[论文解读] Securing Cloud-Based Internet of Things: Challenges and Mitigations

Nivedita Singh, Rajkumar Buyya+1 more|arXiv (Cornell University)|Feb 1, 2024

IoT and Edge/Fog Computing被引用 5

一句话总结

一篇全面的综述，將基于云的 IoT 设备分为 ten types，映射它们的安全/隐私挑战，调查缓解方法，并概述未解决的问题。

ABSTRACT

The Internet of Things (IoT) has seen remarkable advancements in recent years, leading to a paradigm shift in the digital landscape. However, these technological strides have introduced new challenges, particularly in cybersecurity. IoT devices, inherently connected to the internet, are susceptible to various forms of attacks. Moreover, IoT services often handle sensitive user data, which could be exploited by malicious actors or unauthorized service providers. As IoT ecosystems expand, the convergence of traditional and cloud-based systems presents unique security threats in the absence of uniform regulations. Cloud-based IoT systems, enabled by Platform-as-a-Service (PaaS) and Infrastructure-as-a-Service (IaaS) models, offer flexibility and scalability but also pose additional security risks. The intricate interaction between these systems and traditional IoT devices demands comprehensive strategies to protect data integrity and user privacy. This paper highlights the pressing security concerns associated with the widespread adoption of IoT devices and services. We propose viable solutions to bridge the existing security gaps while anticipating and preparing for future challenges. This paper provides a detailed survey of the key security challenges that IoT services are currently facing. We also suggest proactive strategies to mitigate these risks, thereby strengthening the overall security of IoT devices and services.

研究动机与目标

• Systematically categorize cloud-based IoT devices by purpose to identify security/privacy issues.
• Survey security vulnerabilities and privacy risks across ten IoT categories in cloud integrations.
• Evaluate mitigation approaches and identify gaps requiring further research.
• Assess feasibility of standardized security solutions applicable to multiple IoT categories.

提出的方法

• Classify cloud-based IoT devices into ten categories based on device purpose (Figure 2).
• Examine security/privacy risks for each category (Section V).
• Survey existing mitigation approaches and map them to category-specific issues (Section V-A to V-C).
• Summarize open problems and future research directions (Section V-A3, V-B3).
• Provide a synthesis including a final summary table of content (Section VI).

实验结果

研究问题

• RQ1 RQ1: Can we categorize cloud-based IoT devices by purpose and address their security/privacy issues?
• RQ2 RQ2: What mitigation approaches can address the security/privacy issues in each category?
• RQ3 RQ3: Is a standardized security solution feasible across all ten IoT categories?

主要发现

• The paper proposes a ten-category framework for cloud-based IoT devices to organize security/privacy issues (Figure 2).
• It documents category-specific vulnerabilities such as voice squatting in consumer IoT and remote access/ plaintext APIs in children’s IoT.
• Mitigation approaches discussed include SDN-based DDoS protection, cryptographic/authentication schemes, and privacy-preserving designs (e.g., LOKI).
• The authors identify open problems including trust in cloud providers, firmware vulnerability, lack of standards, and privacy concerns requiring multi-stakeholder collaboration.
• The article provides a concise summary table of the covered content and highlights ongoing and future security challenges in cloud-based IoT.