[Paper Review] IoT Security Challenges and Mitigations: An Introduction

Stuart Millar|arXiv (Cornell University)|Dec 29, 2021

IoT and Edge/Fog Computing4 citations

TL;DR

This paper introduces IoT security challenges arising from device resource constraints and fragmented standards, proposing mitigations like lightweight cryptography, secure routing protocols, and intrusion detection systems (IDS) tailored for IoT. It emphasizes the need for standardized, channel-based security and legislative enforcement to ensure device-level protection in increasingly interconnected environments.

ABSTRACT

The use of IoT in society is perhaps already ubiquitous, with a vast attack surface offering multiple opportunities for malicious actors. This short paper first presents an introduction to IoT and its security issues, including an overview of IoT layer models and topologies, IoT standardisation efforts and protocols. The focus then moves to IoT vulnerabilities and specific suggestions for mitigations. This work's intended audience are those relatively new to IoT though with existing network-related knowledge. It is concluded that device resource constraints and a lack of IoT standards are significant issues. Research opportunities exist to develop efficient IoT IDS and energy-saving cryptography techniques lightweight enough to reasonably deploy. The need for standardised protocols and channel-based security solutions is clear, underpinned by legislative directives to ensure high standards that prevent cost-cutting on the device manufacturing side.

Motivation & Objective

• To identify and analyze key security vulnerabilities in IoT systems due to resource constraints and lack of standardization.
• To propose practical mitigations such as secure routing, end-to-end encryption, and intrusion detection systems (IDS) for IoT environments.
• To highlight the importance of legislative and regulatory frameworks in enforcing minimum security standards for IoT device manufacturers.
• To explore the feasibility of deploying energy-efficient cryptographic techniques and IDS in low-power, memory-constrained IoT devices.
• To address the unique challenges posed by decentralized topologies and device mobility in IoT networks.

Proposed method

• Adopted CISCO’s seven-layer IoT reference model to analyze security across all layers, from perception to application.
• Evaluated existing IoT protocols such as DTLS, IPSec/IKEv2, and Secure Implicit Geographic Forwarding (SIGF) for end-to-end security and DoS resistance.
• Proposed puzzle-based mechanisms and return route checks using cookies to delay state establishment and mitigate DoS attacks.
• Recommended depattern-ing techniques to insert fake packets and disrupt attacker fingerprinting and traffic analysis.
• Advocated for object-based security where data objects are cryptographically signed to ensure authenticity and integrity at the application layer.
• Suggested RFID-specific countermeasures including hash-based key exchange and personal firewalls to filter unauthorized reader requests.

Experimental results

Research questions

• RQ1 How do resource constraints in IoT devices impact the feasibility of deploying traditional security mechanisms like full encryption and complex IDS?
• RQ2 What are the most effective lightweight cryptographic and protocol-based solutions for securing IoT communications under bandwidth and processing limitations?
• RQ3 To what extent can decentralized topologies like mesh networks reduce central points of failure and improve resilience against IoT-specific attacks?
• RQ4 How can intrusion detection systems be adapted to operate efficiently on low-power, memory-constrained IoT nodes?
• RQ5 What role can legislation and regulatory standards play in compelling manufacturers to implement baseline security in IoT devices?

Key findings

• 70% of analyzed IoT devices from major manufacturers used unencrypted network services, exposing sensitive data to remote and local network threats.
• Device-level constraints—such as 8-bit processors, KB-level RAM, and low-power radios—limit the use of computationally intensive security mechanisms like full encryption.
• DTLS and IPSec/IKEv2 were identified as effective countermeasures for DoS attacks through cookie-based return route validation and mutual authentication.
• Secure routing protocols like SIGF reduce risks from sinkhole, HELLO flood, and wormhole attacks by eliminating routing tables, though they remain vulnerable to Sybil and DoS attacks.
• Object-based security, where data objects are digitally signed, enables end-to-end integrity and authenticity verification independent of transport channels.
• Legislative frameworks are essential to enforce minimum security standards, as market forces alone cannot compel manufacturers to prioritize security over cost.