Security Challenges and Limitations in Iot Environments: Suha Ibrahim Al-Sharekh, Khalil H. A. Al-Shqeerat
Security Challenges and Limitations in Iot Environments: Suha Ibrahim Al-Sharekh, Khalil H. A. Al-Shqeerat
Security Challenges and Limitations in Iot Environments: Suha Ibrahim Al-Sharekh, Khalil H. A. Al-Shqeerat
1. Introduction
Fig. 1 IoT Conceptual Framework
The Internet has great importance in our life. It provides a
unique and interconnected system through which devices The development of Internet things plays an essential role
can connect across the world using a set of communication in gradually changing human life towards intelligence.
protocols. In the beginning, the Internet was limited to Many smart applications rely on IoT technology such as
surfing fixed websites and enabling users to communicate smart home, healthcare monitoring, route planning,
with each other by e-mail service. At present, new and building management, and smart city.
multiple Internet technologies have emerged. IoT is the critical future in the Internet world. Therefore,
The presence of intelligent devices is significant and security services such as privacy and authentication are a
become a mandatory part of our daily lives, in which it crucial factor for modern technologies to achieve the
connects different things remotely at any time. The number benefits of IoT services [5]. Besides, IoT creates an
of connected smart devices is increasing exponentially day excellent opportunity for economic growth and life that is
by day, so the Internet of Things (IoT) is the ideal solution more comfortable. However, it causes significant security
for managing and monitoring these smart devices. risks, especially when these devices are compromised or
The IoT term means connecting various things to the vulnerable to cyber-attack. Therefore, the adoption of
Internet. An intelligent terminal can enable physical adequate security and authentication techniques are
components to communicate with each other without the necessary for a broad and rapid IoT deployment.
need for human interaction [1]. One of the primary motivations behind this study is the
Kevin Ashton mentioned this idea in 1999 during a spread and growth of IoT usages in various aspects,
presentation at Proctor & Gamble. He used this term to although many security concerns and issues may arise
link the idea of radio frequency identification (RFID) to when adopting IoT different environments. This paper
the new Internet theme [2]. At an early stage, the usage of aims to find out the fundamental security requirement,
IoT technology is equivalent to the use of RFID challenges, limitations that affect the adapting of IoT
technology and connecting it to the Internet. technology.
According to Gartner, 20 billion IoT devices are expected The rest of this paper is organized as follows. Section II
to be connected to the Internet by 2020. In the 1990s, sales describes the architecture of IoT. Section III overviews the
points and logistics were the most significant and most main security requirements of IoT. Section IV reviews
promising Internet applications. IoT technology was used some security challenges and limitations that face adopting
to identify goods automatically and share information
IoT technology. Finally, the results of the conducted based on communication techniques used such as Wi-Fi,
survey are discussed in section V. and Bluetooth [11].
3) Middleware Layer
2. IoT Architecture Middleware Layer is also known as a processing layer. It
is built over the network layer. In this layer, the IoT
IoT was introduced as a third wave of web pages after systems run [12]. It provides an API (Application
static web pages (WWW). A global network connects Programming Interface) to implement applications.
different types of objects from anywhere, and anytime Moreover, it provides many services such as data analysis,
using Internet protocol (IP) [6]. data processing, detect and manage devices, data collection,
According to [7, 8], the IoT architecture consists of five and discovery of information by Object Naming Service
layers; perception, network, middleware, application, and (ONS) or Electronic Product Code (EPC). Middleware
business Layers, as shown in Figure 2. Layer uses standard protocols that as CoAP, MQTT,
XMPP, and HTTP.
4) Application Layer
The application layer contains an application user interface.
Applications that are part of the application layer consume
web services and application-programming interface that is
exposed to the middle layer. It is responsible for delivery
and providing various applications in many areas where
IoT technology can be deployed and applied, for example,
smart homes, smart cities, smart health, and others [13].
The primary goal of the Application layer is to connect IoT
users and applications.
5) Business Layer
The business layer manages the whole IoT systems such as
applications, business models, and data have been received
Fig. 2 IoT Architecture Layers
from the application layer. The business layer develops
IoT applications and contributes to the development of
successful business models for the promotion of IoT
1) Perception Layer related technologies [14]. Furthermore, this layer should
The perception layer is also called the recognition layer. manage and maintain the privacy of users, which is
The essential task of this layer is to identify the objects and indispensable to the internet of things.
collect information. This layer consists of a group of
physical objects, things. It is responsible for collecting data
and providing information to the objects. The 3. Security Requirements
responsibility of the layer is to secure how data is collected,
stored and transmitted to the network layer. The perception Fundamental security issues in IoT systems require
layer includes RFID (Radio-Frequency Identification), protecting two critical aspects, which are confidential data
sensors, camera, GPS (The Global Positioning System), and identity authentication. Furthermore, five main
etc. and it depends on the characteristics of each element, requirements in information security are considered; data
such as protocols or communication technologies used [9]. availability, data confidentiality, data integrity, authenticity,
and authorization and breach any of these areas will cause
2) Network layer security damages or problems to the IoT system [15].
The most advanced layer of conventional IoT architecture Correspondingly, each of the five layers of IoT must meet
is the network layer. It likes a neural network and these requirements. Figure 3 shows the main security
considers the brain of IoT. The network layer is requirements for IoT environment.
responsible for transferring and processing data provided
by the perception layer. It has a significant role in handling a) Data Availability
the data related to IoT management [10]. Data availability is crucial in the IoT. It contributes to
The network and communication technology used in this ensuring that users have access to the security and
layer such as wired, wireless and satellite depend on the reliability of available data. IoT system needs to provide
techniques adopted by the perception layer [9]. The backup of vital information to prevent data loss. Some
perception layer is closely related to the network layer attacks cause harms related to data availability such as
IJCSNS International Journal of Computer Science and Network Security, VOL.19 No.2, February 2019 195
denial-of-service (DoS) and distributed-denial of services this section, we will explain some of these potential
(DDoS) attacks [15]. security challenges in the IoT environment.
1. Lack of skills:
Specific skills and expertise are essential factors required
for designing, implementing, developing, and managing
security that must be considered. The disruption of any of
these factors may cause damage to the security system in
IoT. Furthermore, lack of skills and expertise cause slow
adoption of IoT technologies [18, 19].
The number of skilled people who can adequately handle
IoT techniques is very limited. Getting the benefits of IoT
technology and dealing with their challenges depends
mostly on individual skills.
2. Cost vs. security trade-offs:
The cost plays a crucial role in any project. In IoT,
Fig. 3 IoT Security Requirements hardware and unit prices are the main contributions to
increase security and safety from one side and reduce
potential risk on another side. The need for special high-
b) Data Confidentiality quality equipment requires a high cost of money [20, 21,
Data confidentially requires protection of data using 22].
specific encryption techniques and mechanisms to prevent
data disclosure and any unauthorized access to IoT 3. Privacy protection:
equipment and devices [16]. IoT allows anyone to access embedded devices from
anywhere, which affects the privacy of sensitive data.
c) Data Integrity Therefore, some norms or rules must be set to avoid the
Data integrity refers to protecting valuable and sensitive violation of privacy. For example, some of IoT devices
information from the risk cybercriminals. Several things sharing the data with other devices and in this case, the
affect data integrity, for example, server downtime. The data become insecure, which lead in helping the attackers
cyclic redundancy check (CRC) is a way to ensure data and intruders to penetrate the IoT system, and then insert
integrity and detect message encryption errors by adding a malicious programs and breach data confidentiality and
fixed-length value to detect network errors in IoT [15]. privacy [23, 24].
d) Authentication and authorization 4. IoT Architecture challenge:
Authentication and authorization issues play an essential Internet of things consists of many connected devices and
role in IoT security. They verify the identity of users or sensors. Each device uses a set of different protocols and
devices and then grant access to non-suspicious IoT standards for communication. There is no well-defined
objects or services [17]. standards and rules for communication [25].
Some researchers have reported that the number of
internet-connected devices would exceed 30 billion.
4. Security Challenges and Limitations Moreover, the applications of IoT would be not limited
Although IoT technology offers many advantages and and would increase day by day. These different devices
benefits in many areas and solves a range of problems in produced by different manufacturers, even if they do the
different sectors, it still faces a range of different security same functions.
challenges and limitations. This challenge refers to the nature of IoT and may lead to a
lack of unified standardization.
4.1 Security Challenges
5. Data storage in IoT devices:
Security is the most critical issue that may face IoT As the size amount of data increases at a very high rate,
development. Providing security for IoT technology is a data storage becomes a major problem. Data storage also
big and real challenge. Since the IoT technology has a affects data protection. When stored data damage, it is
spread scope, and there are many areas of research, we difficult to back up all stored data [26].
have focused on the security challenges related to some There are no clear criteria to ensure that data distributed
aspects such as performance, work efficiency, costs, data, within IoT devices is securely transferred to the main data
wireless sensor networks, and other security challenges. In center because the process of transfer data is not
196 IJCSNS International Journal of Computer Science and Network Security, VOL.19 No.2, February 2019
attacker may be temper with IoT devices by picking up the Energy Capacity: it is the amount of energy the devices
devices and can extract encryption secrets, and modify have to maintain itself over a specified period. The energy
programs or add a malicious contract to them. One of the sources in the devices are limited and need to be replaced
methods used to resist and defend these attacks is tamper- after a particular time. Some IoT devices consume large
resistant packaging. amounts of power and are not rechargeable. Therefore. To
Memory constraint: IoT devices have RAM and flash save the battery in limited devices, use low-bandwidth
memory is limited compared to traditional devices such as connections.
personal computers and used a lightweight version of Processing Capacity: The processing capacity refers to
General-Purpose Operating System. Therefore, security the amount of power in the devices. Many IoT devices are
schemes must be highly efficient for memory. Nevertheless, small, low-cost with low processing capacity. Therefore,
traditional security algorithms are not designed for these devices require lightweight protocols to work
memory efficiency because traditional systems use large efficiently.
RAM. Consequently, in IoT devices, security schemes may
not have enough memory space due to their small size.
Therefore, traditional security schemes cannot be used to 5. Survey and Result Discussion
secure the devices of the IoT.
In this study, we conducted a survey which has been
4.2.4 Limitations based on WSN distributed on faculty members, graduate students, IT
Objects in the IoT are controlled via microcontroller, experts and others who have an interest in IoT.
memory space and often in the power consumption as in The survey aims to take their views on the most critical
wireless sensor networks. At the same time, device security challenges, and limitations may face IoT. The
protocols, for example, Transmission Control Protocol number of participants that answer to the questionnaire is
(TCP) are heavily consumed in the devices. In addition, 190 participants. This questionnaire involves two main
the IEEE protocol contained in the WSN has a limited research questions as follows:
maximum transmission unit (MTU) that does not meet the 1- What are the main security challenges face IoT?
IPv6 primary transmission module. One reason for these 2- What is the most limitation currently restrict the spread
limitations makes it possible for developers to use of IoT?
particular protocols for the IoT. When reviewing respondents' answers on the questionnaire,
Although wireless sensor networks and ad-hoc networks found that 11.1% of them did not know IoT security
share similarities, there is a range of limitations that challenges. While 16.3% of participants do not know about
security challenges must overcome. Power management in the limitations that restrict the spread of IoT. These
wireless sensors is a critical problem in wireless sensors percentages indicate that people should be more aware of
network because of low power. Moreover, WSNs do not the security issues in IoT since the internet of things is very
have the same capacity and memory as in ad-hoc networks. important and used in many areas, and the orientation will
The transmission range also varies between the ad-hoc now be on it.
network and WSNs because the wireless sensor networks
are limited in power and therefore have a much shorter 5.1 Main Security Challenges face IoT
communication range than ad-hoc networks. All of these
limitations make many security algorithms used in ad-hoc The responses to the first question are shown in Figure 4.
networks, not practical in the wireless sensor networks.
4.2.5 Limitations based on IoT Communication
Devices
Devices of the IoT are resources constrained, and therefore,
traditional security mechanisms are not precise in smart
things. According to [29], there are some security
limitations related to the IoT communication devices are:
Memory Capacity: Restricted devices use random access
memory (RAM) to store data and storage between a few
kilobytes and 12 kilobytes. Data storage in the IoT devices
is limited, and some devices cannot store or send data. As
a result, some data is ignored if it exceeds the limit of
Fig. 4 Security Challenges of IoT
storage.
198 IJCSNS International Journal of Computer Science and Network Security, VOL.19 No.2, February 2019
Based on the ratios in the figure. 4 the privacy protection 6. Conclusion and Future Work
of IoT (with 45.8% votes from respondents), the lack of
skills, expertise of IoT adoption (with 38.9% votes from This study classified the architectures of IoT based on five
respondents), and weak security testing and updating in layers. We have mentioned the most critical aspects of the
IoT devices (with 35.3% votes from respondents) are the security requirements that must be observed in the IoT.
most security challenges facing IoT; because these three Furthermore, the overall security challenges of IoT
got the highest vote. Privacy protection is the most followed by security limitations related to the IoT devices
significant security challenges because it needs special have been explored. We have conducted a questionnaire
technologies to protect privacy in IoT. Lack of skills and on the most critical security challenges and restrictions that
experience in IoT and weak security testing and updating face Internet IoT and take people's opinions about it. This
in IoT devices they have the close voting rate. questionnaire was distributed to faculty members from
Also, some of the security challenges in the questionnaire various universities in Saudi Arabia, graduate students and
were observed in ratios such as cost vs. security trade-offs IT experts.
(with 32.6% of respondents), data storage in IoT devices This paper provided opportunities for future research work
(with 23.7% of respondents), limited infrastructure in this area. We believe that this study is important and
resources (with 22.1% of respondents), architecture provides a significant contribution to researchers in
challenge of IoT (with 18.4% of respondents). developing IoT security. Several potential security issues
Complicated expanded system (with 14.2% of must be followed for future research, such as
respondents) and varying security requirements and their vulnerabilities, threats, and provide practical solutions to
corresponding measures in IoT environments (with 14.2% overcome IoT security threats.
of respondents) received the same percentage of voting.
The lowest rating was lower power sources and capacity
References
(with 8.9% of respondents). [1] Vermesan, O. and Friess, P. eds., 2014. Internet of things-
from research and innovation to market deployment (Vol.
5.2 The most Limitations of IoT 29). Aalborg: River publishers. Ashton, K. (2009). That
‘Internet of Things’ thing. RFID Journal, 22, 97–114.
Figure 5 represents the opinions of participants on the most [2] Minerva, R., Biru, A. and Rotondi, D., 2015. Towards a
limitation currently restrict the spread of IoT. definition of the Internet of Things (IoT). IEEE Internet
Initiative, 1, pp.1-86.
[3] Evdokimov, S., Fabian, B., Günther, O., Ivantysynova, L.
and Ziekow, H., 2011. RFID and the internet of things:
Technology, applications, and security
challenges. Foundations and Trends® in Technology,
Information and Operations Management, 4(2), pp.105-185.
[4] Chase, J., 2013. The evolution of the internet of
things. Texas Instruments, p.1.
[5] Atzori, L., Iera, A. and Morabito, G., 2017. Understanding
the Internet of Things: definition, potentials, and societal
role of a fast evolving paradigm. Ad Hoc Networks, 56,
pp.122-140.
[6] Silva, B.N., Khan, M. and Han, K., 2018. Internet of
things: A comprehensive review of enabling technologies,
Fig. 5 Limitations of IoT architecture, and challenges. IETE Technical Review, 35(2),
pp.205-220.
Limitations are limiting the spread of IoT. From their [7] Atzori, L., Iera, A. and Morabito, G., 2010. The internet of
things: A survey. Computer networks, 54(15), pp.2787-
points of participants’ views, the diversity of connected
2805.
devices got the highest vote rate of 17.4%. [8] Khan, R., Khan, S.U., Zaheer, R. and Khan, S., 2012,
15.3% of participants in the questionnaire have selected a December. Future internet: the internet of things
short communication range. architecture, possible applications and key challenges.
The participants selected memory and power constraints, In Frontiers of Information Technology (FIT), 2012 10th
multi and varying communication protocols, and these two International Conference on (pp. 257-260). IEEE.
limitations received the same percentage of voting 13.2%. [9] Bilal, M., 2017. A Review of Internet of Things
The mobility and dynamic topology got 11.1% votes. Architecture, Technologies and Analysis Smartphone-based
While dynamic security patch got a lower percentage vote Attacks Against 3D printers. arXiv preprint
arXiv:1708.04560.
of 9.5%.
IJCSNS International Journal of Computer Science and Network Security, VOL.19 No.2, February 2019 199
[10] Gaitan, N.C., Gaitan, V.G. and Ungurean, I., 2015. A Challenges and Future Direction of Research. International
Survey on the Internet of Things Software Journal of Applied Engineering Research, 12(21),
Architecture. International Journal of Advanced Computer pp.11055-11061.
Science, 6, pp.140-143. [26] Alansari, Z., Anuar, N.B., Kamsin, A., Soomro, S., Belgaum,
[11] Zachariah, T., Klugman, N., Campbell, B., Adkins, J., M.R., Miraz, M.H. and Alshaer, J., 2018, August.
Jackson, N. and Dutta, P., 2015, February. The internet of Challenges of Internet of Things and Big Data Integration.
things has a gateway problem. In Proceedings of the 16th In International Conference for Emerging Technologies in
international workshop on mobile computing systems and Computing, pp. 47-55.
applications (pp. 27-32). ACM. [27] Gaur, A., Scotney, B., Parr, G. and McClean, S., 2015.
[12] Burhan, M., Rehman, R., Khan, B. and Kim, B.S., 2018. Smart city architecture and its applications based on
IoT Elements, Layered Architectures and Security Issues: A IoT. Procedia computer science, 52, pp.1089-1094.
Comprehensive Survey. Sensors, 18(9), p.2796. [28] Hernandez-Bravo, A. and Carretero, J., 2014. Approach to
[13] Sethi, P. and Sarangi, S.R., 2017. Internet of things: manage Complexity in Internet of Things. Procedia
architectures, protocols, and applications. Journal of Computer Science, 36, pp.210-217.
Electrical and Computer Engineering, 2017. [29] Bello, O., Zeadally, S. and Badra, M., 2017. Network layer
[14] Wu, M., Lu, T.J., Ling, F.Y., Sun, J. and Du, H.Y., 2010, inter-operation of Device-to-Device communication
August. Research on the architecture of Internet of Things. technologies in Internet of Things (IoT). Ad Hoc
In Advanced Computer Theory and Engineering (ICACTE), Networks, 57, pp.52-62.
2010 3rd International Conference on (Vol. 5, pp. V5-484). [30] Hossain, M.M., Fotouhi, M. and Hasan, R., 2015, June.
IEEE. Towards an analysis of security issues, challenges, and open
[15] Suo, H., Wan, J., Zou, C. and Liu, J., 2012, March. Security problems in the internet of things. In 2015 IEEE World
in the internet of things: a review. In Computer Science and Congress on Services (SERVICES), pp. 21-28.
Electronics Engineering (ICCSEE), 2012 international [31] Bellavista, P., Cardone, G., Corradi, A. and Foschini, L.,
conference on (Vol. 3, pp. 648-651). IEEE. 2013. Convergence of MANET and WSN in IoT urban
[16] Miorandi, D., Sicari, S., De Pellegrini, F. and Chlamtac, I., scenarios. IEEE Sensors Journal, 13(10), pp.3558-3567.
2012. Internet of things: Vision, applications and research [32] Khan, M.A. and Salah, K., 2018. IoT security: Review,
challenges. Ad hoc networks, 10(7), pp.1497-1516. blockchain solutions, and open challenges. Future
[17] Salman, O., Abdallah, S., Elhajj, I.H., Chehab, A. and Generation Computer Systems, 82, pp.395-411.
Kayssi, A., 2016, June. Identity-based authentication
scheme for the internet of things. In IEEE Symposium on
Computers and Communication (ISCC), pp. 1109-1111.
[18] Mainetti, L., Manco, L., Patrono, L., Sergi, I. and Vergallo,
R., 2015, December. Web of topics: An iot-aware model-
driven designing approach. In IEEE 2nd World Forum
on Internet of Things (WF-IoT), pp. 46-51.
[19] Lee, I. and Lee, K., 2015. The Internet of Things (IoT):
Applications, investments, and challenges for
enterprises. Business Horizons, 58(4), pp.431-440.
[20] Kumara, N.M. and Mallickb, P.K., 2018. Blockchain
technology for security issues and challenges in
IoT. Procedia Computer Science, 132, pp.1815-1823.
[21] Alharby, S., Harris, N., Weddell, A. and Reeve, J., 2018.
The security trade-offs in resource constrained nodes for iot
application. International Journal of Electrical, Computer,
Energetic, Electronic and Communication
Engineering, 12(1), pp.52-59.
[22] Aman, W. and Snekkenes, E., 2015, December. Managing
Security trade-offs in the internet of things using adaptive
security. In 10th International Conference for Internet
Technology and Secured Transactions (ICITST), pp. 362-
368.
[23] Middha, K. and Verma, A., 2018. Internet of Things (Iot)
Architecture, Challenges, Applications: A
Review. International Journal of Advanced Research in
Computer Science, 9(1).
[24] Haroon, A., Shah, M.A., Asim, Y., Naeem, W., Kamran, M.
and Javaid, Q., 2016. Constraints in the IoT: the world in
2020 and beyond. Constraints, 7(11).
[25] Burhanuddin, M.A., Mohammed, A.A.J., Ismail, R. and
Basiron, H., 2017. Internet of Things Architecture: Current