Personal Data Security in the Internet of Things (IOT)

Chaitanya Jagarwal
B-tech Scholar, RTU ,Kota

Sumit Yadav
B-tech Scholar, RTU ,Kota

Mr. Sanjay Tiwari

Associate Professor, CSE, AIETM, Jaipur

ABSTRACT
Recent growth of the information and communication technologies (ICT) created enormous opportunities for the
economic and technical growth. However, they also opened the Pandora’s box of cybercrime, stealing personal
information and identity, spying on people’s working and private lives as well as other related issues. Internet of Things
(IoT) that combines a myriad of devices connected together for a two-way flow of information represents another
important challenge, since it collects and stores zillions of personal data that can be abused by the third parties. Our
paper analyses the recent developments of IoT in the light of data protection and tackling cybercrime. We show that
since the concept is relatively young, very few legislative norms exist for its regulation and persecution of violators. It is
also clear that new laws and rules should be introduced but the fragile balance between personal data protection and total
“Big Brother-like” control from the law enforcement agencies and the governments should be carefully maintained and
secured.
Keywords: Data protection, digitalization, cybercrime, public surveillance, justice, Internet of Things.

1. INTRODUCTION
Nowadays, there is enormous data available to networks), while the fact that all physical worlds will
communicate with consumers, collect data, transmit data be connected to IPv4 has led to a host of security concerns
to businesses and collect large amounts of data for third [6].
parties [1], [2]. Examples include smartphones that
interact with other smartphones, connected medical Once a physical object connects to the Internet and
devices, social networks, smart home devices, and much can be controlled accordingly, it can be transformed into
more. Connected devices undermine our ability to an IoT device in various ways. As more and more
separate these connections from those we choose. The physical objects such as cars, houses and buildings
growing number of initiatives, devices and solutions become part of the IP-based systems, we can expect a
related to the Internet of Things (IoT) is having a significant increase in attacks. These threats include not
significant impact on the privacy and security of our only physical attacks, but also cyberattacks on the
personal data and those of the people we know and love Internet of Things itself.
[2], [3]. Our paper focuses on the issues of personal data
Internet of Things (IoT) and cloud computing, a topic protection in the Internet of Things using the legislative
that has been taken up by various authorities worldwide. and the data protection framework. We analyze the recent
This has led to a plethora of guidelines, rules and developments of IoT in the light of data protection and
nonbinding recommendations, but little concrete action the fight against cybercrime.
on the part of the central and federal governments.
Simply put, IoT is the process of creating physical things
that are embedded with sensors, software, and electronic 2. LITERATURE REVIEW
connectivity to create a global network of physical In general terms, as heterogeneous devices become
objects that exchange data and exchange information part of the IoT network, new security threats will emerge.
with each other and with the world around them [4], [5]. IoT device manufacturers should take these protective
IoT imagines a world of connected devices and services, measures into account and extend them to the entire
not only in the physical world, but also in the cloud. This network of devices, not just their individual devices [7],
means that it is subject to the same security measures as [8].
IPv4 (the 4th version of the Internet Protocol, one of the
core protocols of standards-based internetworking Some recent examples come from the United States
methods in the Internet and other packet-switched which is not a leading country in developing the digital

1
economy and investing into the smart home hardware. In of the Internet of Things for effective security and privacy
September 2018, the California legislature in the United [13].
States passed a law that imposes new restrictions on the
The widespread adoption of IoT devices which is
number of IoT devices sold in the country. Unite Stats
apparent from the spending on smart home appliances
Congress also introduced a bill (H.R. 2222) and an
(see Figure 1 above) has highlighted the need for a more
amendment to the National Defense Authorization Act
specific regulatory framework to address the concerns
(NDAA), which proposes that the Commerce
and apply regulation. Although it becomes apparent that
Department conduct a study of the IoT industry and make
Internet security is required, the fact is that many IoT
recommendations for the secure growth of IoT devices
device systems are very limited in security due to a lack
[9]. IoT security hacks happen but the extensive work
of regulation and widespread use of third-party software.
was built in this industry and it helps to draft a code of
conduct for consumer IoT security. Security requirements also vary considerably; for
example, there is a significant difference in the level of
When billions of things become connected devices,
security and data protection requirements for different
they can be exposed to intruders and interference that
types of devices. This raises the question of whether the
could dramatically compromise privacy and threaten
services concerned can becalled telecommunications
public safety but can also help to fight corruption that is
services and whether they should be regulated within a
notorious in some parts of the world [10]. Private
regulatory framework for telecommunications [14].
property can be damaged and lots of harm can be done.
One thing is the digital data that includes photos, videos IoT presents some very important security and
or documents. However, another thing is physical security challenges that need to be addressed in order to
security when smart houses can be broken into and the reach its full potential. Therefore, one of the most
smart appliances can be hacked and made to violate or important problems in connection with the Internet of
kill their owners. Things that needs to be addressed is the issue of data
protection, an issue that is closely linked to the physical
world [15].
The security gaps and problems associated with IoT
can be drastically reduced by implementing security
analyses. IoT security is defined in the IoT agenda as a
technology area that addresses the protection of the
security and privacy of data and information in the
physical world as well as in the digital world. The
protection of an IoT deployment depends on the system
involved and the level of security of the systems
involved, such as network connection, data storage and
data encryption. This includes collecting and analyzing
Figure 1 Spending on the smart home devices in the data from multiple sources that can help IoT security
world (in billions of U.S. dollars) providers identify potential threats and nip them in the
bud.
Nevertheless, the IoT presents some very important
security and data protection challenges that need to be IoT gateways alone are too small to monitor, and
addressed in order to reach its full potential. Therefore, there is a lack of infrastructure to monitor them. IoT is
one of the main problems associated with the Internet of designed as the next generation of the Internet of Things
Things that needs to be addressed is the problem of (IoT), not just as an IPv4 version. This means that it is
privacy, a problem that is closely linked to the physical subject to the same security measures as required for IPv
world [11, [12]. There are some security vulnerability 4, but also to the fact that the physical world is connected
guidelines and general recommendations summarizing to IPv 4, which leads to a variety of security concerns
the state of the art in security and data protection for IoT [16].
devices. This sets out minimum requirements that IoT Since these are integrated into IP-based systems, a
device manufacturers should consider when developing significant increase in attacks is expected. These attack
applications, services, firmware updates and to reduce the threats include not only physical attacks, but also
risk of a security incident due to a compromised IoT cyberattacks such as ransomware, phishing and other
device. The protection of an IoT deployment depends on forms of malware.
the system involved, the application, the service or the
firmware, and the degree of integration with other As these heterogeneous devices become part of the
systems and services. The IoT Trust Framework of the IoT network, new security threats will emerge. IoT
Internet Society has identified core requirements that developers and customers, these devices are becoming
need to be understood, evaluated and implemented as part more common. Concerns are growing about the growing

2
number of devices that are becoming increasingly All of the above calls for the new legislative norms
important to customers of IoT developers [17]. that would understand the novel technological concepts
and embrace them into their processing and
Some benevolent hackers can demonstrate how easy
implementation.
it was to gain access to a connected car - something that
was a minor concern in the technology era several years
ago, but is now a key area of interest for IoT creators.
Unfortunately, new security threats seem inevitable [18].
3. LEGAL AND FORENSIC
The Internet of Things will make it possible to PROVISIONS OF THE INTERNET OF
connect physical objects of daily life to the Internet.
THINGS
These objects will have the ability to identify and identify
cloud-based applications, devices and other objects that Speaking about the legal and forensic provisions of
are connected and cooperating globally, in a world where the IoT, it seems crucial to identify the impact of the data
big data analytics enable smart decisions. Some draft collected and submit it to law enforcement authorities.
laws, such as the IoT Improvement Act, propose security There are a number of applications and challenges that
standards to help close the gaps in the security and professionals in the emerging field of IoT forensics face.
privacy of IoT devices and applications. The potential for In fact, Internet of Things has many impacts on the legal
meaningful innovation is enormous for the IoT, but the and forensic field. Because the data is provided by smart
potential risks and challenges in the area of security and devices, investigators can gather more information about
data protection also present challenges. a crime, such as its location, time of day, and the location
of the victim. Collecting this data can be a challenge,
Not only the Internet of Things but also novel
however, as the data is stored on the device in the form
development in the areas of security and data protection
of photos, videos, audio, text messages or other data. IoT
are important. IoT devices can be harmful to consumers
devices to construct a timeline during an investigation,
and networks because they contain security
for example, with the help of a smartphone or tablets.
vulnerabilities. This lack of security increases the risk of
personal information leaking when data is collected and One can identify key areas that should address
transferred to and from IoT devices. Sometimes solutions and the importance of data models for both IoT
unauthorized persons can exploit security vulnerabilities mobility and forensics, and the need for a better
to create a risk to physical security [19]. understanding of them. Understanding the data model for
These devices are connected to various hardware and IoT and mobility forensics suggests other important
software, so there is a risk that sensitive information may questions. This paper presents examples of IoT scenarios
leak through unauthorized manipulation. This can have and attempts to identify the sources of the evidence it
particularly serious consequences if personal information contains. It will also discuss how digital forensics of the
such as credit card numbers, bank account information IoT differ from classical digital forensics, and emphasize
and other personal information is hacked. IoT security the importance of data models for both IoT and mobility
should be a serious concern to protect IoT devices that forensics, as well as the need for a better understanding
of the data model. The Internet of Things (IoT) has a
are at risk with the potential consequences of hacking and
number of legal challenges to overcome, both in terms of
lives. Meanwhile, many manufacturers are increasingly
privacy and security and the use of data models. It also
incorporating smart devices such as smart thermostats,
suggests that we can distinguish between the digital
smart lighting and smart home systems into their
forensics of the IoT and traditional legal and legal
facilities. These may not be adequately protected and
enforcement of mobility.
cause serious problems for consumers. As the intelligent
and autonomous future dawns, the security risks inherent There is not a secret that various devices connected to
in the rapidly growing inner web of things will become the Internet, including mobile phones, tablets, laptops and
complex. Security has immediate and future other mobile devices such as smartphones, are already
consequences, and we have no idea how vulnerable the being researched to monitor people. Connected devices
Internet of Things can be and what we should do about it. with the Internet of Things (IoT), so-called everyday
There are a number of options to solve the security objects and devices that can be connected to the Internet,
problem of the Internet of Things or not, but they are not are the target of law enforcement and play an increasing
all solved. role at crime scenes. The UK Home Office has informed
The number of "things" and devices added to the Privacy International that it is developing a strategy to use
Internet of Things (IoT) every day also increases the the Internet of Things as part of a criminal investigation.
potential for security threats. The reality today is that the In January 2017, it was stated that internet devices were
“likely to revolutionize crime scene investigations” by
Internet of Things is connected to everyone and
the National Crime Agency (NCA) and the Police and
everything, and there is no longer a single point at which
Crime Commissioner's Office [21]. The use of new
everyone fails, not even the most powerful devices [20].
technologies in our homes and bodies as part of criminal

3
investigations and the use of evidence raises new examples of IoT in public spaces underline the need to
challenges and risks that have not been sufficiently update data protection rules to take into account the
researched. A key element in tackling this crisis in the complexity and impact of IoT data collection.
UK will be to stabilize the market by addressing the core Restrictions on data collection and free use pose
issues of forensic technology worldwide. We believe that challenges to the IoT model, such as the need to store data
the discussion on the use of the IoT by law enforcement on land.
authorities would benefit from discussions on its possible
There are also facts that it can be difficult to get the
use in criminal investigations and on the use of these
consent of individuals because IoT technologies such as
technologies in forensic investigations. To address this
sensors and cameras are embedded in the infrastructure
problem, the scientific evidence used and the excellent
and sometimes discreetly placed. After all, many parties,
research that underpins it will also be crucial for the
such as cloud providers, are involved in the collection and
development of a robust legal framework. Forensic
transfer of data, and third parties often do not extend their
research must harness new skills such as machine
rights to privacy and data protection. The majority of
learning, artificial intelligence, and machine vision to
connected devices do not adequately explain to their
develop new technological tools to meet the challenges
customers how their personal data is processed. IoT
of detecting and identifying traces of people. We also
devices are still being adopted and adopted, and there is
need to develop the basic foundations needed to identify
a lack of understanding of the privacy and security
these materials, such as the ability to search the digital
implications of these devices and their use. Such outages
environment for traces of human activity and use data
may not be surprising, given the extent to which IoT
analysis.
services are involved in collecting, processing and storing
personal information such as credit card numbers, bank
account numbers and other personal information.
4. DATA PROTECTION IN THE Compliance with the GDPR is particularly challenging in
INTERNET OF THINGS the Internet of Things, as far as it can be difficult to obtain
For government agencies such as the Federal Trade the necessary consent to process personal data on an IoT
Commission, the European Union's General Data network. In the IoT context, a key difficulty is in
Protection Regulation (GDPR) protects privacy and data determining which stakeholder is the data controller or
security [22]. This includes, inter alia, adopting best processor for a particular processing activity. IoT devices
practices in the areas of data protection and security, are unlikely to know this, although advocates are
collecting consumer information only with the explicit changing this under the European Union's General Data
consent of consumers and providing access to their data Protection Regulation. IoT organizations that are
only after their consent. particularly committed to data protection benefit from
increased customer confidence, which can be a
There are various cloud-based mobility platforms that distinctive feature of a business. The IoT and the Internet
make it easy for companies to securely manage and of Things are based on the assumption that huge amounts
optimize IoT deployment. IoT needs security, which is of data are generated that can not only be used but also
why we have developed tools and expertise to reduce analyzed in a variety of ways, for example in real time,
risks through responsible development of IoT without the need for consent. As a result of this flood of
applications. In addition, it is committed to collecting data, there was an urgent need to review data protection,
personal information that is consistent with the privacy which has resulted in UK law now being enshrined in the
and security of its customers’ personal information. IoT Data Protection Act. The GDPR is therefore an important
devices and the data processing activities associated with step towards the protection of personal data in Europe and
the operation of IoT are the responsibility of the United an example for other countries and regions.
States Department of Homeland Security (DHS), as they
tend to process personal data. It is clear that solutions and
privacy are built into the design of their products, and the 5. CONLUSIONS
ability to incorporate data subject to these rights into their
design. IoT solutions and incorporate data protection Overall, it becomes clear that the concept and the
measures into them, as well as into data processing. This functioning of the Internet of Things are very young and
should be documented and documented in practice as part immature, hence very few functional and effective
of the principles of GDPR accountability and in the legislative norms can be found for its regulation and
implementation of data protection measures persecution of its violators. It is also discernable that new
legislative norms and rules should be introduced but the
The Asian region is also characterized by high fragile balance between personal data protection and
penetration of ICTs and data localization, which drives totalitarian-like control that might be imposed by the law
further data protection considerations. Asian lawmakers enforcement agencies and the corrupt governments
are considering strengthening their own privacy laws, should be carefully maintained and secured.
such as the Data Protection Act (DPA) in Japan and the
Privacy Act (DPA) in South Korea [23]. Existing
4
 We are confident that the policymakers and
stakeholders can initiate consultations and regulations to
secure consumers' IoT by identifying best practices to
enhance cyber security for consumers in the IoT. The
code of conduct is part of a series of best practices and
safety principles published by the department last year.
The department is also leading the creation of an
international focus on IoT security to support work on a
global framework for the development and
implementation of security standards for IoT devices.
Internet of Things (IoT) and the security challenges it
poses, and the need to move forward in developing and
implementing security standards for IoT devices and
services in a secure, secure and transparent manner.

REFERENCES
[1] M. Cohen, Big data and service operations,
Production and Operations Management 27(9)
(2018) 17091723. DOI:
https://doi.org/10.1111/poms.12832

[2] P. Tabesh, E. Mousavidin, S. Hasani,

Implementing big data strategies: A managerial
perspective, Business Horizons 62(3) (2019)
347-358 DOI:
https://doi.org/10.1016/j.bushor.2019.02.001

[3] Z. Almusaylim, N. Zaman, A review on smart

home present state and challenges: linked to
contextawareness internet of things (IoT),
Wireless Networks
25(6) (2019) 3193-3204. DOI:
https://doi.org/10.1007/s11276-018-1712-5

[4] B. Di Martino, M. Rak, M. Ficco, A. Esposito,

S. Maisto, S. Nacchia, Internet of things
reference architectures, security and
interoperability: A survey, Internet of Things
1(2018) 99-112. DOI:
https://doi.org/10.1016/j.iot.2018.08.008

[5] W. Strielkowski, D. Streimikiene, A. Fomina, E.

Semenova, Internet of energy (IoE) and high-
renewables electricity system market design,
Energies 12(24) (2019) 4790. DOI:
https://doi.org/10.3390/en12244790

[6] A. Rayes, S. Salam, Internet of Things from

hype to reality, Springer, 2017, 328 p.

[7] R. Rapuzzi, M. Repetto, Building situational

awareness for network threats in fog/edge
computing: Emerging paradigms beyond the
security perimeter model, Future Generation
Computer Systems 85 (2018) 235-249. DOI:
https://doi.org/10.1016/j.future.2018.04.007