IoT Security and Privacy Regime: Challenges and Solutions Explored

This research project delves into the security and privacy regime of the Internet of Things (IoT), defined as a network of interconnected devices embedded with software, sensors, and connectivity. It highlights the increasing demand for IoT technology and explores associated security and privacy concerns, including identification, localization, tracking, profiling, privacy-violating interactions, lifecycle transitions, inventory attacks, and data linkage. The report structures its analysis through a literature review of past and present research, examining privacy threats like tracking, identification, and profiling, and referencing security principles from organizations like OECD and ISO. It also discusses context and privacy awareness in devices and cryptographic techniques, aiming to address privacy concerns for both end-users and service providers. This document is available on Desklib, where students can find additional resources and solved assignments.

Running head: IOT SECURITY AND PRIVACY REGIME
IOT SECURITY AND PRIVACY REGIME
NAMBURU GOPICHAND
University Name
Author Note:

2
IOT SECURITY AND PRIVACY REGIME
Milestone 1
Executive Summary
The major objective of this research project is to understand about the security and privacy
regime of Internet of Things or IoT. This Internet of Things or IoT can be easily defined as the
network of vehicles, home appliances, physical devices or any other product, which is
subsequently embedded with the software, sensors, electronics, actuators and connectivity, which
help in enabling each and every object in the proper connection and exchanging of data. Due to
the explicit and higher demand of technology, the internet of things is considered to be the best
and the most effective technologies in the entire technological world. However, there are privacy
and security regime within the technology that has made it so popular and well accepted by all.
Relevant details regarding the privacy and security regime are provided within the research
project.

3
IOT SECURITY AND PRIVACY REGIME
Milestone 2
Introduction of problems
Internet of things is widely populated as an emerging internet based information
architecture which provides services such as exchange of facility and goods. It encourages
policymakers and others to develop new and high disruptive digital technologies however some
problems are occurring in security field of Economics, legal norms and Social (Da Xu, He & Li,
2014). The technical factors of IOT are widely available however there is lack of existence of
legal framework. These innovative technologies are raise new safety and privacy concern. Some
of the security and privacy concerns are legitimist and need immediate overlook while taking
care of the innovation, economic growth, consumer choice, entrepreneurialism and price growth.
In this paper, thread is categorized by mainly seven section as identification, Localization and
tracking, Profiling, Privacy-violating interaction and presentation, lifestyle transitions, inventory
attack and linkage to focus on the overlap and dependencies among different challenges (Lee et
al., 2015). Identification signifies the challenges associate with an identifier and the threats of
specific privacy violation context. This privacy concerns are most dominant because it involves
risk of tracking and profiling of individuals. In the information processing phase at the backend,
the information are stored in a resolute place which is situates outside of subject’s control. The
collection and interaction phase is also become the aspect of concern that may impact over the
interconnection identification and thread and evolving technologies. Tracking and localization is
also one of the dominant challenge associate with IOT. This thread implies the possibility of
compromise and record individual’s location through space and time (Gaur et al., 2015).
Tracking is not a new kind of thread as many individuals are already affected through GPS
stalking. However tracking and localization is a vital functionality of IOT. Though it does not
concern with direct compromising of information but IOT technologies will not only support the

4
IOT SECURITY AND PRIVACY REGIME
development of Location Based System and improve their accuracy but also expand those
services to indoor environments e.g. for smart retail. The impact of the evolving feature in IOT
effects the explosion of data source (Baccelli et al., 2014). Profiling signifies the challenges of
compiling information associate with certain individuals in order to gather welfares by
association with other profiles and data. In IOT profiling methods are usually used for
personalization of e-commerce in advertisement, newsletters and recommender system. Profiling
challenges for privacy including data perturbation, anonymization, client-side personalization
and encrypted information (Farooq et al., 2015). Another most occurred problem is privacy
violating interaction where the private information can be compromised through a public
medium. Applications of IOT such as transportation, envision, healthcare and smart retail needs
dense contact with user for efficiency where information is available through smart environment.
However, many third party can observe those mechanism that becomes a highly privacy concern.
Privacy and security can be affected by the smart things from lifecycle transitions. Inventory
attacks are also an emerging challenge associate with the privacy and security concern (Gubbi
et al., 2013). It involves with unauthorized collection of data related to other individual private
things. While linkage associate with the sources reveals (truthful or erroneous) information that
the subject did not disclose to the previously isolated sources.
Structure
This section provides the clear definition of the structure followed in this report. There are
several section of this report for clearly describing the security and privacy regime in IOT. In
every section there is proper heading with suitable subheading to demonstrate the broad about
security and privacy regime associate with IOT. The demonstration of the followed structure is
following-

5
IOT SECURITY AND PRIVACY REGIME
 Executive summary: this section the executive summary is widely described with
specification of the report purpose. This section also describes the broad about the chosen
topic and expected format. In the last part, the problem statements are illustrated.
 Literature review: In the next section, the literature review is illustrated associate with the
privacy and security with help of previous report published in the web. The present and
past research associates with the IOT security, are evaluates. This section presents a
broad about the chosen topic with the help of previous research results.
 Methodology: Then the methodology section describes the methodologies which are used
in the past and present literatures relevant to the chosen topic.
 Next section compromises the methodologies describes in the previous section from
perspective on the efficiency, simplicity, extension into other applications, time saving
when used, cost saving when used, feasibility, connectivity, commercialization issues,
 The chosen methodology is illustrate in this section based on various factors with proper
justifications includes tables and graphs.
 Conclusion: At last the results are concluded in the conclusion section to support your
justification and argument.
Literature Review:
Introduction
The literature review presents a board about the security and privacy regime associate
with IOT (Abomhara & Køien, 2014). This section will be widely discussing about the

6
IOT SECURITY AND PRIVACY REGIME
causalities and associate problems of the IOT. Nowadays we are surrounding with the devices,
this devices are now become essential for every day. Successful implementation of IOT
application is associated with many spectsabd needs huge number of consideration. This aspects
are involves technologies which are utilized in daily life for communication, transfer and
receiving purpose. However with emerging technology the security risks are also increasing. The
seamless interaction between human and such devices are gradually increasing (Rehman et al.,
2016). The security concern is also growing as every device is connected with each other for
communicating and various reasons. Attackers take advantage of this situation to compromise
any system for ant desire or particular goal. To ensure the proper implementation of Internet of
things privacy and security aspects are needs to be measured in order to make those devices
effective and efficient. Every device and system must be secured and must provide embedded
security to user and their personal information (Fan et al., 2014). This paper will discuss about
the security issues of different level of IOT system. It also taking considers of current IOT
structure to elaborates and analyze the security concerns and privacy issues of IOT system.
Past and Present Work
In 2013, Jayavardhana et al “Internet of Things (IoT): A vision, architectural elements,
and future directions”. The ubiquitous detection activated by wireless network technologies
(WSN) covers many areas of modern life (Kumar & Patel, 2014). This paper makes it easier to
understand measure and infer the security and privacy. The information of many individual is
surrounding us in form of text and image which are needs to protect in order to provide a secure
platform. The proliferation of these devices in a communication actuation network creates
Internet of Things (IoT), the actuators and sensors compete perfectly with each other and the
surrounding we are living in (Roman, Zhou & Lopez, 2013). that also develop common

7
IOT SECURITY AND PRIVACY REGIME
operational image known as COP by utilizing share across platform. Where RIFD tags and
integrated system adoption has been enable the wireless technologies to breakthrough typical
communication system. The demand of utilizing sophisticated ingenuity query is growing
dramatically while moving from www to web2 and web3 can also be stays as from static web
page to social network and ubiquitous computer web. That’s also increase the cloud-centric
vision in all over the world for the implementation of IOT (Desai, Sheth & Anantharam, 2015).
The authors conclude our IoT vision by developing the need for convergence of WSN, Internet
and distributed computing directed towards the technology research community. The
proliferation of devices with communication actuation capabilities brings Internet vision closer
to things, where actuation and detection functions blend perfectly in the background and new
functionality is made possible by access to new sources of rich information.
Privacy Threats
In this modern decade, it has been hard to protect data to retain privacy as the internet of
things technologies take over our daily lives (Alrawais et al., 2017). Ziegeldorf’s literature
review enumerates the most common privacy threats in the Internet of Things:
Tracking and Localization: is one of the dominant threats as GPS, internet traffics are
installed in most of the devices which can be utilized to compromise the individual’s location.
Identification is also one of the threats that connects the identifier and capable of
compromising the address and name of a certain individual with a user entity.
Lifecycle transitions: when an IOT devices is sold this is used by some other user
previously. They consider that all the information is deleted before handing the device over such
as Smartphone (Bellavista et al., 2013). Other cases, when user does not use their devices and

8
IOT SECURITY AND PRIVACY REGIME
want to rid of, they delete all the information manually (Jing et al., 2014). However, all
information cannot be deleted by user as smart devices often stores huge amount of data
throughout the lifecycle. This data includes personal image, videos and other information.
Presentation and interaction: refer to numbers of smart things which are interacting with
systems and presenting feedback to users (Datta, Bonnet & Nikaein, 2014). It could lead to a
dominant threat as the data transition between system and user is exchanged.
Profiling: profiling features are mostly used in the newsletter and advertisement for
personalization organizations compile information about individuals to infer interests by
association with other profiles and data sources. This information also can be used to track user
activity and compromise their personal data.
Linkage consist of linking system which associate with linking different systems that
increase the chance of unauthorized access and leaks of private information (Biswas &
Giaffreda, 2014).
Privacy principles:
The OECD and ISO has recognized more over eleven security principle from the charter,
guidelines and rules from the global standard boards associate with the protect privacy. Some of
the applications are directly applicable with IOT such as “consent and choice” which explains
People should not be denied goods or services or offered them on a less preferential basis which
is violated by TOSHIBA (Cirani et al., 2015). Other one is “Right to confidentiality and secrecy
of communications” which is violated by the Samsung in recent year. These causalities are also
reflecting the essence of privacy preserving. There are several approaches explains in many
research paper in order to address the privacy concern of end-user and service provider.

9
IOT SECURITY AND PRIVACY REGIME
Context and Privacy Awareness: Devices such as smart TV, health and fitness associate
devices and wearable technologies are also can propose security risk. The privacy awareness
solution has been focused on end user applications which are used daily for ease the effort or
entertainment. Such devices can compromise personal data (Borgohain, Kumar & Sanyal, 2015).
Recently, a framework has been proposed named SeCoMan to act as a trusted third party
application. However the applications may not be real able protect personal information which it
uses to work effectively such as location information.
Information manipulation and Cryptographic techniques: researchers are spend lot of
years to implement proper privacy preserving schema which are letter delivered as novel.
However, they are not able to propose the perfect solution yet. They faced certain obstacles
because many sensors cannot offer adequate security protocols due to the limited amount of
storage and computation resources.
Data minimization: IOT service provider stores all the relevant data such as user personal
data for the principle of data minimization (Blaauw et al., 2014). They retain this type of data as
much they need them for providing proper services. They should keep this data till they need
them.
Access Control: For addition encryption and privacy awareness access control is one of
the most useful solutions. This approach assist user to manage their own data. CapBAc is an
example which is proposed by the, Hernandez, Moreno and Skarmeta. It is essential to distribute
approach h in which smart things themselves are able to make fine-grained authorization
decisions.

10
IOT SECURITY AND PRIVACY REGIME
There are other proposed solutions that do not fall into the above solution. Hitchhiking
can be a solution. This is a new approach to ensure the anonymity of individuals. This
application assist user to safe-keep their location information (Catarinucci et al., 2015). The
knowledge of user location is particularly unnecessary for most of the application. Hitchhiking
can be used to run that application without compromising the user certain location.
Introspection technique is also an effective approach to protect user personal data. it is
highly applicable to secure the data transition. Introspection technique examines the VM in order
to ensure the security. It closely examines the CPU state of VM, I/O activity and content files
and network information (Karimi & Atkinson, 2013). That is delivered via detects malicious
software and hyper visor on VM. Most of the casualties occur by malicious attacks over the IOT
devices. These aspects are creating risk to user privacy as there is a huge chance of losing
personal information.
Methodology:
To evaluate the limits of security that are potentially violated by the IOT, a systematic
quantitative literature was conducted in order to understand the broad about the security and
privacy regime. This method is very effective and capable of identifying the areas illustrate in the
existing research (Chiang & Zhang, 2016). According to the Byrne and Pickering this method
has exclusive benefits compared to narrative styles. It is effective to identify the areas which are
deeply covered in the research and also reveal the gaps. The approaches taken by this method is
slightly different from typical methods that facilities delivery of new insights.

11
IOT SECURITY AND PRIVACY REGIME
Methodology 1
Figure 1: Choose Databases
(Source: Chi et al., 2014)
Choose Database: previous research paper published in academic journals was collected
from electronics database including web of science, research gate, ScoPus and Google Scholar.
Choose Keyword: keyword used for research were ‘Internet of Things’, ‘IoT’, and a
combination of terms including ‘trust’, ‘privacy’ ,‘awareness’, ‘data’, ‘security’ ‘protection’,
‘preserving’, ‘individual’, ‘private’ and ‘user’.
Choose Time Range: The search results were restricted to papers published between 2013
to current year (Kelly, Suryadevara & Mukhopadhyay, 2013).
Choose Exclusion Criteria: The academic search was restricted to papers published in
English. In addition to the research papers, a search for news stories and privacy reports were
also included in order to accommodate personal privacy violation perspectives. Review papers
were excluded but their reference lists were followed to ensure all the research in this field was
consulted. Searching & Recording: For each collected paper, the following information was
recorded including author(s), year of publication, journal, country where the research was carried
out (Krco, Pokric & Carrez, 2014). Each paper was categorized based on the methods used nd
whether analysis was quantitative, qualitative, or mixed. The rest of the criteria are related to the

12
IOT SECURITY AND PRIVACY REGIME
researched topic, it classifies the application area as home automation, smart cities, smart
manufacturing, health care, automotive, or wearable devices, the type of technology used (RFID,
sensor, nano, or intelligent embedded technology). The privacy protections, threats, violations,
and perceptions for each type of technology were also recorded (Yi, Qin & Li, 2015).
Perceptions were categorized based on Westin’s three categories: fundamentalist, pragmatic, and
unconcerned.
Identifying Patterns: An analysis was carried out to uncover patterns in order to identify
foci, gaps and to make recommendations for future research.
Methodology 2: Making the hardware used for IoT temper resistant:
It is seen that most of the hardware are working in an environment where they are not at
all attended and are subjected to various kinds of security threats. The devices should be kept in
an isolated position so as to allow few designated or authorized person to have physical access to
the device and this is to be done for the IoT devices which are completely unattended (Suo et al.,
2012). Besides this it is very much advantageous to make the IoT devices temper resistant or
temper evident. By this kind of endpoint hardening it is possible to block intruders from reaching
the data which are important. This type of end point security would also be stopping the hackers
in buying the devices and then weaponing them. This type of end point security might include
the use of small simple plastic devices, port locks and camera covers, which lock out USB and
Ethernet ports and cover webcam apertures. Ports locks helps in the prevention of coming of
unwanted malware. The best practice of securing the end point hardening would be by obtaining
the layered approach where the attacker needs to overcome a series of obstacles which are
mainly designed for eth purpose of protecting the devices and the data from any kind of
unwanted access or use (Madakam, Ramaswamy & Tripathi, 2015). In cases when there is a