to detect. My research will capture the state of art and the state of the practice in verification and validation of CPS. Based on this, I will design middleware that combines models of the physical world with programming-language based assertions to help developers to design, develop, and debug robust CPS applications with ease. <s> BIB002 </s> A survey of security and privacy issues in the Internet of Things from the layered context <s> 13 <s> It is widely held that debugging cyber-physical systems (CPS) is challenging, to date, empirical studies investigating research challenges in CPS verification and validation have not been done. As a result, the exact challenges facing CPS developers in the real world remain at best unquantified and at worst unknown, and the research directions the community should undertake are not clearly identified. In this paper, we review our recent empirical study of real-world CPS developers. This position paper then uses the findings from this study to highlight the discovered key challenges and to present a research trajectory to address these challenges. <s> BIB003 </s> A survey of security and privacy issues in the Internet of Things from the layered context <s> 13 <s> Android users are constantly threatened by an increasing number of malicious applications (apps), generically called malware. Malware constitutes a serious threat to user privacy, money, device and file integrity. In this paper we note that, by studying their actions, we can classify malware into a small number of behavioral classes, each of which performs a limited set of misbehaviors that characterize them. These misbehaviors can be defined by monitoring features belonging to different Android levels. In this paper we present MADAM, a novel host-based malware detection system for Android devices which simultaneously analyzes and correlates features at four levels: kernel, application, user and package, to detect and stop malicious behaviors. MADAM has been specifically designed to take into account those behaviors that are characteristics of almost every real malware which can be found in the wild. MADAM detects and effectively blocks more than 96 percent of malicious apps, which come from three large datasets with about 2,800 apps, by exploiting the cooperation of two parallel classifiers and a behavioral signature-based detector. Extensive experiments, which also includes the analysis of a testbed of 9,804 genuine apps, have been conducted to show the low false alarm rate, the negligible performance overhead and limited battery consumption. <s> BIB004 </s> A survey of security and privacy issues in the Internet of Things from the layered context <s> 13 <s> Abstract In the roaming service system of Global Mobile Networks (GLOMONET), mutual authentication and key agreement (MAKA) protocol is used to identify legitimate roaming users and establish a secure session between users and servers. In recent years, many MAKA protocols are proposed. Among them, the most representative is Gope-Hwang's, which uses the low-cost cryptographic primitives, and hence is more suitable for battery-powered mobile devices. In this paper, we analyze the deficiencies of Gope-Hwang's protocol and propose a novel efficient MAKA protocol with desynchronization for anonymous roaming service in GLOMONET. Gope-Hwang's protocol is lightweight but is susceptible to replay attacks and have a large storage burden. We utilize symmetric encryption to implement dynamic random pseudo-ID, which can achieve anonymity, solve storage burden problem and reach desynchronization. Informal analysis and automated security validation with AVISPA Tool show that our protocol can resist many common attacks such as replay attack, lost smart card attack, forgery attack etc. Moreover, compared to the other four selected protocols in our performance analysis, the efficiency of our protocol outperforms all the other work and is increased by 9.6% than that of Gope-Hwang's. <s> BIB005 </s> A survey of security and privacy issues in the Internet of Things from the layered context <s> 13 <s> The emergence of the mobile Internet of Things (IoT) has made our lives smarter, relying on its various mobile IoT devices and services provided. However, with the explosively emerging mobile IoT services, malicious attackers can access them in an unauthorized way. In this paper, we designed an Efficient Anonymous User Authentication (E-AUA) protocol between the users and servers based on multiserver architectures, which contain multiple servers to address the problem of network congestion in mobile IoT. Furthermore, the E-AUA protocol was designed with a dual messages mechanism with strong anti-attack ability, lower communication and computation costs. Comparing with the state of the art protocols, our E-AUA protocol reduced both communication and computation costs. We also provided a security analysis to demonstrate that our E-AUA protocol is secure and meets a variety of security requirements in a motivated mobile IoT scenario. <s> BIB006 </s> A survey of security and privacy issues in the Internet of Things from the layered context <s> 13 <s> Abstract In an increasingly connected world, energy efficiency has become a significant problem. Online electronic transactions are booming based on shopping convenience, fast payments, and lower prices. Electronic trading systems are one of the main sources of energy consumption because the so-called contract signing protocol (CSP) is a crucial part of e-commerce. Therefore, the energy consumption is largely determined by the efficiency of the CSP. To this end, an abuse-free CSP with low-storage TTP is proposed to eliminate the enormous energy-consumption problem originating from the unfit protocol design. This protocol exploits a proxy key scheme and introduces a lightweight TTP storage policy that greatly reduces the TTP burden by integrating symmetric encryption aiming at constructing an energy-efficient electronic transaction ecosystem. Theoretical analysis and comparative analysis show that the storage requirement of TTP is reduced by more than 50% while ensuring fairness, optimism and abuse-freeness in our protocol. Moreover, the exchange steps of our protocol are reduced so that the protocol efficiency is improved. <s> BIB007 </s> A survey of security and privacy issues in the Internet of Things from the layered context <s> 13 <s> It is well known that blink, yawn, and heart rate changes give clue about a human’s mental state, such as drowsiness and fatigue. In this paper, image sequences, as the raw data, are captured from smart phones which serve as non-contact optical sensors. Video streams containing subject’s facial region are analyzed to identify the physiological sources that are mixed in each image. We then propose a method to extract blood volume pulse and eye blink and yawn signals as multiple independent sources simultaneously by multi-channel second-order blind identification (SOBI) without any other sophisticated processing, such as eye and mouth localizations. An overall decision is made by analyzing the separated source signals in parallel to determine the driver’s driving state. The robustness of the proposed method is tested under various illumination contexts and a variety of head motion modes. Experiments on 15 subjects show that the multi-channel SOBI presents a promising framework to accurately detect drowsiness by merging multi-physiological information in a less complex way. <s> BIB008
The proposed authentication and authorization techniques in the recent literature are still compromised for the resource constrained devices. There are more research to be done on the implementation of authentication techniques for resource constrained IoT devices that would be light- BIB004 have proposed a novel malware detection system called MADAM for android devices that are designed to detect any malicious behaviours. The system simultaneously analyses and block any malicious behaviours at four levels: kernel, suer, application and package. The author tested MADAM on three large datasets of 2800 apps and the proposed system efficiently blocks nearly 96% of malicious apps with minimal power usage. Overall, from our study we found security gaps in IoT architecture, lightweight security solutions and managing huge heterogeneous data. Security requirements for IoT are application specific. However, we can design a standard framework that can be customizable according to the application requirements. We can apply some ideas of software engineering in which we can summarize the similarities of these IoT applications and design a common framework that can provide the necessary security solutions to these applications. Lightweight security solutions will always be the future research direction due to resource constrained nature of IoT. Therefore, lightweight security concerns are noteworthy part that has to be well addressed before deploying advanced Internet of Things (IoT) systems. The security solutions such as key management, authentication, authorization, access control etc. should be energy aware and lightweight. The application computation and security requirements can be divided in different levels. Furthermore, we can add some default solutions to each levels so that it can satisfy the particular necessities of the levels. In this way the algorithm proposed in these levels can be modified to benefit the IoT system. Sometimes, remote authentication server might be required when there's unavailability of data because of the natural disaster and other factors. This has been a serious concern in the IoT system. Huang et al. BIB001 proposed two solutions to authenticate users from the remote locations. The first solution is a multi-factor authentication scheme that authenticates users by using passwords, biometrics and smart-cards. The other solution is a stand-alone authentication protocol which supports the authentication of the users even if the remote server is down. The proposed techniques have shown are efficient and reduced communication overhead compared to other solutions.Similarly, IoT devices used in smart homes are vulnerable to many attacks. The devices are preloaded with secret keys which the users usually do not update while installing at homes. Therefore, it become easy for the attackers to hijack the wireless communications. The users might not be aware of this situation hence suffers from privacy issues. To address these problems Zhang et. al  have proposed a matrix based cross-layer key establishment protocol. The protocol enables smart home appliances to establish a secret session key among themselves without the use of preloaded secret keys. The protocol is promising in achieving secret session key with minimal energy consumption and without the need of pre-shared keys. Similarly some efficient authentication protocols BIB006 BIB005  and abusefree contract signing protocol with low-storage cost BIB007 are proposed for various applications of IoT. Eventually, we may be ready to give a general unique IoT security system. IoT system produces huge amount of heterogeneous data each second. The efficient approach to manage these huge data produced by IoT systems is also focus of our research in future. We can apply technologies such as big data, cloud and fog computing for the massive information exchange in the network. The technologies are efficient in managing heterogeneous huge data securely and efficiently. Fog computing is a novel paradigm that work closely to the edge of the network. The concept of fog computing is quite similar to the cloud computing that provides services such as data storage, massive data computing, application services etc. It has really re-defined the concept of cloud computing. Stojmenovic et al.  have discussed the authentication and authorization techniques that can be implemented in Fog computing. A recent work of 10 explains what could be the security issues in the fog computing communications and lists some possible research directions to address these issues. A security scenario of fragile connection between the cloud and fog computing is also addressed by the author with an example of authentication techniques. Therefore, it would be a good idea to apply big data, cloud and fog computing solutions on IoT systems to get comprehensive security solutions for the applications. Another interest research direction to look at is to combine formal methods with machine learning to detect possible security vulenrabilies in different layers of IoT applications. Formal method is able to provide a rigorous mathematical and logical guarantees for the safety and security properties of a given IoT application  BIB003  . Though there are many restrictions in the approach (e.g., state space explosion, high cost of maintenance, and require non-trivial learning curve) ? , recent work in the formal methods have improved to a practical level to address security issues both at development and runtime   BIB002    . Also machine learning has been increasingly used by both professionals and academics for various aspects in IoT  BIB008 and they can be used in combination with formal methods to provide rigorous yet scalable security guarantee for mission-critical IoT applications.