This article has been accepted for publication in a future issue of this journal, but has not been

fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/JIOT.2018.2869847, IEEE Internet of
Things Journal
> REPLACE THIS LINE WITH YOUR PAPER IDENTIFICATION NUMBER (DOUBLE-CLICK HERE TO EDIT) < 1

Internet of Things (IoT) Cybersecurity

Research: A Review of Current Research Topics
Yang Lu, Member, IEEE, Li Da Xu, Fellow, IEEE

 IoT. If the issue is not well managed, hackers will take

Abstract—As an emerging technology, the Internet of Things advantage of the defects and weaknesses of devices or objects
(IoT) revolutionized the global network comprising of people, and then will distort data or disrupt systems through the global
smart devices, intelligent objects, information, and data. The IoT network. IoT attacks and failures may outweigh any of its
development of IoT is still in its infancy and many directly related
issues need to be solved. IoT is a unified concept of embedding
benefits. In addition, traditional security protocols and
everything. IoT has a great chance to make the world a higher level mechanisms are not suitable because existing devices are
of accessibility, integrity, availability, scalability, confidentiality, limited in their low levels of scalability, integrity, and
and interoperability. But, how to protect IoT is a challenging task. interoperability. Therefore, new methodologies and
System security is the foundation for the development of IoT. This technologies should be developed to meet the security, privacy,
article systematically reviews IoT cybersecurity. The key factors and reliability requirements of IoT [2]-[4].
of the paradigm are the protection and integration of
heterogeneous smart devices and information communication
IoT involves so many different things, especially
technologies (ICT). Our review applies to people interested in heterogeneous devices. By 2015, IoT connected 4.9 billion
cybersecurity of IoT, such as the current research of IoT things and will connect 25 billion things by 2020 [5]. IoT has
cybersecurity, IoT cybersecurity architecture and taxonomy, key great flexibility and scalability, but this huge number also may
enabling countermeasures and strategies, major applications in predict a security disaster. The more devices a person connects,
industries, research trends and challenges. the greater the risk to the individual and to the network, and the
higher the cybersecurity risk to the global infrastructure. In
Index Terms— Cybersecurity, Enterprise Systems, Industrial
Informatics, Internet of Things (IoT), Radio Frequency 2003, each person had only fewer than 0.08 devices. In 2010,
Identification (RFID), Smart Device, Wireless Sensor Networks the number increased to 1.84. By 2020, there will be 6.58
(WSNs). devices per person [6]. Devices of all types are developing
widely and rapidly across the global IoT network, but these
devices are easily attacked and are considered as vulnerable
I. INTRODUCTION points in the IoT network. Thus, the IoT cybersecurity

A S an emerging technology and, really, a revolution, the infrastructure ensures that devices are maintained in a secure
Internet of Things (IoT) has brought tremendous changes environment and that users can use them appropriately. The
to end users in their daily lives. For individuals, their living, scale of IoT smart devices is very broad, and includes
studying, and working are all involved in the IoT network, computers, smart phones, communication interfaces, operating
taking advantage of smart environments (home and city), systems, lightweight services, and preloaded applications.
eHealth, and transportation systems. For businesses or Equipped with RFID sensors or actuators, intelligent devices
institutions, innovations like advanced automation and can execute accordingly, make decisions autonomously, and
industrial manufacturing, knowledge sharing and data disseminate information to users safely [7], [8].
management, and smart and self-modifying mechanisms and With the advancement of internet and wireless
systems are becoming more and more popular [1]. communication, smart devices and things, and IP protocol and
Due to the rapid development in telecommunication systems, sensor network technologies, more and more network-based
IoT can collaborate with Wireless Sensor Networks (WSNs), objects have been involved in IoT cybersecurity. These
Radio Frequency Identification (RFID), things, and networks in advanced technologies also are having a huge impact on new
any form, at any time, and anywhere. Cybersecurity is the ICT and on Industry 4.0 [9]. Cybersecurity is spread across the
inevitable problem that must be solved in the development of IoT network, a global infrastructure of heterogeneous smart
devices that integrate sensory, communications, networking,

Yang Lu received his B.S. degree from Jilin University, China, in 2004 and 1978, M.S. degree in information science and engineering from the University
the M.S. degree from the University of Manchester, UK, in 2006. He is of Science and Technology of China, in 1981, and Ph.D. degree in systems
currently pursuing his Ph.D. degree in ICT (Information and Communication science and engineering from Portland State University, USA, in 1986 (e-mail:
Technology) in USA. He is a member of IEEE. He has published research [email protected]). (Corresponding Author).
papers in refereed journals published by major publishers such as Elsevier, He is an IEEE Fellow, academician of the European Academy of Sciences,
Taylor and Francis, and World Scientific (e-mail: [email protected]/ziiyuu@ and academician of the Russian Academy of Engineering (formerly USSR
gmail.com). Academy of Engineering). Dr. Xu is a 2016 and 2017 Highly Cited Researcher
Li Da Xu (M’86–SM’11-F’16) received B.S. degree in information science in the field of engineering named by Clarivate Analytics (formerly Thomson
and engineering from the University of Science and Technology of China, in Reuters Intellectual Property & Science).

Copyright (c) 2012 IEEE. Personal use of this material is permitted. However, permission to use this material for any other purposes must be obtained from
the IEEE by sending a request to [email protected].
2327-4662 (c) 2018 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/JIOT.2018.2869847, IEEE Internet of
Things Journal
> REPLACE THIS LINE WITH YOUR PAPER IDENTIFICATION NUMBER (DOUBLE-CLICK HERE TO EDIT) < 2

and information processing technologies [1]. In addition, many challenges and opportunities for other interested researchers.
other technologies and devices, such as barcodes, smart phones, According to the five databases, there exist a large number of
social networks, and cloud computing, that are used in IoT journal articles and conference papers related to IoT
influence cybersecurity, to some extent. cybersecurity. For this research, for example, 433 articles
The cybersecurity of IoT is often cited by countries and (IEEE Xplore) from 2013 were chosen. The trend in Figure 1
institutions to implement standards and laws in order to achieve illustrates that cybersecurity is becoming a hot issue in IoT
a high degree of cybersecurity. The United States, China, and research.
the United Kingdom are the three largest countries affected by
IoT cybersecurity threats, especially by smart home attacks II. IOT-BASED CYBERSECURITY MANAGEMENT
[10]. In the U.S., the Cybersecurity for the Internet of Things SYSTEM
(IoT) program has been implemented to control and to improve IoT integrates heterogeneous smart devices into an integrity
the cybersecurity of smart devices and the entire environments network. IoT cybersecurity is a mechanism for the strategic
by standards and guidelines [11]. China’s Cybersecurity Law improvement of, and encompasses all of the changes involved,
(CSL) was initiated on June 1, 2017. The Cyberspace in IoT, to ensure the safety of the entire environment.
Administration of China (CAC) is the primary governmental
authority to supervise and enforce the CSL. The CSL regulates A. Cybersecurity-Oriented IoT Architecture
cybersecurity from different aspects, including network In Table I, the popular IoT cybersecurity architectures from
operation security and network information security, as well as different perspectives are listed. The table clearly illustrates that
managing monitoring, early warning, and emergency responses scholars construct IoT cybersecurity frameworks into three
within mainland China [12]. Europe has made progress in major categories: basic three-layer architecture, derived four-
various sectors, such as energy, vehicles, and residential, in layer architecture, and detailed five-layer architecture. The
cybersecurity [13]. layers are the perception (sensor) layer, the accessing layer, the
network layer, the middleware layer, the application (service)
layer, and the interface layer.
350
Table I
300 SUMMARY OF DIFFERENT IOT ARCHITECTURES
Number of Articles

Number of Major Technologies Article

250 Layers
Three Layers Sensing, Network, Application [2]
200
Perception, Network, Application [14]
Perception, Transportation, Application [15]
150
Perception, Network, Application [16]
Perception, Network, Service [17]
100 Perception, Network, Application [18] [33]
Four Layers Sensing, Networking, Service, Interface [1]
50 Perception, Network, Support, Application [7]

0 Five Layers Field Data Acquisition, Access Gateway, [3]

2013 2014 2015 2016 2017 Internet, Middleware, Application

Year Perception, Network, Middleware, [19]

Application, Business
Fig.1. The number of articles by year of the
five databases
An IoT architecture was proposed by [2] that includes three
fundamental layers: the application layer, the network layer,
Despite, or perhaps even because of, the diversified benefits and the sensing layer. From a service-oriented view, [1] divided
of internets, without powerful cybersecurity infrastructure and the whole framework into four layers, based on the SOA
functions, security attacks and deliberate misconduct can cause (service-oriented architecture): the sensing layer, the network
great trouble for the global IoT network. Meanwhile, the layer, the service layer, and the interface layer.
number of IoT-related cybersecurity publications is growing Moreover, the IoT architecture from other studies is
exponentially. This paper conducted an extensive literature described below. For instance, for the three-layered
review by exploring relevant articles from five major academic architecture, most studies [14]-[18] have the same architecture
databases (IEEE Xplore, Web of Science, ACM digital library, as Atzori’s. In the four-layered architecture, as compared to
INSPEC, and ScienceDirect) to clarify and to understand the Xu’s architecture, the third layer constructed by [7] is the
current status and the potential research directions regarding the support layer, which is especially for cloud computing. For the
issues of cybersecurity in IoT. Our review identifies five-layered architecture, based on Atzori’s architecture, [19]
cybersecurity countermeasures and the techniques of IoT that added two more common layers: the middleware and business
have been employed in diversified industries and highlights the layers. [3] proposed a five-layered generic IoT architecture that

2327-4662 (c) 2018 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/JIOT.2018.2869847, IEEE Internet of
Things Journal
> REPLACE THIS LINE WITH YOUR PAPER IDENTIFICATION NUMBER (DOUBLE-CLICK HERE TO EDIT) < 3

can satisfy various industries. The two bottom layers the field memory, disk space, processor time, and configuration
data collection layer and the access gateway layer process data information outages are all potential channels for DoS attacks
collection, the Internet layer serves communication media, and [4], [22]-[24]. A DoS attack has two types: Distributed Denial
the two top layers (the middleware layer and the application of Service (DDoS) and Ordinary DoS [25].
layer) are responsible for data utilization. 1) The Sensing Layer
The architectural design of IoT-based cybersecurity is The sensing layer, which consists of data sensors and
concerned with architecture protocols, wireless networking and networks, can detect, collect, process, and transmit information
communication, principles and functionalities, heterogeneous or data to the entire network [1]. There exist three major
and ubiquitous devices, authentication, lightweight cybersecurity issues at this layer: (1) the strength of wireless
technologies, etc. From the technological perspective, the signals, (2) the exposure of sensor nodes in IoT devices, (3) the
design of the architecture requires accessibility, integrity, dynamic nature of IoT topology, and (4) communication,
availability, scalability, confidentiality, and interoperability computation, and storage and memory constraints [26].
among heterogeneous smart devices [20]. From the This layer employs three popular mechanisms to protect the
hardware/software limitations, the design of the architecture IoT network: the lightweight encryption mechanism, the access
should be used in conjunction with computing and energy, control mechanism, and the nodes authentication mechanism.
memory, tamper-proof packaging, embedded software, and In practice, many attacks and crimes, such as Replay Attacks,
dynamic patches. Since cybersecurity might change or might Timing Attacks, Node Capture Attacks, Malicious Data
need real-time interaction within the related environment, an Attacks, and others, focus on the confidentiality of the
adaptive architecture is needed to assist devices which perception layer.
dynamically interact with other things in IoT. At each layer, A Replay Attack is made by spoofing, altering, or replaying
IoT devices and services are vulnerable to malicious attacks that the identity information of smart devices in the IoT network. A
can disrupt or destroy IoT network and services. From the Time Attack is an attacker stealing the encryption key
perspective of cybersecurity, a four-layered IoT architecture associated with time and other important information [27]. A
(Table II) is constructed in our study. Node Capture Attack is when an attacker takes over nodes and
captures useful information and data. In addition, the attacker
TABLE II can send Malicious Data to the layer by adding another node to
A FOUR-LAYERED CYBERSECURITY-ORIENTED the network [26]. A Side Channel Attack (SCA) refers to an
ARCHITECTURE FOR IOT
Layers Description Attack Types
attack on the side leakage information (such as time
Sensing Sensing objects and data. Replay Attacks, Timing consumption, power consumption or electromagnetic radiation,
Attack focus: Attacks, Node Capture etc.) of the encryption device, through the operation process of
confidentiality Attacks, Malicious Data the device [14].
Attacks, SCA (Side
As an example, Hanney needs to prove her identity to Jerry
Channel Attack)
Networking Networking and data Spoofed, altered or to access a web account. Jerry requests her password as proof
transmission. Attack replayed routing of identity, and it is provided by Hanney. At the same time, Jack
focus: confidentiality, information, Sybil, is eavesdropping on the conversation and saves the password.
privacy, and Wormholes
Later, Jack shows the password to Jerry as proof of access to
compatibility
Middleware Data delivery. Attack Malicious Insider, Hanney's website account.
focus: authenticity, underlying infrastructure, 2) The Network Layer
integrity and third-party relationships, The network layer serves the function of data routing and
confidentiality virtualization threat transmission to different IoT hubs and devices over the Internet
Application Requested service Phishing Attack, Virus,
provision. Attack focus: Worms, Trojan Horse and and the mobile network [2]. At this layer, cloud computing
data privacy and identity Spyware, Malicious platforms, Internet gateways, switching, and routing devices are
authentication Scripts, Unauthorized operated by using some of the very recent technologies such as
Access WiFi, LTE, Bluetooth, 3G/4G, Zigbee etc. The network
gateways serve as the mediator between different IoT nodes by
B. The Four Layers and Cybersecurity aggregating, filtering, and transmitting data to and from
different sensors.
The IoT is a global network, in which things or objects can
Confidentiality, privacy, and compatibility are the main
be connected and operated by smart devices such as Radio-
cybersecurity issues at this layer. In the IoT global network, the
Frequency Identification (RFID) tags and readers [21], sensors,
interactive function may be human-to-machine, machine-to-
actuators, smartphones, etc. At each layer, IoT-related things
human, human-to-human, or machine-to-machine. The
are susceptible to Denial of Service attacks (DoS), due to their
interconnection is handled by wired or wireless mechanisms
limited storage capacity, power consumption, and computation
among heterogeneous smart devices. Because everything is
capability.
embedded in the IoT network, attackers have a good chance of
A DoS Attack is an attempt to deny end users access to
evincing criminal activities. Specifically, the network layer is
resources related to the Internet of Things (e.g., machine or
very vulnerable to a type of attack called a Man-in-the-Middle
network resources). Interference channels, bandwidth,
attack. Advanced protocols and software/hardware can detect

2327-4662 (c) 2018 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/JIOT.2018.2869847, IEEE Internet of
Things Journal
> REPLACE THIS LINE WITH YOUR PAPER IDENTIFICATION NUMBER (DOUBLE-CLICK HERE TO EDIT) < 4

abnormal behaviors or situations to keep IoT secure [28], [29] [32]. The attacker injects malware into the system through
Spoofing, modification, and replay are mutual direct attacks viruses, worms, Trojan horses, and spyware to deny service,
that target data exchange, generate fake and false messages, and change data, and/or access confidential data [36]. When the user
create routing loops between nodes. A Sybil attack is a single monitors the gateway and runs the Active-X script, the system
node that can be located at multiple locations at the same time shuts down. Attackers can control access and steal data [37]. In
across multiple identities. Sybil attacks steal information by an Unauthorized Access Attack, an attacker can easily cause
spreading malware, reducing integrity and resource utilization damage to the system by forbidding access to related services
within the Internet of Things. Social media such as Facebook of IoT or by deleting existing data.
and Twitter are vulnerable to Sybil attacks [30].
C. Attack Taxonomy
As an example, an attacker can contaminate the entire
network by sending fake routing information. On Twitter, a user Due to the heterogeneity of smart devices, communication
is asked to do a survey before allowing him/her to enter the fake protocols, applications, and services, the attacks appear to be
Twitter login page. As the user logs in, the fake page can record malicious. We categorize different attacks into eight
the user's credentials, display the login error, and redirect the classifications [13]. Details are in Figure 2.
user to the real Facebook page. During this operation, the user's
information can be stolen. Device High end class, low end class
3) The Middleware Layer
The middleware layer is based upon the principle of Service
Oriented Architecture (SOA) [2]. It is a software layer between Location Internal, external
network and application levels. At this level, the authenticity,
integrity and confidentiality of all of the exchanged data needs
to be operated and managed. Through the Internet of Things Access Level Active, passive
architecture, intelligent middleware can combine high spatial-
temporal resolution with the ubiquitous nature of sensor
Information Interruption, eavesdropping, modification,
networks and other identifiable things to create dynamic Damage Level fabrication, replay, man-in-the-middle
mechanisms for the physical world in the digital/virtual world IoT
[31]. Attacks
A Malicious Inside Attack is the internal attackers Host Promise User, hardware, software

deliberately modifying and extracting data or information

within the network [32]. An Underlying Attack is a platform-
Strategy Physical, logical
as-a-service (PaaS) based attack. The goal of developers is to
maintain the secure application of IoT, and to maintain the
security of the lower layers [33]. Third-party relationship
Protocol-based Disruption, deviation
attacks are caused by third-party components such as mashups,
which increase the security of data and networks on PaaS [34].
A virtualization attack means that a virtual machine may be Layer-based
Perception, network, middleware,
application, interface
damaged and may affect other virtual machines. Many different
types of attacks may occur [35].
DoS, Wormholes, Spoofed, alter or
For example, assume that an insider illegally accesses a Major Attacks
replayed routing information, Sybil
system or a network and investigates the nature of system or
network to target vulnerable points. Then, a workstation may Fig. 2. Taxonomy of Cybersecurity Attacks on IoT
be executed to leak or to destroy data or information.
4) The Application Layer Attacks Based on Devices are high-end and low-end device
According to standardized protocols and service attacks. Attacks Based on Location are internal and external
technologies, the application layer explores all system attacks. Attacks Based on Access Level are active and passive
functionalities for the final users [1]. attacks [38]-[40]. Attacks Based on Information Damage
In the application layer, malicious data is shared and include interruption, eavesdropping, modification, fabrication,
exchanged among smart devices. How to protect data privacy replay, and man-in-the-middle attacks. Host-Based Attacks are
and security and how to identify objects depending on non- users, hardware, and software attacks. Attacks Based on
standard authentication mechanisms are big challenges to Strategy are physical and logical attacks. Protocol-Based
practitioners and to scholars [16]. Common security problems Attacks are disruption and deviation attacks. Layer-Based
in this layer are (1) data access permissions, identity Attacks are perception, network, middleware, and application
authentication, (2) data protection and recovery, (3) the ability attacks.
of dealing with mass-data, and (4) software vulnerabilities [14]. High-end device attacks involve high-power/full-fledged
A Phishing Attack is done by an attacker who obtains useful devices to launch attacks on the IoT system, while low-end
information or data from the user by stealing an authentication device attacks involve low power devices to attack the IoT
authorization, such as login credentials, credit card information system [41].

2327-4662 (c) 2018 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/JIOT.2018.2869847, IEEE Internet of
Things Journal
> REPLACE THIS LINE WITH YOUR PAPER IDENTIFICATION NUMBER (DOUBLE-CLICK HERE TO EDIT) < 5

Internal threats (“Insider”) originate from inside the IoT this section, we briefly introduce some common
network, and external threats (“Outsider”) originate outside the countermeasures that apply not only to different layers but also
IoT network [42]. In an internal attack, the attacker attempts to to smart devices, intelligent objects, and the entire network.
execute his own malicious code on smart devices in the IoT RFID (Radio Frequency Identification) and WSNs (Wireless
network. There are four types of internal attacks in practice: Sensor Networks) are the two fundamental technologies for the
affected roles, unintentional roles, emotional attackers, and creation and development of IoT. Moreover, technological
technically aware roles. An attacker tries to randomly, and device-involved measures and security schemes are illustrated
without the user’s knowledge, access IoT smart devices outside in detail.
the network, remotely.
A. RFID-based Authentication Measures
Without disrupting information and communication in the
IoT network, passive attacks involve monitoring and RFID technology allows the microchip to transmit
eavesdropping to recover information [26], [43]. Contrary to identification information to the reader through wireless
passive attacks, active attacks directly affect the communication. By using RFID devices, people and entities
communication system in the IoT networks. Active attacks can can identify, track, and monitor any object that has an RFID tag
circumvent or destroy smart devices and can destroy or label attached. RFID has been widely used in transportation
information or data [44], [40]. systems, medical records, and supply chain management [54].
The focus of the Interrupt Attack is on interrupting the RFID and the related technologies and instruments will be the
availability of the system. If this occurs, resources will be cornerstone of the upcoming Internet of Things, even as Radio
exhausted and smart devices may shut down [7], [45]. Frequency Identification techniques (RFID) and the related
Eavesdropping on the communication channel prevents the technologies make IoT more feasible and riskier, especially
receiver device from selecting packets to send. RFID devices when one considers possible application for authentication in
are vulnerable to eavesdropping attacks [46]. Attacks can alter the IoT global network.
or modify information or data in the IoT smart devices to RFID devices tag or label each device to enable identification
mislead the communication protocol. This attack threatens the mechanisms in the IoT network. Authentication is a necessary
integrity of the IoT network security requirements [47]. A and viable connection between two things to prevent data
Fabrication Attack occurs when an attacker inserts counterfeit attacks. Specifically, RFID cybersecurity measures include (1)
data into the IoT architecture to create damage to the IoT access control, (2) data encryption, (3) IPSec-based security
information system and to threaten IoT authentication [43]. channels, (4) cryptography technology schemes, and (5)
Credential information or data (such as passwords or keys) physical cybersecurity schemes.
associated with actual users may be misappropriated and Access control is a mechanism to prevent attackers from
abused [48]. Attackers attack software because of IoT device stealing or misusing RFID devices’ information or data, such as
exhaustion or resource buffer overflow vulnerability [49]. label failure, chip protection, and antenna energy analysis. Data
Attackers injecting malicious code or stealing the actual driver encryption is a mechanism that encrypts RFID signals and
or connecting to the device is a Hardware Attack [50], [51]. prevents data privacy through an algorithm. This algorithm also
Since most smart devices are run in an outdoor environment, prevents attackers from eavesdropping and tampering with data
physical attacks are likely to tamper with hardware. Physical during transmission. The IPSec-based secure channel integrates
attacks are similar to hardware attacks. Logical Attacks bring IPSec protocols and security mechanisms to perform
dysfunction to communication systems over the IoT network authentication and encryption over the IoT network. Based on
without harming physical devices [52]. secure communication protocols (hash function, random
Attackers can attack IoT in an abnormal manner. External number mechanism, server data search, logic algorithms, and
attackers may pretend to be insiders and may execute malicious re-encryption mechanisms), cryptographic technology
code on the IoT network. Thus, attackers can attack protocols solutions primarily protect user privacy, in addition to the
by disrupting internal or external networks: key management confidentiality, authenticity, and integrity of RFID systems.
protocol, data aggregation protocol, synchronization protocol, Physical security schemes can be divided into two categories:
etc. Deviation Attacks have two target protocols: application hiding and masking. The hiding schemes eliminate the data
protocol and the network protocol [39]. dependencies of the energy consumption; the masking schemes
randomize the intermediate values of the encryption devices
III. KEY ENABLING MEASUREMENTS [14].
The IoT is susceptible to various security attacks by hackers B. WSN-based Measures
or behavioral criminals. Many researchers [53] have explored Wireless Sensor Network (WSN) technology uses
the IoT security countermeasures from layer-level perspectives. interconnected smart devices for sensing and monitoring. Its
At each layer, the related attacks and countermeasures are applications include environmental monitoring, medical
described. But so many objects, attacks, and countermeasures monitoring, industrial monitoring, traffic monitoring, etc. [55],
are spread across the dynamic network. For instance, DoS [56].
attacks appear at most layers of the IoT network via malicious Data and information are collected and transmitted through
attacking perspectives, and RFID devices use different WSN, in which attackers actively and aggressively attack
countermeasures to deal with attacks throughout IoT. Hence, in

2327-4662 (c) 2018 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/JIOT.2018.2869847, IEEE Internet of
Things Journal
> REPLACE THIS LINE WITH YOUR PAPER IDENTIFICATION NUMBER (DOUBLE-CLICK HERE TO EDIT) < 6

WSN-related data or things. Therefore, it is recommended that IoT Global Network

many appropriate protection measures be taken to deal with
different attacks.
(1) Key Management. With WSN, the appropriate algorithm
can be built, and security keys will be generated and updated. HIP-based Schemes DTLS-based Schemes CapBAS Schemes

Common activities are to forward, backward, and extend

privacy, in order to protect collusion attacks and to identify
authentication. There are four protocols used: simple key ● Interoperability (No interruption in the functional operation of heterogeneous things)
distribution protocols, key pre-distribution protocols, dynamic ● Scalability (Connection of different smart devices among IoT network)
key management protocols, and hierarchical key management ● Memory Efficiency (Limitation of memory and storage of IoT smart devices)
protocols. (2) Secret Key Algorithms. Key algorithms include ● Communication overhead (No exchange of too many messages between communicating peers)
symmetric and asymmetric key algorithms. Symmetric key ● Computation Overhead (No consume too many CPU cycles for executing algorithms)
algorithms use Skipjack and RC5. Asymmetric key algorithms ● Resilience (Avoidance of failure of single point and of affection to IoT network)
use RAS (Rivest-Shamir-Adleman) and ECC (Elliptic Curves
Cryptography) [57], [58]. (3) Security Routing Protocol. Secure Fig. 3. An Evaluation Chart for IoT Security Schemes
routing protocol algorithms typically use the following
mechanisms: clustering mechanisms, data fusion mechanisms,
multiple hops routing mechanisms, and key mechanisms. The 1) Host Identity Protocol (HIP)-based schemes
Based on device mobility security attributes, these schemes,
SPINS security framework protocol is widely used in secure
such as interoperability, scalability, memory efficiency,
routing technologies and includes the SNEP (Secure Network
communication and computation overhead, and resiliency, are
Encryption Protocol) protocol and μTESLA (Micro Timed
applied to the authentication of IoT devices [60], [61].
Efficient Streaming Loss-tolerant Authentication Protocol)
HIP-DEX [62] and Slimfit [63] use Elliptic Curve Diffie-
protocol [59]. (4) Authentication and Access Control.
Hellman (ECDH) for key exchange in non-collaborative
Authentication technologies include lightweight public key
scenarios, while HIP-TEX [60] employs cryptographic
authentication technology, PSK (Pre-Shared Key), random key
computations of the key exchange in a collaborative
pre-distribution authentication technology, auxiliary
environment. HIP-TEX is relatively efficient in terms of
information authentication technology, and one-way hash
computation and memory, but lacks communication efficiency,
function authentication technology. Access control includes
because HIP-TEX will lead more IoT traffic. Slimfit may be
asymmetric symmetric cryptosystems. (5) Physical Security
suitable for IoT because it has the advantages of resiliency,
Design. Node design and antenna design are the two aspects.
memory, and communication skills, but Slimfit does not
Node design consists of hardware structure design and security
provide scalability and interoperability. HIP-DEX may be well-
chip selection, chip connection, radiofrequency circuit design,
suited for IoT with its high computational complexity, since it
and data acquisition unit design. Antenna design needs to be
can achieve high levels of interoperability, resiliency,
suitable for good communication distance, high adaptability,
scalability, communication complexity, and memory.
stability, and so on.
2) Datagram Transport Layer Security (DTLS)-based
C. Security Schemes schemes
In this section, we briefly summarize the IoT security Based on a new standard for the IoT [64], DTLS-based
schemes into three categories: Host Identity Protocol (HIP)- (Datagram Transport Layer Security) schemes were proposed
based schemes, Datagram Transport Layer Security (DTLS)- to secure the IoT network. Similar to HIP-based schemes,
based schemes, and Capability-based Access Control DTLS-based schemes need to satisfy the attributes of
(CapBAC) schemes. The advantages and disadvantages of the interoperability, resiliency, scalability, communication,
specific schemes are addressed and discussed as well. An memory, and computation.
evaluation chart is depicted in Figure 3. An X.509-certificate-based DTLS scheme was constructed
[65] to mutually authenticate smart devices in IoT but ignoring
either to process a certificate chain or to check a revocation list.
The delegation-based DTLS schemes [63] utilized a trusted
entity Delegation Server (DS) to handle certificate verification
in a home network. The certificate-based DTLS schemes
facilitate interoperability, resiliency, and scalability, but lack
computation, communication, and memory. In contrast, the
delegation-based DTLS schemes have the advantages of
communication, computation, and memory. However, the
delegation-based schemes are vulnerable to single points of
failure and to DoS attacks.
3) Capability-based Access Control (CapBAC) schemes
The mechanism for restricting access to authorized users in

2327-4662 (c) 2018 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/JIOT.2018.2869847, IEEE Internet of
Things Journal
> REPLACE THIS LINE WITH YOUR PAPER IDENTIFICATION NUMBER (DOUBLE-CLICK HERE TO EDIT) < 7

IoT is Capability-based Access Control (CapBAC) [66]-[69]. operations and to become more cost-effective tools [71].
CapBAC uses a cryptographic token to protect access rights and Cybersecurity attacks directly threaten the confidentiality,
privileges. The CapBAC schemes have two classifications: the integrity, and availability of healthcare systems, and include
centralized approach, which explores the access control logics DoS attacks, remote brute force attacks, man-in-the-middle
into a central entity in Cloud, and the distributed approach, attacks, password sniffing, Trojan horses, and data tampering.
which embeds the access control logics into IoT smart devices. [72] addresses the security and privacy challenges faced by
The centralized schemes include XACML, SAML based eHealth wireless technologies and eHealth smart devices.
schemes, Kerberos, RADIUS based schemes, OAuth based With the widespread use of IoT technology in healthcare,
schemes, and Context-aware schemes, and the distributed new security and privacy issues have arisen. It allows for data
schemes include Proxy Assisted schemes, Embedded PDP, etc. privacy, reliability, integrity, and unauthorized identification
A centralized approach fulfills the requirements of and tracking of objects. For example, an intruder can use an
interoperability, computation complexity, and memory interfering signal to block an infinite communication line
efficiency. However, the communication between smart between an RFID tag and a reader in IoT, or even spoof an
devices and the external entity has to be overloaded. On the RFID tag to send an error message to the reader. This will lead
other hand, a distributed approach has good level of scalability, to confusion in the medical information system and seriously
but lacks interoperability and memory efficiency [39]. affect the safety of patients. With the development of IoT and
the related technologies, medical care will develop into
intelligence, electronic information, artificial intelligence,
IV. KEY APPLICATIONS IN INDUSTRIES personalization and mobility [19].
The IoT makes full use of things, like smart devices and data B. Smart Domain
from the physical world, in a global network, in order to provide
IoT has connected people to things, like smart homes, smart
secured services to end-users. The IoT cybersecurity system
cities, smart meters, smart devices, smart appliances, and social
will bring tangible benefits to all walks of life. The more
networks. IoT will bring unprecedented improvements in
interactions and interoperability, the higher the standard
quality of life. One of the goals of IoT is to develop smart
mechanisms and services, the more life-cycle management, and
environments and self-conscious/autonomous objects: smart
the better the collaboration between companies. Industry relies
transport, smart cities, smart homes, smart health, smart living,
heavily on control systems, sensor equipment and data
and so on [73], [74].
networks. The disadvantages of this trend have led to an
Cybersecurity includes illegal access to information and
increase in the number and the types of cybersecurity threats.
attacks, resulting in a disruption of service availability. Data
Cybersecurity attacks against infrastructure and systems have
privacy and emergency responses trigger technical challenges
become commonplace in various industries, among medical
in smart environments. For cybersecurity purposes, the IoT
services, smart cities and home design, and transportation and
infrastructure needs to be confidential, auto-immune, and
parking systems.
reliable, in order to protect and to improve the smart
A. Healthcare Service Industry environment. For example, in a smart home, only authorized
The basic characteristics of IoT are the comprehensive users can monitor all the IoT-related smart devices. The
recognition of information, reliable delivery of information and password for IoT-related smart devices should be kept
smart processing of information. The development of IoT has confidential. Auto-immunity protects a family from potential
promoted the informationization process of the medical system. intruders through an alarm [75].
The application of IoT technology in the medical field will A smart home is a collection of devices that make up a variety
improve the cooperation and integration of traditional of smart system. A dynamic heterogeneous architecture is built
information technology in the healthcare industry [1], [2]. through the awareness layer, the network layer and the
IoT cybersecurity in the healthcare industry is associated application layer. In the smart home system architecture based
with medical information, identification, hospital emergency, on IoT, there is a unified operating standard between the
remote monitoring and home care, drug and production universal IoT devices. The IoT device organization system
supervision, medical equipment and medical waste tracking, connects to the access center without directly accessing related
blood management, infection control and many more [70]. For devices. Wireless communication methods are commonly used
example, traditionally medical information needs to be between IoT devices and access centers. Users can interact and
manually entered to generate information, networks, and manage with IoT devices through different platforms. For
individual functions. Each department and participant are example, a personal computer. Commonly used interaction
relatively independent, and information is asymmetry. IoT methods are: directly interacting with the device through the
technology completely breaks these limits with its terminal access center; connecting to the Internet center through the
scalability and accessibility. It enables healthcare systems to Internet cloud service [73].
more effectively improve overall information levels and C. Transportation and Parking System
collaborate on a variety of service functions.
The Transportation IoT was proposed in the context of the
In the healthcare environment, wireless wearable devices can
development of IoT. In the context of the application of IoT-
use IoT-derived data and information to improve basic

2327-4662 (c) 2018 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/JIOT.2018.2869847, IEEE Internet of
Things Journal
> REPLACE THIS LINE WITH YOUR PAPER IDENTIFICATION NUMBER (DOUBLE-CLICK HERE TO EDIT) < 8

related technologies. It can establish the whole process of Layer) communications

vehicle tracking, traffic safety and efficiency, intelligent 6LowPAN Confidentiality, Integrity, Transparent end-to-end
(Network Authentication, Non- security, communications
management of urban traffic, and automatic acquisition of more Layer) repudiation between 6LoWPAN
abundant road condition information by vehicles to achieve devices
automatic driving [76], [77]. RPL Confidentiality, Integrity, Protecting routing control
IoT technology brings a new revolution in transport and (Middleware Authentication, Non- messages, protecting
Layer) repudiation, Replay attack, routing operations against
logistics systems. The intelligent transportation system will Key management falsified routing updates
provide efficient traffic control and management in IoT. IoT- CoAP Confidentiality, Integrity, Protecting CoAP
based infrastructure and systems can be used to prevent (Application Authentication, Non- application-layer
electronic toll collection, mobile emergency command and Layer) repudiation, Replay messages, transparent and
protection granular end-to-end
dispatch, traffic enforcement, vehicle violation monitoring, security
environmental pollution reduction, and anti-theft systems; and
to avoid traffic jams, traffic accidents, intelligent beacons; and IEEE 802.15.4 [81], [82] sets the basic rules for lower-level
to minimize arrival delays [76], [77]. communications and lays the foundation for higher-level IoT
These applications are only part of IoT and have not yet communication protocols. 6LoWPAN [83]-[85] supports the
formed a huge network. In the future, intelligent transportation transmission of IPv6 packets over IEEE 802.15.4 and
will be accomplished through the connection between vehicles implements packet fragmentation and reassembly mechanisms
and vehicles, the interaction between people and vehicles, and and other functions. The Low-power and Lossy Networks
the huge vehicle connection network. The transportation (RPL) [86] proposed by the IETF's Low-Power, Lossless
problems such as traffic congestion, environmental pollution Network Routing (ROLL) Working Group design routing
and safety accidents will be appropriately solved [1], [2]. solutions for IoT applications. RPL provides a framework for
specific types of applications. The Constrained Application
Protocol (CoAP) [87], currently being designed by the
V. RESEARCH CHALLENGES & FUTURE TRENDS Constrained RESTful Environments (CoRE) Working Group of
The global IoT network comprises a variety of devices and the IETF, supports communications at the application layer.
applications. But, due to different scenarios and requirements, In fact, we do not have a standardized framework that can
these things may not be designed primarily for security issues. integrate data models, ontology, and data formats with IoT
Many challenging issues still need to be addressed in order to protocols, applications, and services. Due to the extant differing
achieve a higher level of IoT cybersecurity, e.g., secrecy, standards, more thorough and generalized infrastructure needs
confidentiality, data integrity, authentication, access control, to be built to fulfill the interoperability and integrity of IoT
etc. Several technologies, standardization, and other emerging mechanisms, applications, and services.
research are currently under way, to meet the high standards of IoT system is such broad platform that consists
IoT cybersecurity. IoT is a network system that connects things heterogeneous data, devices, technologies, and protocols.
based on the internet, and establishes information sharing and Standardization may be a Garden of Eden that cannot achieve
exchange. The core of IoT is to achieve convenience, in IoT systems at least in short-term. However, standardization
efficiency, and intelligence. The realization of IoT technology can be the ultimate goal that improves and prompts the
is based on infrastructure and high-end technology [78]. development of security in IoT. The following is good
A. Standardization examples that company or organization implements
standardization issues for both security and IoT.
Because of the complex structure of things in IoT, standards
and protocols need to be modified and federated with B. Data Issues
heterogeneous things. A standardized IoT architecture The vast amount of data generated by the Internet of Things
comprising data models, interfaces, and protocols can support a in various businesses, including personal basic information,
broad range of humans, devices, languages, and operating user account transaction data, medical insurance records, and
systems to achieve common goals [16], [28]. work business information. Once these data are leaked, it will
The Institute of Electrical and Electronics Engineers (IEEE) have a major impact on people's lives and work [78]. Malicious
and the Internet Engineering Task Force (IETF) are the main data (e.g., personal information, stock data, and medical
entities that design new communications and security protocols; records) needs to be processed in the IoT network. Data is one
they will play an important role in protecting the global IoT of the promising cybersecurity issues in different layers of IoT
network [79], [80]. Table III lists standards and protocols in cybersecurity infrastructure. The major issues are data
details. confidentiality, data privacy, and data integrity. Many
approaches have been developed to protect information and
Table III data security within the IoT network [77]. Data confidentiality
STANDARDS & PROTOCOLS FOR IOT CYBERSECURITY
is one of fundamental data issues in IoT cybersecurity. A well-
Standards Security Issue Application
IEEE Confidentiality, Integrity, Access control configured scenario guarantees that authorized entities can
802.15.4 Authentication, Replay mechanism, Time- access and process data and prevents the invasion of
(Perception attack synchronized unauthorized entities. The two important cybersecurity

2327-4662 (c) 2018 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/JIOT.2018.2869847, IEEE Internet of
Things Journal
> REPLACE THIS LINE WITH YOUR PAPER IDENTIFICATION NUMBER (DOUBLE-CLICK HERE TO EDIT) < 9

mechanisms are access control and the authentication process device (eg, a mobile phone) and communicated with the cloud
[76]. or sent directly to the terminal device, then forwarding the
Many access control techniques have been proposed, from control commands to the device terminal. In this way, smart
the previous literature, to ensure confidentiality in IoT. One devices in IoT can be controlled in any situation that may
standard approach is Role-Based Access Control (RBAC). interfere with the internet, thereby enabling intelligent
RBAC integrates with real-time and dynamic data streams operations related to data [100].
management systems in IoT to ensure data authenticity,
C. Research Trends
confidentiality, and integrity during transmission [88]-[90]. The
second mechanism is a key distribution scheme, that is, secure The IoT is an emerging technology that changes all of aspects
data aggregation in wireless sensor networks such as SEDAN of society, both for people and for business. With the advance
[91] and SAWAN [92]. In addition, in order to avoid of IoT, many advanced technologies and mechanisms are being
unauthorized access, anonymization techniques based on data initiated.
suppression, randomization or cloaking have been proposed 1) Cloud service security
[93], [94]. Cloud computing is based on distributed computing, parallel
Privacy in data collection, sharing, and management open computing, grid computing and virtualization. Cloud
new research issues in IoT. RFID-related devices and computing can provide massive information storage and
technologies are one viable way to protect data security. Many analytics for IoT. With the development of IoT, how to analyze
mechanisms have been proposed to address data privacy issues and process a large amount of data and information is a real
in IoT cybersecurity, such as Kaos [95], Tropos [96], NFR [97], problem. One potential solution is to integrate cloud computing
GBRAM [98], PRIS [99]. In addition, security mechanisms, into IoT system. Using cloud computing to build an IoT
like Data Encryption (RSA, DSA, BLOWFISH and DES) and platform can reduce costs and achieve efficient calculation and
Biometric Verification, can prevent unauthorized users from storage [101]. Cloud computing provides a high-quality and
accessing data [47]. Data integrity refers to the protection of reliable architecture for IoT and is conducive to the massive
information or data from attacks or external influences during expansion of IoT. However, because the cloud computing
transmission and reception, maintaining the originality, platform is a relatively open platform, there are many security
accuracy, and unfalsification of data [2]. The security risks in its operation procedure.
mechanisms are Cyclic Redundancy Check (CRC) and Version There is a tendency for IoT systems and services to be
Control. Data availability ensures that authorized users access removed and hosted on cloud platforms, so that devices and
their information resources in both normal and abnormal applications can be accessed at anytime from anywhere,
conditions. A Denial-of-Service (DoS) Attack is one of the without boundaries. Smart devices can be deployed and linked
popular attacks that cybersecurity should focus on. Most to cloud services through Wi-Fi and wireless Internet
functional devices have a more or less security risk. For connectivity systems. The IoT relies on cloud services such as
example, the car's central control display system, webcam, Storage-as-a-Service (SaaS) and Database-as-a-Service (DaaS)
home alarms, etc. IoT devices do not focus on enhancing the to store sensor data [102]. However, cybersecurity concerns
security of data information in all aspects of access, have increased. Ways to integrate and improve the existing IoT
transmission, and storage of data information, but are always systems and mechanisms in order to prevent attacks toward
concerned with the capabilities of the extended device. cloud-based IoT services will attract more and more attention.
Traditional security models cannot adapt to new security Cloud security includes technologies, security controls, and
challenges and the age of information data brought about by strategies developed for protecting cloud databases and services
IoT. Security issues directly affect the further development and such as infrastructure (IaaS) platform (PaaS), software (SaaS),
application of IoT. Data security and disposal are issues that and infrastructure (IaaS).
cannot be avoided by security issues [1]. The big data of IoT is stored in a server with a cloud
The rapid development of big data and IoT has brought computing platform. Cloud computing servers are distributed
convenience to people, and we also encounter unprecedented around the world. The diversity and complexity of the server
information security risks [100]. As early as July 2015, determines that the user does not know where the data is stored,
American auto companies recalled more than one million and the security risks exist. Cloud computing mainly uses
vehicles using the Uconnect system. The reason is that there are virtual technology to achieve data sharing, and many virtual
large security holes in the in-vehicle system. Hackers can use machines share one resource. Once encryption or isolation of
these vulnerabilities to remotely control the onboard system to one piece of data is not achieved, the data is transparent and
shut down the engine, accelerate and decelerate the vehicle, and easily exploited by illegal users. The cloud computing platform
cause brake failure. Due to the virtual nature of IoT, its does not guarantee the complete security of end-user
operating mode relies on the collection and processing of data information. The end-user is handed over to the cloud
resources. Currently, IoT and big data technologies combine computing platform. Cloud computing platforms analyze and
multiple services. For example, wireless communication process data and have data access. In this way, the end-user
technology (Bluetooth, WI-FI, ZigBee), hardware, device and doesn’t have complete control over the data. In the process of
applications, mobile applications, cloud services. On the mobile calculating and processing data in the cloud, the data is easily
side, the mobile application is first downloaded by the mobile leaked. There are also security risks in transmitting and using

2327-4662 (c) 2018 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/JIOT.2018.2869847, IEEE Internet of
Things Journal
> REPLACE THIS LINE WITH YOUR PAPER IDENTIFICATION NUMBER (DOUBLE-CLICK HERE TO EDIT) < 10

data in IoT systems [103]. security mechanisms are key factors in ensuring the high level
Establishing a secure network environment. A trusted cloud of security and privacy. The demand for IoT-related services
computing platform provides supercomputing capabilities for will continue to grow. The core of supporting IoT is a large-
data storage and web applications. The security measures of the scale connection among different things with a delay of about 1
cloud computing platform, such as physical security, system millisecond. The current network has bottlenecks that are
security, network security, database security, etc., ensure the difficult to achieve. It is possible for 5G networks to fill this
basic computing power of the platform and protect cloud- gap, mainly because of the low latency, wide coverage, ultra-
related end-user’s data security and privacy from the dense networks, and large-scale connections of 5G.
unauthorized access and potential threats. Encryption 3) QoS-based (Quality of service) Design
technology is used to protect data. Encryption is a way to handle The ubiquitous IoT requires complex cybersecurity systems
secret locks and passwords efficiently. Cloud computing-based to accomplish different tasks. A QoS-based (Quality of Service)
IoT systems, encryption technologies, authentication and cybersecurity infrastructure has the potential to protect and to
access, and anonymous algorithms will be the means to protect improve the entire IoT network. QoS research is needed to
data security and privacy in the near future [103]. support the development of IoT. QoS management schemes can
2) 5G improve the levels of RFID system and of cybersecurity
The key technologies of 5G are wireless technology and infrastructure [109].
network technology. Wireless technologies include massive Although a lot of research has been done on IoT
MIMO technology, multiple access technology, ultra-high- cybersecurity issues, such as architecture and protocol design,
density network technology, multi-carrier technology and countermeasures, and applications, the quality of service (QoS)
modulation coding technology. Network technologies include in IoT cybersecurity is still an unexplored field of research.
network slicing technology, mobile edge computing Consider, for example, (1) IoT-related resource constraints.
technology, control plane/user plane separation technology and QoS-based cybersecurity mechanisms should be simplified in
network function reconstruction technology [104]. order to solve constraints involved in IoT, such as energy,
With the development of connectivity technology and the bandwidth, memory, etc. (2) Data privacy. QoS-based
integration with smart devices, 5G will enhance the ubiquity, cybersecurity mechanisms should take into account the issue of
reliability, scalability, and cost-effectiveness of seamless global data privacy, which is critical to IoT security. (3) Scalability. A
IoT [104]. Because of more IP identifiable objects, IPv6 is QoS-based network security mechanism should be able to
replacing IPv4 to implement IoT, since more bandwidth is expand to a large number of sensor nodes and smart devices.
needed to solve more traffic issues and delays. Hence, the new 4) Other trends
generation of communication (5G) has been created and can Fault Tolerance Mechanism The higher the limit on smart
provide speed between 10-800Gbps, while the current devices, the worse the performance of the device, and the more
technology (4G) has only provided at a speed of 2-1000 Mbps. susceptible the devices are to attacks. IoT objects should have
5G technology can also integrate both IPv4 and IPv6. The certain defensive mechanisms that can be used flexibly when
implementation of 5G will enhance many technologies: needed and can recover from any possible damage. Hence, fault
Heterogeneous Networks (HetNets), Software Defined tolerance is indispensable to cybersecurity [28]. IoT Forensics.
Networks (SDNs), Massive MIMO, and Multiple Radio Since IoT is a comprehensive definition, crimes such as
Access, etc. [105], [106]. The development of mobile devices computer crimes or cloud crimes should be IoT crimes, which
and smartphones enables users to achieve exponential data involve any abnormal activity or behavior in the IoT paradigm.
flow. [107] depicts the use of small cells (e.g., femtocells) in an IoT-related crimes are related to smart devices, services, and
IoT environment. Femtocell will integrate voice, video and data communication channels. An effective way to investigate these
for mobile users. Proper traffic modeling and deployment crimes is to perform digital forensic procedures within the IoT
strategies will improve the overall performance of femtocell network [39]. Self-Management. One of the ultimate goals of
networks in the IoT environment. Furthermore, the Industrial the IoT is to self-manage everything, in order to meet the
Internet of Things (IIoT) is a rapidly evolving Internet network requirements of different entities (such as people, companies,
[24], and embedded sensors are the primary tool for collecting and institutions). Smart things can be performed without
and exchanging data. 5G technology and healthcare systems restrictions. For example, smart devices can self-configure,
can be integrated. Users can interact with various types of self-maintain, self-repair, and can even play an active role in
sensors through a secure wireless medical sensor network their own disposal [31]. Blockchain Embedded Cybersecurity
(WMSN) [108]. Design. The interoperability, integrity, and autonomy of RFID
However, as a global dynamic environment, rich source data and wireless sensor network technologies, and their low-cost
integrates unlimited systems, and attackers have a great transmission capacity may lead to dynamic system
opportunity to identify vulnerable targets and to launch attacks interconnection of distributed resource entities through the IoT
within the IoT network. Cybersecurity issue, such as data network. Cryptography consists of a public key and a private
privacy, information transmission management, security key. The private key needs to be associated with unrelated and
protocols and mechanisms all need to be considered within IoT constrained objects in the dynamic network. In the long run,
interoperability of 5G technology. Mobile communication smart devices need to be rekeyed in order to ensure the security
networks have high security requirements. QoS and industry of information and data [28], [110], [111].

2327-4662 (c) 2018 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/JIOT.2018.2869847, IEEE Internet of
Things Journal
> REPLACE THIS LINE WITH YOUR PAPER IDENTIFICATION NUMBER (DOUBLE-CLICK HERE TO EDIT) < 11

VI. CONCLUSION [17] X. Jia, O. Feng, T. Fan, and Q. Lei, “RFID Technology and Its
Applications in Internet of Things (IoT),” In Proc. of the 2nd IEEE
In the Internet of Things (IoT), people, protocols and International Conference on Consumer Electronics, Communications and
principles, wireless networking and communication, devices, Networks (CECNet), Apr. 2012, pp.1282-1285.
and technologies collaborate as virtual entities that achieve [18] M. C. Domingo, “An overview of the internet of things for people with
disabilities,” J. Netw. Comput. Appl., vol.35, no.2, pp.584-596, 2012.
common goals. The IoT has dramatically changed the entire [19] F. Alsubaei, A. Abuhussein, and S. Shiva. "Security and Privacy in the
world and our daily lives. Cybersecurity guarantees that IoT Internet of Medical Things: Taxonomy and Risk Assessment," Local Computer
will become a secure network for people, software/hardware, Networks Workshops (LCN Workshops), 42nd Conference on. IEEE, 2017, pp.
processes, and things. If so, IoT will offer the world a higher 112-120, doi: 10.1109/LCN.Workshops.2017.72.
[20] S. A. Alabady, F. Al-Turjman, and S. Din, “A novel security model for
level of accessibility, integrity, availability, scalability, cooperative virtual networks in the IoT era”, Springer International Journal of
confidentiality, and interoperability. At the same time, Parallel Programming, 2018, doi: 10.1007/s10766-018-0580-z.
cybersecurity issues will be one of the primary tasks of IoT in [21] C. Sun, “Application of RFID technology for logistics on internet of
the coming years. things,” AASRI Procedia, vol.1, pp.106-111, 2012.
[22] S. Babar, P. Mahalle, A. Stango, N. Prasad, and R. Prasad, “Proposed
In this article, we have vigorously surveyed the important Security Model and Threat Taxonomy for the Internet of Things,” In Proc. of
aspects of IoT cybersecurity, specifically, the state-of-the-art of the Recent Trends in Network Security and Applications. Springer, 2010, pp.
the current position and potential future directions, the major 420–429
countermeasures against IoT attacks, and the applications in [23] P. N. Mahalle, B. Anggorojati, N. R. Prasad, and R. Prasad, “Identity
authentication and capability based access control (IACAC) for the internet of
industries. In addition, we introduced and discussed a possible things,” Journal of Cyber Security and Mobility, vol. 1, no. 4, pp. 309–348,
four-layered IoT cybersecurity infrastructure and a taxonomy 2013.
of attacks on IoT cybersecurity. [24] A. R. Sadeghi, C. Wachsmann, and M. Waidner. “Security and Privacy
Challenges in Industrial Internet of Things,” In Annual Design Automation
Conference, ACM, 2015, pp. 54.
REFERENCES [25] A. Belapurkar, A. Chakrabarti, H. Ponnapalli, N. Varadarajan, S.
[1] L. Xu, W. He, and S. Li, “Internet of Things in industries: a survey,” IEEE Padmanabhuni, and S. Sundarrajan, Distributed Systems Security: Issues,
Trans. Ind. Informat., vol. 10, no. 4, pp. 2233-2243, 2014. Processes and Solutions. Wiley Publishing, Chichester, UK, 2009.
[2] L. Atzori, A. Iera, and G. Morabito, “The internet of things: a survey,” [26] M. Farooq, M. Waseem, A. Khairi, and S. Mazhar, "A critical analysis on
Comput. Netw., vol. 54, no. 15, pp. 2787–2805, 2010. the security concerns of internet of things (IoT)," Perception, vol. 111, no. 7,
[3] D. Bandyopadhyay, and J. Sen, “Internet of things: applications and pp. 1-6, 2015.
challenges in technology and standardization,” Wireless Pers. Commun., [27] S. Sicari, A. Rizzardi, L. Grieco, and A. Coen-Porisini, “Security, privacy
vol.58, no.1, pp.49-69, 2011. and trust in internet of things: The road ahead,” Computer Networks, vol. 76,
[4] R. Roman, J. Zhou, and J. Lopez, "On the features and challenges of security pp. 146 – 164, 2015. [Online]. Available: http://www.sciencedirect.com
and privacy in distributed internet of things," Comput. Netw., vol. 57, no. 10, /science/article/pii/S1389128614003971.
pp. 2266-2279, 2013. [28] R. Roman, P. Najera, and J. Lopez, “Securing the internet of things,”
[5] Gartner (2015). Gartner Says 4.9 Billion Connected "Things" Will Be in Use Computer, vol.44, no.9, pp.51-58, 2011.
in 2015 [Online]. Available: http://www.gartner.com/newsroom/id/2905717, [29] R. E. Crossler, F. Bélanger, and D. Ormond, "The quest for complete
accessed on Jun. 29, 2018. security: An empirical analysis of users’ multi-layered protection from security
[6] D. Evans (2011), “The Internet of things: How the next evolution of the threats," Information Systems Frontiers, pp. 1-15, 2017, Online published, doi:
Internet is changing everything,” CISCO, San Jose, CA, USA, White Paper, 10.1007/s10796-017-9755-1.
Available: https://www.cisco.com/c/dam/en_us/about/ac79/docs/innov/IoT_ [30] H. Kumar, D. Sarma, and A. Kar, “Security threats in wireless sensor
IBSG_ 0411FINAL .pdf, accessed on Jun. 25, 2018. networks,” IEEE Aerosp. Electron. Syst. Mag., vol. 23, no. 6, pp. 39–45, Jun.
[7] H. Suo, J. Wan, C. Zou, and J. Liu, “Security in the Internet of Things: A 2008.
Review,” In Proc. of the Computer Science and Electronics Engineering [31] M. Abomhara and G. M. Koien, ‘‘Security and Privacy in the Internet of
(ICCSEE), vol. 3. IEEE, 2012, pp. 648–651. Things: Current Status and Open Issues,’’ In Proc. IEEE Int. Conf. Privacy
[8] M. Covington and R. Carskadden, “Threat Implications of the Internet of Security Mobile Syst., May 2014, pp. 1-8, doi:
Things,” In Proc. of the 5th International Conference on Cyber Conflict 10.1109/PRISMS.2014.6970594.
(CyCon). IEEE, 2013, pp. 1–12. [32] S. Li and L. Xu, Securing the Internet of Things. Syngress Publishing,
[9] Y. Lu, "Industry 4.0: a survey on technologies, applications and open Cambridge, MA, 2017.
research issues," J. of Ind. Inform. Integ., vol. 6, pp. 1-10, 2017. [33] A. Mukherjee, ‘‘Physical-Layer Security in the Internet of Things: Sensing
[10] Helpnetsecurity (2017). US, China and the UK are top regions affected by and Communication Confidentiality under Resource Constraints,’’ In Proc.
IoT security threats, [Online]. Available: IEEE, vol. 103, no. 10, pp. 1747–1761, Oct. 2015.
https://www.helpnetsecurity.com/2017/08/16/regions-iot-security-threats/, [34] K. Hashizume, D. G Rosado, E.Fernández-Medina, E. B. Fernandez, “An
accessed on Jun. 20, 2018. analysis of security issues for cloud computing”, Journal of Internet Services
[11] NIST (2016), NIST Cybersecurity for IoT Program. [Online]. Available: and Applications, vol. 4, no. 1, pp. 5, 2013.
https://www.nist.gov/programs-projects/nist-cybersecurity-iot-program, [35] K. Nagaraju and R. Sridaran, "A survey on security threats for cloud
accessed on Jun. 19, 2018. computing," International Journal of Engineering Research & Technology, vol.
[12] KPMG (2017), Overview of China’s Cybersecurity Law. [Online]. 1, no. 7, pp. 1-10, 2012.
Available: https://assets.kpmg.com/content/dam/kpmg/cn/pdf/en/2017/02/ [36] Q. Xu, P. Ren, H. Song, and Q. Du, “Security enhancement for IoT
overview-of-cybersecurity-law.pdf, accessed on Jun. 15, 2018. communications exposed to eavesdroppers with uncertain locations,” IEEE
[13] R. H. Weber, “Internet of things-new security and privacy challenges,” Access, vol. 4, pp. 2840–2853, 2016.
Comput. Law Security Rev., vol. 26, no. 1, pp. 23–30, 2010. [37] Y. Zou, X. Wang, W. Shen, and L. Hanzo, “Security versus reliability
[14] K. Zhao and L. Ge, ‘‘A Survey on the Internet of Things Security,’’ In analysis of opportunistic relaying,” IEEE Trans. Veh. Technol., vol. 63, no. 6,
Proc. 9th Int. Conf. Comput. Intell. Secur. (CIS), Dec. 2013, pp. 663–667. pp. 2653–2661, Jul. 2014.
[15] Q. Jing, A. V. Vasilakos, J. Wan, J. Lu, and D. Qiu, “Security of the [38] M. Hossain, R. Hasan, and A. Skjellum, "Securing the Internet of Things:
internet of things: perspectives and challenges,” Wireless Networks, vol. 20, pp. A Meta-Study of Challenges, Approaches, and Open Problems," Distributed
2481–2501, 2014. Computing Systems Workshops (ICDCSW), 2017 IEEE 37th International
[16] R. Mahmoud, T. Yousuf, F. Aloul, and I. Zualkernan, "Internet of things Conference on. IEEE, 2017, pp. 220-225.
(IoT) Security: Current Status, Challenges and Prospective Measures," In [39] M. Hossain, M. Fotouhi, and R. Hasan, “Towards an analysis of security
Internet Technology and Secured Transactions (ICITST), 2015 10th issues, challenges, and open problems in the IoT,” In Services (SERVICES),
International Conference, IEEE, 2015, pp. 336-341. 2015 IEEE World Congress on IEEE, 2015, pp. 21-28.

2327-4662 (c) 2018 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/JIOT.2018.2869847, IEEE Internet of
Things Journal
> REPLACE THIS LINE WITH YOUR PAPER IDENTIFICATION NUMBER (DOUBLE-CLICK HERE TO EDIT) < 12

[40] A. Mayzaud, R. Badonnel, and I. Chrisment, “A taxonomy of attacks in [64] Z. Shelby, K. Hartke, C. Bormann, and B. Frank, “Constrained application
rpl-based internet of things,” International Journal of Network Security, vol. protocol (CoAP),” IETF 2013. [Online]. Available:
18, no. 3, pp. 459–473, 2016. http://tools.ietf.org/html/draft-ietf-corecoap-18.
[41] S. U. Rehman, K. W. Sowerby, and C. Coghill, “Analysis of impersonation [65] T. Kothmayr, C. Schmitt, W. Hu, M. Brunig, and G. Carle, “A DTLS based
attacks on systems using RF fingerprinting and low-end receivers,” End-to-End Security Architecture for the Internet of Things with Two-Way
J. Comput. Syst. Sci., vol. 80, no. 3, pp. 591–601, 2014. Authentication,” In Proc. IEEE 37th Conf. Local Comput. Netw. Workshops,
[42] T.-G. Lupu, I. Rudas, and N. Mastorakis, “Main Types of Attacks in Oct. 2012, pp. 956–963.
Wireless Sensor Networks,” In WSEAS International Conference, Proc. Recent [66] S. Cirani, M. Picone, P. Gonizzi, L. Veltri, and G. Ferrari, “IoT-OAS: An
Advances in Computer Engineering, no. 9. WSEAS, 2009. oauth-based authorization service architecture for secure services in IoT
[43] S. Alam and D. De, “Analysis of security threats in wireless sensor scenarios,” IEEE Sensors J., vol. 15, no. 2, pp. 1224–1234, Feb. 2015.
network,” International Journal of Wireless and Mobile Networks, vol. 6, no. [67] R. Hummen, H. Shafagh, S. Raza, T. Voig, and K. Wehrle, “Delegation-
2, pp. 35–46, Apr. 2014. based Authentication and Authorization for the IP-based Internet of things,” in
[44] A. K. Rai, R. R. Tewari, and S. K. Upadhyay, "Different types of attacks Proc. 11th Annu. IEEE Int. Conf. Sens., Commun. Netw. (SECON), 2014, pp.
on integrated manet-internet communication," International Journal of 284–292.
Computer Science and Security, vol. 4, no. 3, pp. 265-274, 2010. [68] P. Pereira, J. Eliasson, and J. Delsing, “An Authentication and Access
[45] T. Heer, O. Garcia-Morchon, R. Hummen, S. Loong Keoh, S. S. Kumar, Control Framework for COAP-based Internet of Things,” In Proc. 40th Annu.
and K.Wehrle, “Security challenges in the IP-based internet of things,” Wireless Conf. IEEE Ind. Electron. Soc. (IECON), TX, USA, Oct. 2014, pp. 5293–5299.
Pers. Commun., vol. 61, pp. 527–542, 2011. [69] B. Anggorojati, P. N. Mahalle, N. R. Prasad, and R. Prasad, "Capability-
[46] G. P. Hancke and S. C. Centre, “Eavesdropping Attacks on High- based Access Control Delegation Model on the Federated IoT Network," In Int'l
Frequency RFID Tokens,” In Proc. Workshop Radio Frequency Identification Symposium on Wireless Personal Multimedia Communications (WPMC), 2012,
Security, Jul. 2008, pp. 100–113. pp. 604-608.
[47] Y. Zhang and W. Lee, “Intrusion Detection in Wireless Ad-Hoc networks,” [70] D. Miorandi, S. Sicari, F. De Pellegrini, and I. Chlamtac, “Internet of
In Proc. 6th Int’l. Conf. Mobile Comp. Net., MobiCom 2000, Aug. 2000, pp. things: vision, applications and research challenges,” Ad Hoc Netw., vol. 10,
275–83. no. 7, pp. 1497–1516, 2012.
[48] M. Uma and G. Padmavathi, “A survey on various cyber attacks and their [71] S. Li, L. Xu, and S. Zhao, “The internet of things: a survey,” Information
classification”, International Journal of Network Security, vol. 15, no. 6, pp. Systems Frontiers, vol.17, no.2, pp.243-259, 2015.
391-397, 2013. [72] Omoogun, Michelle, et al. "When eHealth Meets the Internet of Things:
[49] M. Ali, S. U. Khan, and A. V. Vasilakos, “Security in cloud computing: Pervasive Security and Privacy Challenges." In Cyber Security and Protection
opportunities and challenges,” Inf. Sci., vol. 305, pp. 357– 383, 2015, Of Digital Services (Cyber Security), 2017 International Conference on. pp. 1-
doi:10.1016/j.ins.2015.01.025. 7, IEEE.
[50] A. Perrig, J. Stankovich, and D. Wagner, “Security in wireless sensor [73] C. W. Tsai, C. F. Lai, and A. V. Vasilakos, ‘‘Future internet of things: open
networks,” Commun. ACM, vol. 47, no. 6, pp. 53–57, Jun. 2004. issues and challenges,’’ Wireless Netw., vol. 20, no. 8, pp. 2201-2217, 2014.
[51] H. Abie and I. Balasingham, “Risk-based Adaptive Security for Smart IoT [74] Y. Mehmood, F. Ahmad, I. Yaqoob, A. Adnane, M. Imran, and S. Guizani,
in eHealth,” In Proc. of the 7th International Conference on Body Area “Internet-of-things-based smart cities: Recent advances and challenges,” IEEE
Networks. ICST, 2012, pp. 269–275. Commun. Mag., vol. 55, no. 9, pp. 16–24, Jan. 2017.
[52] S. Babar, P. Mahalle, A. Stango, N. Prasad, and R. Prasad, “Proposed [75] A. S. Elmaghraby, M. M. Losavio, “Cyber security challenges in smart
Security Model and Threat Taxonomy for the Internet of Things (IoT),” ser. cities: safety, security and privacy,” Journal of Advanced Research, Volume 5,
Communications in Computer and Information Science. Springer Berlin No. 4, pp. 491-497, July 2014, doi: 10.1016/j.jare.2014.02.006.
Heidelberg, 2010, vol. 89, book section 42, pp. 420–429. [Online]. Available: [76] R. Khan, S. U. Khan, R. Zaheer, and S. Khan, “Future Internet: The
http://dx.doi.org/10.1007/978-3-642-14478-3 42 Internet of Things Architecture, Possible Applications and Key Challenges,” In
[53] J. P. Walters and Z. Liang, “Wireless Sensor Network Security: A Survey,” Proc. 10th Int. Conf. FIT, 2012, pp. 257–260.
Security in Distributed, Grid, and Pervasive Computing, Ed. Y. Xiao, Auerbach [77] A. Riahi, Y. Challal, E. Natalizio, Z. Chtourou, and A. Bouabdallah, “A
Publishing, CRC Press, 2006. Systemic Approach for IoT Security,” In Distributed Computing in Sensor
[54] E. W. T. Ngai, K. K. Moon, F. J. Riggins, and C. Y. Yi, “RFID research: Systems (DCOSS), 2013 IEEE International Conference on. IEEE, 2013, pp.
an academic literature review (1995–2005) and future research directions,” Int. 351–355.
J. Prod. Econ., vol. 112, no. 2, pp. 510–520, 2008. [78] Z. K. Zhang, M. C. Y. Cho, C. W. Wang, C. W. Hsu, C. K. Chen, and S.
[55] S. Li, L. Xu, and X. Wang, “Compressed sensing signal and data Shieh, "IoT security: ongoing challenges and research opportunities." In
acquisition in wireless sensor networks and internet of things,” IEEE Trans. Service-Oriented Computing and Applications (SOCA), 2014 IEEE 7th
Ind. Informat., vol. 9, no. 4, pp. 2177–2186, Nov. 2013. International Conference on, IEEE, 2014, pp. 230-234.
[56] W. He and L. Xu, “Integration of distributed enterprise applications: a [79] J. Granjal, E. Monteiro, and J. S. Silva, ‘‘Security for the Internet of
survey,” IEEE Trans. Ind. Informat., vol. 10, no. 1, pp. 35–42, Feb. 2014 Things: A survey of Existing Protocols and Open Research Issues,’’ IEEE
[57] A. Perrig et al., “SPINS: security protocols for sensor networks,” Wireless Commun. Survey Tuts., vol. 17, no. 3, pp. 1294–1312, 3rd Quart., 2015.
Networks, vol. 8, pp. 521–34, 2000. [80] K. T. Nguyen, M. Laurent, and N. Oualha, ‘‘Survey on secure
[58] F. Al-Turjman and S. Alturjman, “Confidential Smart-Sensing Framework communication protocols for the Internet of Things,’’ Ad Hoc Netw., vol. 32,
in the IoT Era”, The Springer Journal of Supercomputing, 2018, doi: pp. 17–31, Sep. 2015.
10.1007/s11227-018-2524-1. [81] IEEE Standard for Local and Metropolitan Area Networks—Part 15.4:
[59] D. Liu, P. Ning, and R. Li, “Establishing pairwise keys in distributed sensor Low-Rate Wireless Personal Area Networks (LR-WPANs), IEEE Std.
networks,” ACM Trans. Inform. System Security (TISSEC), vol. 8, pp. 41–77, 802.15.4-2011 (Revision of IEEE Std. 802.15.4-2006), (2011) 1-314, 2011.
2005. [82] IEEE Standard for Local and Metropolitan Area Networks—Part 15.4:
[60] Y. B. Saied and A. Olivereau, “D-HIP: A distributed key exchange scheme Low-Rate Wireless Personal Area Networks (LR-WPANs) Amendment 1:
for HIP-based Internet of Things,” in WoWMoM, IEEE, 2012, Online MAC Sublayer, IEEE Std. 802.15.4e-2012 (Amendment to IEEE Std. 802.15.4-
published, doi: 10.1109/WoWMoM.2012.6263785 2011), (2012) 1-225, 2012.
[61] R. Hummen, J. Ziegeldorf, H. Shafagh, S. Raza, and K. Wehrle, “Towards [83] N. Kushalnagar, G. Montenegro, and C. Schumacher, “IPv6 over Low-
Viable Certificate-based Authentication for the Internet of Things,” In Proc. Power Wireless Personal Area Networks (6LoWPANs): Overview,
2nd ACM Workshop Hot Topics Wireless Netw. Security Privacy, 2013, pp. 37– Assumptions, Problem Statement, Goals,” RFC 4919, 2007, [Online].
42. Available: https://www.rfc-editor.org/rfc/pdfrfc/rfc4919.txt.pdf.
[62] S. L. Keoh, S. S. Kumar, and O. Garcia-Morchon, “Securing the IP-based [84] G. Montenegro, N. Kushalnagar, J. Hui, and D. Culler, “Transmission of
Internet of Things with DTLS,” WiSec’, Apr. 2013 [Online]. Available: IPv6 Packets Over IEEE 802.15.4 Networks,” RFC 4944, 2007, [Online].
https://www.researchgate.net/profile/Sandeep_Kumar95/publication/2622107 Available: https://www.rfc-editor.org/rfc/pdfrfc/rfc4944.txt.pdf.
19_Securing_the_IP-based_internet_of_things_with_HIP_and_ DTLS/ links/ [85] J. Hui and P. Thubert, “Compression Format for IPv6 Datagrams Over
561e22a808aef097132b3120/Securing-the-IP-based-internet-of-things-with- IEEE 802.15.4-Based Networks,” RFC 6282, 2011, [Online]. Available:
HIP-and-DTLS.pdf. https://www.rfc-editor.org/rfc/pdfrfc/rfc6282.txt.pdf.
[63] R. Hummen, J. Hiller, M. Henze, and K. Wehrle, “Slimfit—A HIP DEX [86] T. Winter, et al., “RPL: IPv6 Routing Protocol for Low-Power and Lossy
Compression Layer for the IP-based Internet of Things,” In Proc. IEEE 9th Int. Networks,” RFC 6550, 2012, [Online]. Available: https://www.rfc-
Conf. WiMob, 2013, pp. 259–266. editor.org/rfc/pdfrfc/rfc6550.txt.pdf.

2327-4662 (c) 2018 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/JIOT.2018.2869847, IEEE Internet of
Things Journal
> REPLACE THIS LINE WITH YOUR PAPER IDENTIFICATION NUMBER (DOUBLE-CLICK HERE TO EDIT) < 13

[87] C. Bormann, A. Castellani, and Z. Shelby, “CoAP: An application protocol Yang Lu (M’18) received his B.S. degree from Jilin University,
for billions of tiny internet nodes,” IEEE Internet Comput., vol. 1, no. 2, pp.
China, in 2004 and the M.S. degree from the University of
62–67, Mar./Apr. 2012.
[88] R. Sandhu, E. J. Coyne, H. L. Feinstein, and C.E. Youman, “Role-based Manchester, UK, in 2006. He is currently pursuing his Ph.D.
access control models,” IEEE Computer, vol. 29, no. 2, pp. 38–47, 1996. degree in ICT (Information and Communication Technology)
[89] S. Papadopoulos, Y. Yang, and D. Papadias, “CADS: Continuous in USA. He is a member of IEEE. He has published research
Authentication on Data Streams,” In Proc. of the 33rd international conference
papers in refereed journals published by major publishers such
on Very large data bases, VLDB Endowment, 2007, pp. 135–146.
[90] R. V. Nehme, E. A. Rundensteiner, and E. Bertino, “A security punctuation as Elsevier, Taylor and Francis, and World Scientific.
framework for enforcing access control on streaming data,” in ICDE, 2008
[91] M. Bagaa et al., “SEDAN: Secure and Efficient Protocol for Data Li Da Xu (M’86–SM’11-F’16) received B.S. degree in
Aggregation in Wireless Sensor Networks,” In Proc. of IEEE LCN. IEEE, 2007,
information science and engineering from the University of
pp. 1053–1060.
[92] L. Hu and D. Evans, “Secure Aggregation for Wireless Networks,” In Science and Technology of China, in 1978, M.S. degree in
Proc. Symposium Applications Internet Workshops, 2003, pp. 384–391. information science and engineering from the University of
[93] T. Mielikainen, “Privacy Problems with Anonymized Transaction Science and Technology of China, in 1981, and Ph.D. degree in
Databases,” In International Conference on Discovery Science, Springer,
systems science and engineering from Portland State
Berlin, Heidelberg, 2004, pp. 219-229.
[94] A. Narayanan and V. Shmatikov, “Obfuscated Databases and Group University, USA, in 1986.
privacy,” In CCS’05: Proc. of the 12th ACM conference on Computer and He is an IEEE Fellow, academician of the European Academy
communications security, 2005, pp. 102–111. of Sciences, and academician of the Russian Academy of
[95] A. van Lamsweerde, “Goal-Oriented Requirements Engineering: A
Engineering (formerly USSR Academy of Engineering). Dr. Xu
Guided Tour,” In Proc. Fifth IEEE Int’l Symp. Requirements Eng., pp. 249-263,
2001. is a 2016 and 2017 Highly Cited Researcher in the field of
[96] H. Mouratidis, P. Giorgini, and G. Manson, “Integrating Security and engineering named by Clarivate Analytics (formerly Thomson
Systems Engineering: Towards the Modelling of Secure Information Systems,” Reuters Intellectual Property & Science).
In Proc. 15th Conf. Advanced Information Systems Eng., pp. 63-78, 2003.
[97] J. Mylopoulos, L. Chung, and B. Nixon, “Representing and using
nonfunctional requirements: a process-oriented approach”, IEEE Trans. on
Software. Engineering, Vol. 18 No. 6, pp. 483-497, Jun. 1992.
[98] A.I. Anton, “Goal Based Requirements Analysis,” In Proc. Second Int’l
Conf. Requirements Eng., ICRE, 1996, pp. 136–144.
[99] C. Kalloniatis, E. Kavakli, and S. Gritzalis, “Addressing privacy
requirements in system design: the pris method,” Requirements Eng., vol. 13,
no. 3, pp. 241–255, 2008.
[100] Y. Chen, H. Chen, A. Gorkhali, Y. Lu, Y. Ma, and L. Li, “Big data
analytics and big data science: a survey,” Journal of Management Analytics,
vol.3, no.1, pp. 1-42, 2016.
[101] I. A. T. Hashem, I. Yaqoob, N. B. Anuar, S. Mokhtar, A. Gani, and S. U.
Khan, “The rise of “big data” on cloud computing: Review and open research
issues,” Information Systems, 47, pp. 98-115, 2015.
[102] J. Gubbi, R. Buyya, S. Marusic, and M. Palaniswami, “Internet of things
(IoT): a vision, architectural elements, and future directions.” Future gener.
Comput. Syst., vol. 29, no. 7, pp. 1645-1660, Sep. 2013.
[103] A. Whitmore, A. Agarwal, and L. D. Xu, “The internet of things—a
survey of topics and trends,” Information Systems Frontiers, vol.17, no.2,
pp.261-274, 2015.
[104] M. R. Palattella et al., “Internet of things in the 5G era: Enablers,
architecture, and business models,” IEEE J. Sel. Areas Commun., vol. 34, no.
3, pp. 510–527, Mar. 2016.
[105] W. H. Chin, F. Zhong, and R. Haines, “Emerging technologies and
research challenges for 5G wireless networks,” IEEE Wireless Commun., vol.
21, no. 2, pp. 106–112, Apr. 2014.
[106] X. Duan and X. Wang, “Authentication handover and privacy protection
in 5G hetnets using software-defined networking,” IEEE Commun. Mag., vol.
53, no. 4, pp. 28–35, Sep. 2015.
[107] F. Al-Turjman, E. Ever, and H. Zahmatkesh, “Small cells in the
forthcoming 5g/iot: traffic modelling and deployment overview”, IEEE
Communications Surveys and Tutorials, 2018. DOI.
10.1109/COMST.2018.2864779.
[108] F. Al-Turjman and S. Alturjman, "Context-sensitive access in industrial
internet of things (iiot) healthcare applications”, IEEE Trans. Ind. Informat.,
2018. DOI. 10.1109/TII.2018.2808190.
[109] L. Li, S. Li, and S. Zhao, “QoS-aware scheduling of services-oriented
internet of things,” IEEE Trans. Ind. Informat., 10(2), pp. 1497-1505, 2014.
[110] Y. Lu, “Blockchain: a survey on functions, applications and open issues,”
J. Ind. Inform. Manag., 2018, online published,
doi.org/10.1142/S242486221850015X.
[111] Y. Lu, “Blockchain and the related issues: a review of current research
topics,” Journal of Management Analytics, 2018, online published,
doi.org/10.1080/23270012.2018.1516523.

2327-4662 (c) 2018 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.