Security Challenges and Strategies For The Iot in Cloud Computing
Security Challenges and Strategies For The Iot in Cloud Computing
Abstract— The Internet of Things is progressively turning into Infrastructure as a Service, Platform as a Service, Private and
a pervasive computing service, needing enormous volumes of Hybrid cloud, Test and development, Big data analytics, File
data storage and processing. However, due to the distinctive storage, Disaster recovery and Backup. One of the
properties of resource constraints, self-organization, and short- technologies which has merged and apparently benefitting
range communication in Internet of Things (IoT), it always from Cloud computing is Internet of Things (IoT)[1].
adopts to cloud for outsourced storage and computation. This
integration of IoT with cloud has a row of unfamiliar security The inception of IoT from Kevin Ashton's presentation
challenges for the data at rest. Cloud computing delivers highly title at P&G in 1999 and the way it has evolved today to reach
scalable and flexible computing and storage resources on pay- in every home and office as smart IoT devices is a highly
per-use policy. Cloud computing services for computation and progressive journey. Internet of Things was viewed as a
storage are getting increasingly popular and many technology which has potential to change the world, just as the
organizations are now moving their data from in-house data internet did. But sooner or later, the implementation and
centers to the Cloud Storage Providers (CSPs). Time varying applications of this concept spread out from just Radio
workload and data intensive IoT applications are vulnerable to Frequency Identification (RFID) to heterogeneous
encounter challenges while using cloud computing services. implementations. This in turn lead to several new challenges
Additionally, the encryption techniques and third-party for insufficient processing or storage power to make the IoT
auditors to maintain data integrity are still in their developing
devices efficient without overburdening them with
stage and therefore the data at rest is still a concern for IoT
resources[1]. At this juncture, the two different yet powerful
applications. In this paper, we perform an analysis study to
investigate the challenges and strategies adapted by Cloud
technologies, Cloud computing and IoT integrated with each
Computing to facilitate a safe transition of IoT applications to other to become an important component of Future Internet.
the Cloud. This integration is seen as a disruptive technology with a large
number of potential applications awaiting to benefit from it.
Keywords-IoT; Cloud Computing; Security; Services; There is plenty of research and development in the area of IoT
Storage; Data Privacy. and Cloud computing. However, to the best of our knowledge
the challenges dealt during the integration of IoT with Cloud
I. INTRODUCTION computing are not categorically investigated. Therefore, in
The most referred to definition for Cloud Computing is this paper we systematically describe the Cloud-IoT
given by National Institute of Standards and Technology architecture, investigate the challenges of Cloud-IoT and
(NIST) in the year 2011, which states "Cloud computing is a emphasize our analysis on the security challenges and their
model for enabling ubiquitous, convenient, on-demand strategies. The research questions which we answer through
network access to a shared pool of configurable computing our study are as follows.
resources (e.g., networks, servers, storage, applications, and 1. What is the need for the integration of IoT with Cloud
services) that can be rapidly provisioned and released with computing?
minimal management effort or service provider interaction".
The key attributes of Cloud computing are On-demand self- 2. Are there any challenges in the integration of IoT with
service, Broad network access, Resource pooling, Rapid Cloud?
elasticity and Measure service. On the whole, these key 3. What are the security challenges and strategies in the
attributes of Cloud computing allow the consumers to Cloud-IoT integration?
automatically acquire resources from the pool of resources in
the Cloud as and when they are needed. The consumers have The structure of the paper is as follows. In Section II, we
to pay only for the services they received. The services offered present the related work. In Section III, the Cloud-IoT
by Cloud are Software as a Service (SaaS), Platform as a architecture is illustrated followed by investigation of
Service (PaaS) and Infrastructure as a Service (IaaS). These challenges in Cloud-IoT in Section IV. Section V discusses
services could be deployed in multiple ways which are Private the open issues in the research. Lastly, we outline the future
cloud, Community cloud, Public cloud and Hybrid cloud. To work in Section VI and conclude our work in Section VII.
mention few areas where Cloud computing is vastly used are
II. BACKGROUND from the sensing layer and process the data to feed the
Cloud Computing services are applied in several fields information to the application layer and other IoT objects.
associated with IoT like Genomics Data Analysis, Teaching
and learning, Services for SMEs, E-Learning process, Virtual
reality, Manufacturing, Disaster Management, Smart Cities,
Internet of Vehicles, Digital Forensics, Hotel Industry, E-
Government and Human Resource Management. Zhou et al.
[2] presented a taxonomy of main security threats in Cloud-
based IoT like identity privacy, location privacy, node
compromise attack, layer removing/adding attack, forward
and backward security and semi-trusted/malicious cloud
security. Whereas, Stergiou et al.[3] views the intercepting
issues in the integration of Cloud and IoT and indicate that the
big data and performance are the integral issues of the Cloud-
IoT integration. Almajed et al.[4] discusses the use of elliptic
curve cryptography (ECC) in low computational devices like
IoT devices due to its effectiveness in generating small keys
with a strong encryption mechanism. Almogren [5] emphasize
the significance of timely utilization of cloud services by the
wearable sensors of patients to monitor critical data. But, it is
focused on the security of healthcare smart objects only.
Hassan et al.[6] presented a cyber-attack detection model in
Cloud based Industrial Internet of Things(IIoT) network.
However, it is confined to the IIoT. Amin et al.[7] shows the
security vulnerabilities of the multi-server cloud environment
and a smartcard-based authentication protocol is proposed. Figure 1 Cloud-IoT Architecture
However, it is applicable for the distributed cloud
environment only. Jaimunk et al.[8] presented a privacy
preserving cloud-IoT architecture, however in an attempt to Web servers with RESTful and SOAP is used for
give control to the users, it adds more than required load to the communication between the devices over the internet. SOAP
user. WS works with exchange XML but in most of the WSs
operates over HTTP, which is a crucial challenge for the
Most of the previous studies have encountered the resources and energy limited devices. An application protocol
challenges in IoT and in Cloud computing separately and in CoAP enable resource constrained devices to use RESTful
particular application environments. The critical challenges services. CoAP uses UDP rather than TCP, commonly used in
during the integration of IoT with Cloud are not explicitly HTTP, for lightweight communication between resource
studied or discussed. In this study we fill this research gap by constraint devices[3].
clearly identifying and describing these challenges.
IV. INVESTIGATING CHALLENGES OF CLOUD-IOT
III. CLOUD-IOT ARCHITECTURE
Cloud computing is an intermediate layer between the
Cloud Computing and IoT have had an enormous growth things and the applications, hiding complexities and
and development. The characteristics which they showcase functionalities. As we know that IoT in general is a network
upon integration with each other are exemplary. They of interconnected objects and these objects are part of
complement each other very well and therefore many innumerable applications. For each application, the challenges
researchers have designed and proposed all potential are unique, but in general they fall into a typical category. In
applications keeping in mind the integration of Cloud and IoT. this study, we will mainly focus on the security challenges and
IoT has been on the receiving end after leveraging its position analyze the outcomes of the state-of-the-art strategies to
upon getting abundant support from cloud in terms of storage overcome these challenges. Since the convergence of cloud
and computing capacities. and IoT, there have been continuous concerns regarding the
In this section, we present the Cloud-IoT architecture. In lack of trust in the cloud service provider and the knowledge
the Figure 1 below we demonstrate the three layers- about the physical location of the data being transmitted by
Application layer, network layer and sensing layer. The data various IoT nodes to the Cloud. There are concerns regarding
sensing and collection protocols represent the IoT objects the multi-tenancy storage architecture of cloud databases
which are reading and collecting information through several where multiple client’s data is stored in a single unit, which
IoT readers and RFID tags. This information could be stored could compromise the security and lead to leakage of sensitive
into the cloud for further processing. The application layer information[9]. This type of threat associated with the mistrust
which could sense the information from the environment and in the cloud service provider is called the insider threat and it
simultaneously send queries to the cloud to process the sensed is one of the most unsettled concerns of the IT industry even
data and receive results. It could also process the data received today. The critical challenges we have identified from the
literature are briefly described in Table 1 as follows.
368
2020 11th International Conference on Information and Communication Systems (ICICS)
369
2020 11th International Conference on Information and Communication Systems (ICICS)
services is a challenging task for the measures should be straightforward to the users to avoid
Cloud-IoT [1]. imprecise trust in the objects, (7) the privacy policy should
be customizable for users in such a way that they may
regulate it accordingly [2].
Analysis of Cloud-IoT Security Challenges and Strategies
For any technology that processes or stores information, 2) Authentication and confidentiality
data security and privacy issues are its first priority. Likewise, IoT is a web of interconnected things and each thing is
for Cloud-IoT, the issues related to security and privacy are given an address for identification. As a norm, when
the greatest concerns because it is directly associated with the communication request is shared among these interconnected
trust of users. In the past, there had been hacking and forgery IoT objects, they are required to authenticate each other. In
cases with both reputed and non-reputed companies in the Cloud-IoT too, it is no different and identical authentication
market, which incurred great losses. Security threat associated challenges exist.
with IoT is much more alarming because for an instance, A two-way authentication security scheme is introduced in
unlike security threats in banking sector which might bring [7] specifically for IoT based on the Datagram Transport
great financial loss, any threat to smart healthcare IoT Layer Security (DTLS) protocol. The DTLS is placed
applications or Smart Vehicles connected to the Cloud is life between the transport and application layer. This scheme is
threatening [2, 19]. Some of the major security challenges and backed by the RSA and it is designed for the 6LoWPANs.
relevant strategies are as follows.
The architecture presented by the authors provide message
1) Data privacy integrity, confidentiality and authenticity with enough
Data privacy refers to the proper handling of information affordable energy end-to-end latency and memory overhead.
and to control what happens to this information. The wide
adoption of Cloud-IoT in the coming future will penetrate in 3) Access Control
everyone’s life in some way or the other. But this wide With hundreds of thousands of IoT objects around us and
adoption is challenged by data privacy concerns of individual huge amount of data forwarded by the IoT objects to the
users and organizations [2]. Cloud for storage and computation, it is compulsory for the
Annotating data with fine-grained privacy obligations on the data owners to have efficient access control over their data in
data usage is backed by location information. But, the the Cloud. It refers to the data usage permission which could
annotation of data method works on specific application be assigned to different actors in the context of a large IoT
scenarios and not for all scenarios[12]. network. A major issue with the access control in the Cloud-
To overcome the data privacy issue, Henze et al. [20] presents IoT context is the performance and temporal constraints
a User-driven Privacy Enforcement for Cloud-based Services because the computational intensity is higher than the
in the IoT (UPECSI). As the name suggest, this method is traditional Database Management System (DBMS).
user-oriented approach to protect the privacy of data Jaimunk [8] discusses a method which identifies the two
generated by IoT devices and saved or processed in the type of actors that are- Data holders and Data Collectors.
Cloud. It basically constitutes of three components- Model- Only data that is required is fed by the data holders to the data
driven Privacy, Interaction with User and Privacy collectors and an equally effective data collector is
Enforcement Points. The Model-driven privacy is focused to responsible to authenticate the data holders and the things
integrate the privacy within the Cloud service. Users from which are feeding the data.
different levels of requirements are offered an interaction to Xiong et al.[22] constructed a cipher text-policy based
understand their demands and requirements, which creates a encryption approach for data storing and secure access in a
sense of transparency. Thirdly, the Privacy Enforcement cloud for IoT applications that reduces storage overhead of
Points, which is residing in the IoT gateway is responsible to public keys. Moreover, a user access control list (UACL) in
make sure the user defined policies are being followed or not the cloud server is constructed newly to support authorization
while the data is outsourced to the Cloud[21]. One approach access for a specific user.
which developers are exploring is to meet the privacy
requirement of the IoT object even before it is launched i.e. 4) Authorization
during the design phase itself. The aims and objectives of the Authorization involves specifying access rights to
privacy policy are always taken into consideration until the resources. In Cloud-IoT context authorization is referring to
object is delivered or applied in the real scenario. Some of the the procedure which constitute of three phases. The first
principles of privacy by design are: (1) privacy measures phase would be to define the security policies, which is
should be precautionary and not reaction to a fault occurred, nothing but a compilation of comprehensive rules. Next
(2) piracy measures should be mandatorily applied instead of phase, the access control model is implemented and then
choice, (3) piracy should not be regarded as an added value lastly set of rules are enforced[2].
service, rather a compulsion from beginning, (4) the piracy Typically, the objectives of the access control models are
goals should not hinder the expected performance of the clear but the challenge in authorization phase is the
object, (5) security must be exercised to preserve the privacy interpretation of these security policies in the access control
of data in all its phases until the data is deleted, (6) the privacy model. However, one major role of the authorization
370
2020 11th International Conference on Information and Communication Systems (ICICS)
mechanisms is to remove the complexity in the rules because of the network delay and overhead. Until now cloud
interpretation and bridge this gap of high-level security and IoT devices are implementing heterogeneous interfaces.
policies and low-level mechanism. The completion and Privacy and Security: The concerns related to privacy
consistency of the policies could be measured through and security are significant because Cloud-IoT is connecting
authorization principles. Some of the authorization models the physical objects with the computer network and this
are Discretionary model DAC, Mandatory model MAC, integration could be threatening sometimes because it is
RBAC and its several extensions, Attribute based access closely related to the user and the IoT devices that are sensing
control model (ABAC), Or BAC model and Usage Control user habits. More efforts could be made to design schemes
(UCON). Usually authorization models are designed on the which enforce the security policies more effectively and make
basis of subjects, objects and the interaction between them. sure that no unauthorized access is made. On the other hand,
However, few of the authorization models are also based on with respect to the security it is still an area where consistent
the trust, privacy, context and knowledge. Especially in the attempts are made by adversaries to hack the things for
case of Cloud-IoT, it is found that there are heterogeneity instance injecting malware in the sensors or tamper the data
supportive hybrid models in order to meet the organizational on the cloud. Especially with the Cloud-IoT context, gateways
needs[3]. are most important to be secured and to avoid side-channel
attacks[24]. Some of the open research questions, which could
5) Mobile IoT Security be of interest for the further research are as follows.
The mobile nodes in the Internet of Vehicles (IoV) require 1. Can we establish standard security measures for all
identification, authentication and privacy protection while on type of smart things?
the move. They form clusters or groups by taking proximity
2. How to enable the smart things to choose between
as a basic parameter and connect to the Cloud for storage and
cloud, edge, fog and mist computing?
computational requirements. The challenge for the cloud
services offered to such mobile IoT devices is to provide VI. RESEARCH IMPLICATION AND FUTURE WORK
quick and accurate authentication of the nodes moving from
The categorically identified and listed challenges in the
one cluster to another[23]. integration of IoT with Cloud computing would assist
Intelligent transport system, the mobile nodes verify the researchers to direct their effort in proposing efficient
legitimacy of the normal sensor node through a negotiation. solutions for these challenges. The association of strategies
This established hierarchy of the mobile nodes could be used with the security challenges in the integration of IoT with
to communicate within the network in an efficient manner. Cloud computing gives the existing approaches a direction for
Henze et al. [20], presented an architecture which could be the improvement of their performance.
deployed on mobile platform is introduced specifically for
mobile e health applications. It is a combination of RFID tag In this section we also point out possible research
identification in medical field with Cloud-IoT based directions, if addressed carefully will realize the envisioned
safe and secure smart world with the help of Cloud-IoT
solutions, to make it pervasive and easily accessed. Hannan
paradigm. Some of the future research directions are
[1] discusses about the smart mobile based approach which mentioned below.
collects mobile information through access gateway.
Historical data movement paths are exploited apart from • Advanced identification methodology for the
authentication of mobile terminals. This reduces the time for already existing millions of IoT objects and for the
connection and improves the efficiency of information upcoming ones which we will be accommodating.
transmission. Al-Qarni et al. [11] emphasized the • Context-based service provisioning indicates the
significance of the integration of Mobile Adhoc Network ability for the IoT objects to avoid running data to
based IoT (MANET-IoT) with the Cloud due to its and from between the objects, gateways and cloud.
infrastructure which is battery-powered moving nodes. A • Reliable network has always been an area where
clustering approach based on Low Energy Adaptive there is a space for improvement which will enable
Clustering Hierarchy is utilized in wireless sensor network fault tolerant and high connectivity IoT objects to
with modification to adapt to the MANET-IoT’s mobility. perform seamlessly.
• Common APIs could be developed that will permit
the development of third-party applications.
V. OPEN ISSUES
VII. CONCLUSION
The open issues we have identified during our study are as In recent years we have witnessed a massive progress in
follows. the development of IoT and it is continuously increasing its
Lack of standardization in security: Cloud and IoT involvement in all possible aspects of physical world. In the
integration is at a slow pace because of lack of security coming years, IoT is going to generate massive amount of
standards. The current communication medium of many smart data which has to be collected and handled effectively in
things with the cloud is through web based since they are not order to derive productive services. The integration of IoT
efficient enough for a machine-to-machine communication with Cloud is proving to be a convincing solution to be able
371
2020 11th International Conference on Information and Communication Systems (ICICS)
to handle the massive data from hundreds of thousands of IoT Web-Based Information Systems. WECWIS 2001.
devices. However, the integration of Cloud-IoT is hindered 2001. IEEE.
by several challenges from different aspects. In this paper, we 11. Al-Qarni, B.H., A. Almogren, and M.M. Hassan, An
identify these challenges of Cloud-IoT and then we mainly efficient networking protocol for internet of things
focused on the security challenges and strategies. We to handle multimedia big data. Multimedia Tools
discussed the open issues in the area of Cloud-IoT and and Applications, 2019. 78(21): p. 30039-30056.
mention the limitations. We concluded with future research 12. Mohiuddin, I. and A. Almogren, Workload aware
directions which may further enable an improved Cloud-IoT VM consolidation method in edge/cloud computing
technology. for IoT applications. Journal of Parallel and
Distributed Computing, 2019. 123: p. 204-214.
ACKNOWLEDGMENT 13. Tayyaba, S.K., et al., 5G Vehicular Network
The authors would like to thank King Abdulaziz City for Resource Management for Improving Radio Access
Science and Technology (KACST) and King Saud University Through Machine Learning. IEEE Access, 2020. 8:
for their support. This work has been funded by KACST p. 6792-6800.
under the NPST project number 3-17-03-001-0002. 14. Almajed, H.N., A.S. Almogren, and A. Altameem,
A resilient smart body sensor network through
pyramid interconnection. IEEE Access, 2019. 7: p.
REFERENCES 51039-51046.
1. Elazhary, H., Internet of Things (IoT), mobile cloud, 15. Xu, X., et al., A computation offloading method over
cloudlet, mobile IoT, IoT cloud, fog, mobile edge, big data for IoT-enabled cloud-edge computing.
and edge emerging computing paradigms: Future Generation Computer Systems, 2019. 95: p.
Disambiguation and research directions. Journal of 522-533.
Network and Computer Applications, 2019. 128: p. 16. Almogren, A.S., Intrusion detection in Edge-of-
105-140. Things computing. Journal of Parallel and
2. Zhou, J., et al., Security and privacy for cloud-based Distributed Computing, 2020. 137: p. 259-265.
IoT: Challenges. IEEE Communications Magazine, 17. Kianoush, S., et al., A cloud-IoT platform for passive
2017. 55(1): p. 26-33. radio sensing: Challenges and application case
3. Stergiou, C., et al., Secure integration of IoT and studies. IEEE Internet of Things Journal, 2018. 5(5):
cloud computing. Future Generation Computer p. 3624-3636.
Systems, 2018. 78: p. 964-975. 18. Haseeb, K., et al., Secret sharing-based energy-
4. Almajed, H.N. and A.S. Almogren, SE-Enc: A aware and multi-hop routing protocol for IoT based
Secure and Efficient Encoding Scheme Using WSNs. IEEE Access, 2019. 7: p. 79980-79988.
Elliptic Curve Cryptography. IEEE Access, 2019. 7: 19. Alkhalifa, I.S. and A.S. Almogren, NSSC: Novel
p. 175865-175878. Segment based Safety Message Broadcasting in
5. Almogren, A., An automated and intelligent Cluster based Vehicular Sensor Network. IEEE
Parkinson disease monitoring system using Access, 2020.
wearable computing and cloud technology. Cluster 20. Henze, M., et al., A comprehensive approach to
Computing, 2019. 22(1): p. 2309-2316. privacy in the cloud-based Internet of Things.
6. Hassan, M., et al., Increasing the trustworthiness in Future Generation Computer Systems, 2016. 56: p.
the Industrial IoT Networks through a reliable 701-718.
cyber-attack detection model. IEEE Transactions on 21. Awan, K.A., et al., Robusttrust–a pro-privacy
Industrial Informatics, 2020. robust distributed trust management mechanism for
7. Amin, R., et al., A light weight authentication internet of things. IEEE Access, 2019. 7: p. 62095-
protocol for IoT-enabled devices in distributed 62106.
Cloud Computing environment. Future Generation 22. Xiong, S., et al., SEM-ACSIT: Secure and Efficient
Computer Systems, 2018. 78: p. 1005-1019. Multi-Authority Access Control for IoT Cloud
8. Jaimunk, J. Privacy-preserving cloud-IoT Storage. IEEE Internet of Things Journal, 2020.
architecture. in 2019 IEEE/ACM 6th International 23. Haseeb, K., et al., Intrusion Prevention Framework
Conference on Mobile Software Engineering and for Secure Routing in WSN-Based Mobile Internet
Systems (MOBILESoft). 2019. IEEE. of Things. IEEE Access, 2019. 7: p. 185496-185505.
9. Mohiuddin, I., et al. Analysis of network issues and 24. Almogren, A.S., Developing a powerful and
their impact on Cloud Storage. in 2019 2nd resilient smart body sensor network through
International Conference on Computer Applications hypercube interconnection. International Journal of
& Information Security (ICCAIS). 2019. IEEE. Distributed Sensor Networks, 2015. 11(10): p.
10. Dunham, M.H., et al. Data in your space [wireless 609715.
access]. in Proceedings Third International
Workshop on Advanced Issues of E-Commerce and
372