RETRACTED: Privacy-preserving fuzzy commitment schemes for secure IoT device authentication

Internet of Things (IoT) devices are largely embedded devices which lack a sophisticated user interface, e.g., touch screen, keyboard, etc. As a consequence, traditional Pre-Shared Key (PSK) based authentication for mobile devices becomes difficult to apply. For example, according to our study on home automation devices which leverage smartphone for PSK input, the current process does not protect against active impersonating attack and also leaks the Wi-Fi password to eavesdroppers, i.e., currently these IoT devices can be exploited to enter into critical infrastructures, e.g., home networks. Motivated by this real-world security vulnerability, in this paper we propose a novel proximity-based mechanism for IoT device authentication, called Move2Auth, for the purpose of enhancing IoT device security. In Move2Auth, we require user to hold smartphone and perform one of two hand-gestures (moving towards and away, and rotating) in front of IoT device. By combining (1) large RSS-variation and (2) matching between RSS-trace and smartphone sensor-trace, Move2Auth can reliably detect proximity and authenticate IoT device accordingly. Based on our implementation on Samsung Galaxy smartphone and commodity Wi-Fi adapter, we prove Move2Auth can protect against powerful active attack, i.e., the false-positive rate is consistently lower than 0.5%.

A network-independent tool-based usable authentication system for Internet of Things devices

In the ever-expanding Internet of Things (IoT) domain, the production of data has reached an unparalleled scale. This massive data is processed to glean invaluable insights, accelerating a myriad of decision-making processes. Nevertheless, the privacy and security of such information present formidable challenges. This study proposes an innovative methodology for resolving these challenges, by augmenting the privacy and efficacy of big data analytics through federated learning in the IoT ecosystem. The proffered approach amalgamates a hierarchical structure, a scalable learning rate, and a rudimentary cryptographic mechanism to foster learning while ensuring robust privacy and security. Additionally, we introduce a novel communication protocol - SEPP-IoT, designed to facilitate efficient, secure, and confidential interactions between IoT devices and a central server. In our pursuit of optimizing communication overhead, we propose an adaptive data compression algorithm, aimed at curbing the volume of data transferred between IoT devices and the central server. To fortify resilience and fault tolerance, our approach incorporates multiple mechanisms such as data replication, error correction codes, and proactive fault detection and recovery. Trust management, a salient feature of our framework, bolsters the security and integrity of federated learning. We recommend a unique technique that gauges the dependability of IoT nodes using four trust parameters. We employ the FedSim simulator to evaluate our method’s effectiveness. The results indicate a notable enhancement in privacy and efficiency of big data analytics within the IoT.

When the Internet of Things (IoT) is used in a typical manufacturing system, the industrial plant can be controlled remotely through the Internet. This enables manufacturing and execution systems to obtain real-time work orders directly from the Enterprise Resource Planning (ERP) system. Therefore, workflows for development, production, and manufacturing can be integrated with sales, market, and finance business processes. The possibility of implementing this integration, however, is dependent on the trust, security, and authentication of IoT devices. Many IoT devices face significant security risks such as device hijacking and data leaks due to limited resources and inadequate self-protection capabilities. Despite the fact that several studies have been conducted using the physical unclonable function to protect communication between IoT devices from the aforementioned security threats, current solutions rely on the participation of the server to distribute the key parameters, which requires high message overhead and has a significant impact on efficiency. To fill this gap, this article proposes a Consistent Round Hash optimized SRP-6a-based end-to-end mutual authentication for secure data transfer technique with single-share trusted device collaboration can detect an unauthenticated device. In addition, our proposed technique ensures the overall system's integrity and stability during a scaling-out phenomenon, which is becoming increasingly common in complex industrial environments. Furthermore, we present a formal and informal security analysis of the proposed protocol. According to the results of the performance analysis, our proposed technique has the lowest communication overhead, computational cost, and round-trip time when compared to other state-of-the-art schemes.

Internet of Things (IoT) has been thriving in recent years, playing an important role in a multitude of various domains, including industry 4.0, smart transportation, home automation, and healthcare. As a result, a massive number of IoT devices are deployed to collect data from our surrounding environment and transfer these data to other systems over the Internet. This may lead to cybersecurity threats, such as denial of service attacks, brute‐force attacks, and unauthorized accesses. Unfortunately, many IoT devices lack solid security mechanisms and hardware security supports because of their limitations in computational capability. In addition, the heterogeneity of devices in IoT networks causes nontrivial challenges in detecting security threats. In this article, we present a collaborative intrusion detection system (IDS), namely, MidSiot, deployed at both Internet gateways and IoT local gateways. Our proposed IDS consists of three stages: (1) classifying the type of each IoT device in the IoT network; (2) differentiating between benign and malicious network traffic; and (3) identifying the type of attacks targeting IoT devices. The last two stages are handled by the Internet gateways, whereas the first stage is on the local gateway to leverage the computational resources from edge devices. The evaluation results on three popular IDS datasets (IoTID20, CIC‐IDS‐2017, and BOT‐IoT) indicate our proposal could detect seven common cyberattacks targeting IoT devices with an average accuracy of 99.68% and outperforms state‐of‐the‐art IDSs. This demonstrates that MidSiot could be an effective and practical IDS to protect IoT networks.

The Internet of Things (IoT) is a vast network of real, tangible objects or "things" that can communicate and share data with other systems and gadgets over the Internet. A vital component of assuring the secure and dependable operation of IoT systems and devices is IoT security. Attackers may use IoT devices to get unauthorized access, change functionality, or compromise the data that the device collects and transmits. The risks of IoT security breaches grow as more devices connect and exchange sensitive data. To check the vulnerability in Iot devices, a novel Blockchain enabled Iot based Security Assessment for intrusion (Block-ISAI) technique has been proposed. Bag of Words (BoW) technique is used for feature extraction of API documents which helps to make the document simpler. Blockchain technology is utilized for secure data storage and IoT device registration. In order to detect intrusion, a deep learning architecture is designed using the verified data The attack is either detected or not detected when the vulnerability is found using the GloVe-CNN-BiLSTM Model. If the vulnerability is detected then alerts will be given. Utilizing evaluation measures like accuracy, time efficiency, precision, F1 score, detection rate, recall, false alarm rate, usability and reliability the efficacy of the suggested ISAI technique has been assessed. By the comparison analysis, the proposed ISAI technique’s detection rate is 18.22%, 19.43%, and 3.13% higher than the existing HIDS, NIDS, and ML-DDoS techniques respectively. The accuracy of the proposed system is increased by 0.69%, 6.04%, and 36.15% as compared to the HIDS, NIDS, and ML-DDoS method using UNSW-NB 15 dataset and increases by 2.37%, 18.32%, and 5.95% using KDDCUP 19 dataset respectively.

Undeniably, the Internet of Things (IoT) ecosystem continues to evolve at a breakneck pace, exceeding all growth expectations and ubiquity barriers. From sensor to cloud, this giant network keeps breaking technological bounds in several domains, and wireless sensor nodes (motes) are expected to be predominant as the number of IoT devices grows towards the trillions. However, their future in the IoT ecosystem still seems foggy, where several challenges, such as (i) device’s connectivity, (ii) intelligence at the edge, (iii) security and privacy concerns, and (iv) growing energy needs, keep pulling in opposite directions. This prospective paper offers a succinct and forward-looking review of recent trends, challenges, and state-of-the-art solutions of low-end IoT motes, where reconfigurable computing technology plays a key role in tomorrow’s IoT devices.

In today’s competitive landscape, achieving customer-centricity is paramount for the sustainable growth and success of organisations. This research is dedicated to understanding customer preferences in the context of the Internet of things (IoT) and employs a two-part modeling approach tailored to this digital era. In the first phase, we leverage the power of the self-organizing map (SOM) algorithm to segment IoT customers based on their connected device usage patterns. This segmentation approach reveals three distinct customer clusters, with the second cluster demonstrating the highest propensity for IoT device adoption and usage. In the second phase, we introduce a robust decision tree methodology designed to prioritize various factors influencing customer satisfaction in the IoT ecosystem. We employ the classification and regression tree (CART) technique to analyze 17 key questions that assess the significance of factors impacting IoT device purchase decisions. By aligning these factors with the identified IoT customer clusters, we gain profound insights into customer behaviour and preferences in the rapidly evolving world of connected devices. This comprehensive analysis delves into the factors contributing to customer retention in the IoT space, with a strong emphasis on crafting logical marketing strategies, enhancing customer satisfaction, and fostering customer loyalty in the digital realm. Our research methodology involves surveys and questionnaires distributed to 207 IoT users, categorizing them into three distinct IoT customer groups. Leveraging analytical statistical methods, regression analysis, and IoT-specific tools and software, this study rigorously evaluates the factors influencing IoT device purchases. Importantly, this approach not only effectively clusters the IoT customer relationship management (IoT-CRM) dataset but also provides valuable visualisations that are essential for understanding the complex dynamics of the IoT customer landscape. Our findings underscore the critical role of logical marketing strategies, customer satisfaction, and customer loyalty in enhancing customer retention in the IoT era. This research offers a significant contribution to businesses seeking to optimize their IoT-CRM strategies and capitalize on the opportunities presented by the IoT ecosystem.

The proliferation of Internet of Things (IoT) devices has introduced significant challenges in cybersecurity, particularly in the realm of intrusion detection. While effective, traditional centralized machine learning approaches often compromise data privacy and scalability due to the need for data aggregation. In this study, we propose a federated learning framework for near-real-time intrusion detection in IoT environments. Federated learning enables decentralized model training across multiple devices without exchanging raw data, thereby preserving privacy and reducing communication overhead. Our approach builds upon a previously proposed hybrid model, which combines a machine learning model deployed on IoT devices with a second-level cloud-based analysis. This previous work required all data to be passed to the cloud in aggregate form, limiting security. We extend this model to incorporate federated learning, allowing for distributed training while maintaining high accuracy and privacy. We evaluate the performance of our federated-learning-based model against a traditional centralized model, focusing on accuracy retention, training efficiency, and privacy preservation. Our experiments utilize actual attack data partitioned across multiple nodes. The results demonstrate that this hybrid federated learning not only offers significant advantages in terms of data privacy and scalability but also retains the previous competitive accuracy. This paper also explores the integration of federated learning with cloud-based infrastructure, leveraging platforms such as Databricks and Google Cloud Storage. We discuss the challenges and benefits of implementing federated learning in a distributed environment, including the use of Apache Spark and MLlib for scalable model training. The results show that all the algorithms used maintain an excellent identification accuracy (98% for logistic R=regression, 97% for SVM, and 100% for Random Forest). We also report a very short training time (less than 11 s on a single machine). The previous very low application time is also confirmed (0.16 s for over 1,697,851 packets). Our findings highlight the potential of federated learning as a viable solution for enhancing cybersecurity in IoT ecosystems, paving the way for further research in privacy-preserving machine learning techniques.

The proliferation of Internet of Things (IoT) devices in personal and household environments has led to a significant increase in security vulnerabilities. These devices, due to their limited computational resources, often struggle to support conventional security solutions, making them prime targets for cyberattacks. This paper explores the potential of lightweight machine learning (ML) models to enhance the security of personal IoT devices. By leveraging the power of AI, lightweight models can offer real-time threat detection and anomaly identification without compromising the device's performance or requiring extensive computational resources. The paper investigates various ML techniques that are well-suited for IoT environments, such as decision trees, k-nearest neighbours (KNN), and support vector machines (SVM), focusing on their ability to detect intrusions, unauthorized access, and other malicious activities while maintaining efficiency. Additionally, the study highlights the trade-offs between model complexity, accuracy, and resource consumption, offering practical insights for deploying ML solutions in resource-constrained IoT systems. Key challenges, including data privacy, model generalization, and the adaptability of models to diverse IoT ecosystems, are addressed. Finally, the paper discusses future directions for the integration of more advanced lightweight models, such as federated learning and edge computing, which could further enhance security capabilities while ensuring minimal impact on IoT device performance. Through this review, the paper advocates for the adoption of lightweight ML models as a feasible and scalable solution to securing personal IoT devices in an increasingly connected world.

The Internet of Things (IoT) devices is able to communicate with another IoT devices in heterogeneous environments. They are also able to create a network by their own using wireless capabilities without a centralized approach. This network is called wireless mobile ad hoc network (MANET). The MANET facilitate IoT devices to communicate with each other in an infrastructure less network of the Internet of Things environment. The IoT devices can dynamically join, create connection and exchange information among them. The role of cloud in this framework is to store and process the data by IoT devices. The communication Security has been raised as one of the most critical issues of cloud computing where resolving such an issue would result in a constant growth in the use and popularity of cloud. Our purpose of this study is to create a framework for providing the communication in an integrated framework of Cloud and MANET among IoT devices. Our main contribution links a new study that integrates cloud computing to the MANET and provides communication to the internet of things. This study can be used in the framework of the Internet of Things in future.

The Internet of Things (IoT) has had a considerable influence on our daily lives by enabling enhanced connection of devices, systems, and services that extends beyond machine-to-machine interactions and encompasses a wide range of protocols, domains, and applications. However, despite privacy concerns shown by IoT users, little has been done to reduce and protect individual information exposure. It is extremely difficult to mitigate IoT devices from reidentification threats which is why it is still a major challenge for IoT users to securely protect their information. The trust controls how we regulate privacy in our IoT platforms in the same way that it governs personal relationships. As IoT devices become increasingly linked, more data is shared across individuals, businesses, governments, and ecosystems. Technologies, sensors, machines, data, and cloud connections all rely largely on trust relationships that have been formed. With the rapid growth of additional types of IoT devices that are being introduced, it, therefore, expands privacy concerns and is difficult to develop trust with an IoT system or device without the option to regulate information privacy settings. Privacy has always been a barrier for many devices as they race for the early adoption of IoT technologies. Several Internet of Things devices or systems will continue to pose privacy threats. As a result, the main objective of this study was to examine the individual understanding of privacy and to promote information privacy protection awareness not only to IoT users but also to organizations that use IoT devices or platforms to run their day-to-day business operations. Furthermore, the objective extends to compare user knowledge and concerns about IoT privacy, as well as to identify any common attitudes and variances. However, in terms of enhancing individuals’ knowledge, an artifact was developed to educate and enhance information privacy awareness among IoT users. A pre- and postquestionnaire was generated to test and validate user knowledge regarding information privacy protection in IoT. The study was conducted using a quantitative research method. Findings indicate that IoT users’ awareness of information privacy protection turned out to be average, suggesting a need for education and awareness. Several participants stated that information privacy protection awareness is required within the community to educate, raise awareness, eliminate human error, and enable individuals to be conscious of their privacy when surfing the Internet.

Seeing is not always believing: Insights on IoT manufacturing from firmware composition analysis and vendor survey

With the advancement in science and technology, the demand for electronic Internet of Things (IoT) devices has increased to store and process digital data. With the advancement in IoT technology, we are more reliant on IoT devices to perform our regular tasks. IoT Forensics deals with the investigation of IoT devices such as smartphones, tablets, smart watches, or any device which is connected to the Internet. The data on these devices can still be retrieved via IoT forensics even if they are destroyed, resold, or misplaced. Before discarding any IoT device, we must consider how to secure the data stored on them. We are then going to discuss the several types of personal data that could be retrieved from discarded IoT devices. Finally, we are going to discuss the protection measures for the safe disposal of IoT devices.

ABSTRACTIn recent years, the emerging development of Internet of things (IoT) has created new opportunities for IoT service provider, device manufacturer and customer (end user). In agriculture, employing IoT can help reducing manpower as well as standardizing agricultural processes, thus increasing the benefit for customer who does agricultural business. Beside the opportunities, there are also issues while doing maintenance for an agricultural IoT system. One of them is how to automate the process to detect faults of IoT devices in a large deployment area. While previous studies focus on investigating algorithms as well as theoretical model to detect faults for specific IoT devices, automatically expanding of IoT management process for detecting faults of sensor/actuator has not been investigated yet. To achieve this, we should be able to deal with the relationship between IoT device manufacturer, service provider and customer. In this study, we conceptualize the knowledge of IoT devices, management process and fault detection requirement. To realize this model, we introduce a runtime system to expand the IoT management process for detecting sensor/actuator faults which is able to provide the above features. We do several experiments to show the effectiveness and usefulness of the proposed solution.