IoT Security and Privacy Issues
Abeer Assiri Haya Almagwashi
Department of Information Systems Department of Information Systems
King Abdulaziz University King Abdulaziz University
Jeddah, Saudi Arabia Jeddah, Saudi Arabia
<PRESIDIO_ANONYMIZED_EMAIL_ADDRESS>
Abstract— Internet of Things (IoT) represents the future of
technology where objects will be able to communicate with each
other and connect to the internet to create self-configuration,
intelligent system. Beside IoT development benefits, there is still
great doubt about security and privacy which are considered
major challenges facing the adaption and development of IoT
architecture. Security and privacy issues are the most critical
challenge that needs to be addressed in each IoT layer and it is not
fully addressed yet. There have been many studies propose
solutions to address security issues. Protecting IoT require
appropriate security framework that covers all IoT layer-security
issues. This paper presents a review of security and privacy issues
and challenges in IoT. It also shed a light on security requirements
relevant to IoT environment and some proposed solutions.
Keywords-Internet of Things(IoT); security; privacy; IoT
architecture.
I. INTRODUCTION
The Internet of Things (IoT) simply is a collection of many
connectable objects (nodes) that can communicate and share
information to accomplish common tasks. Objects can be a
person, mobile phones, home appliances, doors, cars, animals
or anything else you can imagine. Each object is attached to a
sensor that enables it to connect with the environment. IoT
connects personal, business, industrial, and public-sector
devices to each other, where the information can be sorted,
analyzed, and stored. It has many applications in transportation,
healthcare, energy production, and distribution. ITU-T defines
IoT as: “Global infrastructure for the society, enabling
advanced services by interconnecting (physical and virtual)
things based on existing and evolving interoperable information
and communication technologies.” [1]. IoT represents a new
revolution of the Internet and it will change our daily lifestyle.
It makes intelligent devices around us perform our daily tasks.
In the future, almost all the objects around us will connect to
the internet to communicate. Smart home, smart office, smart
car and smart cities all are new words appeared with IoT.
According to Gartner [2], the number of IoT connected devices
will increase by 2020 from about 25 billion devices to be more
than 50 billion devices. This huge size network with
heterogeneous nature creates new security issues and risks
which increase the targeted surface and allow for attackers to
reach more of personal information from the IoT network that
will facilitate the attacking process. IoT nodes communicate
with each other and connect to the internet with no standard
rules or regulations. This raises many security and privacy
concerns. At the same time, its huge size and heterogeneous
nature create more challenges for proposed solutions.
This paper aim to review the security and privacy issues that
associated with IoT environment. In this paper, we applied a
systematic literature over a set of recent studies about IoT
security and privacy challenges. The review included papers
published between 2011 and 2017 found in the Saudi Digital
Library, Google Scholar and IEEE library using the keywords:
internet of thing challenges, IoT issues, IoT security issues, IoT
security solutions, and IoT security and privacy.
The next section provides a brief introduction to the concept of
IoT and its architecture, then an overview of IoT security at
each architecture layer is discussed in section 3. Section 4
highlights IoT security requirements, challenges, and some
proposed solutions for IoT security challenges. Section 5
provides an overview of the privacy issue in IoT then a
discussion and conclusion.
II. IOT OVERVIEW
A. Evolution
Internet of Things term was proposed in 1999 by Kevin Ashton
at Massachusetts Institute of Technology and IoT began to spread
in markets, but it was limited in use due to low performance of the
network [3]. Sristava in 2011 announced that with RFID, things
tagging can be done using other technologies such as near field
communication (NFC) and QR codes. By 2020 IoT devices will be
more than 50 billion [2]. IoT is a new generation of the internet
where communication goes beyond machine-to- human to a
machine –to- machine. It is a network of objects such as mobile
phones, doors, wearable devices, cars, TV and more. Each device
embedded with sensor and technology like radio frequency
identification (RFID).
IoT transforms the communication model to M2M
communication model. IoT introduced a broader change to the
computing vision, business, health-care sector, industrials and
our daily activities. The current industrial aim is to “connect the
unconnected” which mean every single device around us will
be able to connect and exchange information. However, many
IoT devices with heterogeneous nature and high computational
power make them an easy target for attackers. Security is one
of the major problems faces the IoT growth [4]. A survey
showed that 71% of participants agree that security concerns
have affected the decision of customers of IoT products [5]
978-1-5386-4427-0/18/$31.00 ©2018 IEEE
Authorized licensed use limited to: UNIVERSITY OF IDAHO. Downloaded on April 09,2023 at 12:20:43 UTC from IEEE Xplore. Restrictions apply.
B. IoT Architecture
IoT makes an interconnection between various heterogeneous
objects, so there is a need for a flexible layered architecture.
There is no uniform IoT architecture, but the basic IoT model
has 3-layer architecture, including the application layer, the
network layer, and the perception layer. Each IoT layer
differentiates by its functions and technologies attached with,
so each layer has security issues associated with it [6]. The
layers are:
1. Perception Layer
This layer is known as "sensors layer ". This layer identifies,
gathers, processes data and then send it to the network layer.
It also represents a sensor network and shows IoT node
cooperation in short-range networks. It mostly uses Radio
Frequency Identification (RFID) technology, GPS, and
sensors [7].
2. Network Layer
This layer works on the data routing or data forwarding to
different hubs over IoT and Internet. Switching, cloud
computing platforms, routers and internet gateways are
essential parts of the network layer. It uses some
technologies such as 2G/3G, Satellite Access, LTE, WIFI,
Bluetooth, and ZigBee. Gateways at this layer work as the
interface between nodes by collecting, filtering, and
transmitting data between sensors [7].
3. Application Layer
The purpose of IoT is clearly achieved at this layer by
providing various smart environment applications. Smart
home, smart office, smart city, and smart transportation, etc.
are typical applications of IoT. IoT has a personal
application such as applications of smart wearable devices
or mobile app and industrial applications such as
autonomous vehicles applications [7].
III. IOT SECURITY ISSUES
Confidentiality, integrity, and availability are general security
goals in any system, it is applied also to IoT. IoT has many
limitations which make security a big challenge, such as the
heterogeneous nature of the nodes that has access to the internet
with less embedded protection device [8]. This section provides
an overview of security issues at each IoT layer, then discusses
IoT security requirements and threats and some proposed
solutions for IoT security.
A. Security Issues at each Layer
1. Perception Layer
Usually, the IoT nodes are placed out-door and exist in an
environment that exposes them to physical attacks and to
natural accidents as well. These conditions made IoT nodes
easy targets for physical attacks, for example, an attacker can
tamper with a device element once he gets a physical access
to it. In addition, IoT has a dynamic nature where they need
to be movable in many applications which increase the risk
of such attacks. Moreover, this layer usually consists of
sensors with RFIDs and wireless sensor networks which has
many security problems such as information leakage, replay
attacks, cloning attacks and man-in-the-middle attacks.
Also, the low storage capacity with limited computation
capability, make these nodes vulnerable to many types of
attacks. Examples of such attacks are the replay attack which
can easily exploit the confidentiality of this layer by
spoofing or replaying device information identity. Also,
timing attack where the attacker obtains the encryption key
by analyzing encryption time. Malicious data in this layer
can be generated by attacker nodes which threaten the data
integrity and increase the risk of DoS attack. Most security
issues at this layer can be solved by encryption, stenography,
access control and authentication to confirm sender identity
[9].
2. Network Layer
This layer usually is a target for data eavesdropping, DoS
attacks, illegal access, destruction, viruses attack, Man-inthe-Middle etc. Attackers can analyze the traffic and eaves
dropping to attack the network confidentiality and privacy.
The remote access mechanisms of IoT and data exchange
increase probability of such attacks. The key exchange
mechanism must be in a high-security manner to protect it
from any attacker. Communication in IoT environment
introduces new security issues which are not common in the
Internet. Traditional internet communication is between
human and machines, while in IoT the communication is
between machines. These machines do not follow standard
security protocols for communication and exchange a lot of
sensitive information. Network attackers can gain more
information about the users from his IoT devices and use
that information for criminal activities [10]. In IoT, the
object protection has important as well as the network
protection. Current network protocols produce efficient
protection mechanisms, however, they do not cover the IoT
heterogeneous nature. Objects must be able to know the
current network state and respond to any abnormal
behaviors that may affect their security. Good protocols and
software can help to achieve this level of protection [4].
3. Application Layer
There are many issues at the security of application due to
the lack of standards that manage the interaction and the
applications development process for applications.
Applications with different authentication mechanisms are
difficult to confirm authentication and data privacy. Traffic
management is the responsibility of this layer, which makes
it a target for DoS attack. Also, the great number of
connected devices and generated data can create overhead in
data analysis applications that in turn affects the service
availability. The different user interaction with the
application in IoT must be considered when designing the
applications as well as the amount of data that will be
generated [4].
B. General Security Requirments and Challenges in IoT
The main security requirements of IoT are discussed from
different aspects by [4] [11] [12] [13]. IoT security
requirements can be summarized in five main requirements as
shown in the table1.
Satisfying these requirements is a huge challenge due to the
limitations associated with IoT devices with regards to their
capacity and capability to implement traditional security
solutions.
Authorized licensed use limited to: UNIVERSITY OF IDAHO. Downloaded on April 09,2023 at 12:20:43 UTC from IEEE Xplore. Restrictions apply.
TABLE I. SECURITY REQUIREMENTS IN IOT
Confidentiality Information transmission
 between objects must be
 protected from attackers [11].
Authorization Object privileges should be
 restricted where they can access
 the resources they need for
 specific tasks only [12].
Authenticity The access to the system and
 sensitive information is allowed
 for legal users only [4].
Integrity Ensuring data accuracy and
 completeness and keep it from
 any tampered [13].
Availability To avoid any possible
 operational interruptions or
 failures, the availability and
 continuity of the security
 service must be increased [12].
In addition, there are more challenges facing the achievement
of IoT security requirements mentioned in [4] [11] [13], and
[14] and summarized as follows:
• Date Volume: Even though most of IoT applications
use narrow communication channels, there are many
IoT systems that have a chance of requiring a large
amount of data at the central network [4].
• Constraints in resources: Most nodes in IoT have
low storage and processing capacity so they usually
have low-bandwidth communication channels which
limit the use of some security techniques such as
public key encryption algorithm [14].
• Protection: Since most of RFID systems have a weak
authentication mechanism, it is easy to track tags and
find objects identification. The invader will be able to
read data, modify and even delete data [14].
• Scalability: IoT composed of a massive number of
nodes and it expands with time. Hence, its security
mechanism should be scalable [13].
• Autonomic control: Nodes in IoT should be able to
make connections with each other and configure
themselves to adjust at the platform. So, it must have
some mechanisms and techniques such as selfconfiguring, self-management and self-healing all that
automation make IoT need more control with security
[13].
C. Some proposed solutions for IoT security
There have been some studies aiming to improve IoT security
and to propose solutions to address security issues. Tahir and et
al. in [15] proposed ICMetric framework for securing IoT based
on cryptography keys.
The ICMetric technology adds an additional layer of
cryptographic schemes to solve problems related to key theft,
which can be used for preventing unauthorized access.
ICMetric technology is integrated into a healthcare
environment, for an encryption that allows for the safe and
secure use of electronic devices, which is a crucial
requirement of IoT based healthcare applications. ICMetric
technology also provides protection of data stored on and
transmitted between the devices. Liu et al. in [16] proposed
solution serve IoT security based on the biological immune
system. The proposed solution uses dynamic defense frame of
the internet of thing security, where static security strategies
could be unsuitable. The circular defense proposed with five
links: security threat recognition, risk computation, security
responses, security defense, and finally defense strategy
formulization. The link in the frame is correlated with relative
data of IoT security. Researcher simulated the real IoT
platform by immunity-based antigen and in real IoT detector.
They are emulating the mechanisms which are used to
recognize pathogens in biological systems. Zhou and Chao
[17] developed a security architecture for media-aware traffic,
they designed and evaluated the traffic management scheme.
The media-aware traffic security architecture (MTSA) fulfills
the security requirements for multimedia communication,
computation, and IoT service. Rose [18] described physically
unclonable functions (PUFs) as an example of the
implementation of security primitives and protocols for IoT
devices. He described that in the IoT environment, the PUF has
the potential to provide security enhancements in the form of
robust authentication or secret key generation. Lessa dos Santos
[19] establish an architecture to let IoT limited devices able to
"Datagram Transport Layer Security (DTLS)" with
authentication to communicate with devices on the Internet.
This security architecture for IoT is based on IoT Security
Support Provider (IoTSSP), which is a third-party device, also
on two mechanisms for 6LoWPAN Border Router (6LBR) to
redirect the DTLS handshaking to the IoTSSP. Zegzhda and
Stepanova [20] propose a solution that improves IoT security
using topological sustainability to solve security threats that
aimed to disruption, humiliating or destroying any components
or services in the IoT. The aim is to maintain IoT security using
topological sustainability by preserve adaptive d-regular graph
topology and consider different internet of things requirements
such as restrict computation resources at IoT devices. Raza [21]
implemented Scalable Security with Symmetric Keys, which
introduce a highly scalable and flexible key management
scheme for DTLS security standard for resources-constrained
IoT devices.
All proposed solutions are summarized in table 2 along with
the security requirement that addressed it.
Authorized licensed use limited to: UNIVERSITY OF IDAHO. Downloaded on April 09,2023 at 12:20:43 UTC from IEEE Xplore. Restrictions apply.
 TABLE II. PROPOSED SOLUTIONS FOR IOT SECURITY

Author year Methods for achieving Main Security Requirements covered
 security
 Confidentiality Integrity Authentication Availability
Tahir et al. [15] 2016 ICMetric coupled with CRRP Yes Yes Yes Yes

Liu et al. [16] 2013 IoT dynamic security based on No No No No
 immune system principles
Zhou et al. [17] 2011 Key management, No No Yes No
 watermarking
Lessa dos Santos 2015 ECC cryptography Yes Yes Yes Yes
[19]
Rose [18] 2016 Nano-electronic security Yes No Yes Yes
 primitives
Zegzhda and 2015 Graph topology No Yes No No
Stepanova [20]
Raza et al. [21] 2016 shared keys Yes Yes Yes Yes
IV. IOT PRIVACY ISSUES
Privacy in IoT defined by the Internet security glossary [22]as
"the right of an entity (normally a person), acting in its own
behalf, to determine the degree to which it will interact with its
environment, including the degree to which the entity is willing
to share information about itself with others".
In IoT, the network of devices tries to gain data from the
environment, then broadcast it with some events to the server
that has applications. During all that steps, privacy must be
managed, in the device, storage, communication and while
processing. The privacy with the protection of sensitive
information in IoT was identified as one of the critical issues
that need to be addressed [23].
A. Device Privacy
Sensitive information in IoT could be targeted when
unauthorized access happens in hardware or software. For
example, an invader able to re-program a camera to make it
sends information not to the authorized server only, but to
invaders too.
To provide the privacy in devices, there are many issues must
be addressed, like device location privacy which can be
achieved by Multi-Routing Random Walk Algorithm for
Wireless Sensor Network (WSN), protecting the identification
of device nature that can be achieved by adding noise and
protecting the sensitive information even in case of device theft
by using Quick Response Code technique [23].
B. During Communication Privacy
Data confidentiality when data being transmitted through
network channels commonly achieved using encryption
techniques. Encryption in some cases adds data to packets to
provide tracing property. Communication Protocol for security
can provide some solutions for privacy. Pseudonyms can be
used during communication for encryption that may help to
decrease the vulnerability. Devices should communicate only if
it is necessary, to reduce privacy exposing during
communication. Also, devices must be able to disconnect from
the network if it is inactivity to minimize tracking of location
information. The authorized device only allowed to
communicate and if it is turned on, it must re-authenticate itself
to the network before start dealing with any information [23].
C. Privacy in Storage
To protect information privacy, store only the needed and
important information to keep the least possible amount of
stored information. Information is transported only in case of
"need-to-know". Anonymization could be used to disguise the
identity of the stored information. A database must limit access
to statistical data only. To ensure independency of the output on
other database records, differential privacy can be used or
adding noise technique [23].
D. Privacy at Processing
Personal and sensitive data must be processed in a suitable
manner and for the processing aim only. The acceptance and
the data owner authentication are necessary gained before
exposing personal information to third parties. Digital Rights
Management
Authorized licensed use limited to: UNIVERSITY OF IDAHO. Downloaded on April 09,2023 at 12:20:43 UTC from IEEE Xplore. Restrictions apply.
(DRM) system is a good method that can be used to control
exchanged data rights and defend against illegally processing.
DRM works on the base of devices trusted and secure to be
effective.
The permission and awareness of data owner must be obtained
before processing or even dealing with personal data. User
notification helps to avoid improper use of private data and
sensitive information [23].
V. DISCUSSION
Security and privacy issues has a significant impact on the
adaptation of IoT. The growing research in this area should
consider the security and privacy requirements at each layer and
at each development point and address them. As the number of
connected heterogeneous nodes increase rapidly and most of
the data in the IoT is sensitive and/or personal data, the
challenges facing the complexity of the implementation of
security solutions are rising. IoT is easy to attack at each layer
which makes tackling the security issues a critical area of
research. IoT security main requirements include:
confidentiality, authorization, authenticity, integrity, and
availability. Security challenges in IoT such as service quality,
confidentiality and reliability, confidentiality, managing and
securing big data, software and hardware vulnerability and
creating relevant standards are still open issues and not fully
addressed [9]. Authentication and identification are
fundamental for IoT data privacy, which is also a main security
issue in IoT. However, it faces many neglect while it must be
preserved at each part of IoT. Protecting IoT require appropriate
security frameworks that covers all IoT layer-security issues.
Further research is needed to develop and design proper
security solutions for IoT that considers the limitation of its
devices. In addition, there is a need for developing a holistic
security and privacy frameworks that tackle the identified
issues at each layer and consider influencing factors.
VI. CONCLUSION
This paper provided a short introduction to IoT and its 3-layer
architecture, reviewed the major IoT security challenges and
requirements, highlighted some proposed solutions for security
in IoT and discussed the privacy challenges in the IoT. Security
and privacy challenges can affect the growth of usage of IoT.
There is a need for developing holistic security and privacy
frameworks that considers the challenges in IoT environment
and relevant influencing factors. Also, proposed security
solutions should consider the limitations of IoT devices
resources.
REFERENCES
[1] E. Leloglu, "A Review of Security Concerns in Internet of Things,"
Journal of Computer and Communications, vol. 5, pp. 121-136, 2017.
[2] "Gartner Inc. Press Release," 2014. [Online]. Available:
http://www.gartner.com/newsroom/id/2905717.
[3] J. Singh, T. Pasquier, J. Bacon, H. Ko and D. Eyers, "Twenty Security
Considerations for Cloud-supported Internet of Things," IEEE Internet of
things Journal, vol. 3, 2016.
[4] XHuang, P.Craig and H. Y. Lin, "SecIoT: A Security Framework for the
Internet of Things. Security and Communication Networks," vol. 9, pp.
3083-3094, 2015.
[5] "Capgemini Consulting and Sogeti High Tech Interview,Available at:
http: www.capgeminiconsulting.com".
[6] M. Mohammadi, M. Aledhari, A. Al-Fuqaha, M. Guizani and M. Ayyash,
"Internet of Things: A Survey on Enabling," IEEE, 5 NOV 2015.
[7] L.Atzori, A.Iera, G. Morabito and N. M, "The social internet of things
(siot)–when social networks meet the internet of things: Concept,
architecture and network characterization," Computer Networks,, vol. 56,
no. 3594-3608, 2012.
[8] R. Zejun, L. Xiangang, Y. Runguo and Z. Tao, "Security and privacy on
internet of things," in Electronics Information and Emergency
Communication (ICEIEC), 2017 7th IEEE International Conference, July
2017.
[9] Zhang, Q. Wen and X. D. R, "Application of dynamic variable cipher
security certificate in internet of things," in Int'l Conference on Cloud
Computing and Intelligent Systems (CCIS), 2012.
[10] K.Zhao and LGeo, "A survey on the internet of things security," in
Int'lConf. on Computational Intelligence and Security (CIS)," pp. 663-
667, 2013.
[11] H.Suo, Zou, W. J and J. C.Liu, "Security in the Internet of Things: A
Review," IEEE International Conference on Computer Science and
Electronics Engineering,, Vols. 648-651, pp. 23-25, March 2012.
[12] "Wind River Systems Security in the Internet of Things," 2015. [Online].
Available: http://www.windriver.com/whitepapers/security-in-theinternet-of-things/wr_security-in-the-internet-of-things.pdf.
[13] Nguyen, K. Laurent and O. M, "Survey on Secure Communication,"
Protocols for the Internet of Things. Ad Hoc Networks, vol. 32, pp. 17-
31, 2015.
[14] Arseni, S. Halunga, S.Fratu, O.Vulpe and S. A., "Analysis of the Security
Solutions Implemented in Current Internet of Things Platforms," IEEE
Grid, Cloud & High Performance Computing in Science , Romania, pp.
28-30, 2015.
[15] Tahir, McDonald-Maier and A. Fernando, "A novel ICMetric based
framework for securing the Internet of Things," IEEE International
Conference on Consumer Electronics, pp. 469-470, 2016.
[16] Zhang, C.Liu and Z. H, "A Novel Approach to IoT Security Based on
Immunology," in Ninth International Conference on Computational
Intelligence and Security, 2013.
[17] C. L. and Zhou, "Multimedia traffic security architecture for the internet
of things," vol. 25, no. 3, pp. 35-40, 2011.
[18] Rose, "Security meets nanoelectronics for Internet of things," in
International Great Lakes Symposium on VLSI, 2016.
[19] L. Santos, Guimarães, d. C. Rodrigues, Granville and Tarouco, "A DTLSbased security architecture for the Internet of Things," in IEEE
Symposium on Computers and Communication, 2015.
[20] Stepanova and Zegzhda, "Achieving Internet of Things security via
providing topological sustainability," in Science and Information,
London, 2015.
[21] Raza, L.Seitz, D.Sitenkov and G.Selander, "S3K: Scalable Security With
Symmetric Keys—DTLS Key Establishment for the Internet of Things,"
IEEE Transactions on Automation Science and Engineering, vol. 13, no.
3, 2016.
[22] "RFC 2828, Internet Security Glossary," May 2000. [Online]. Available:
https://www.ietf.org/rfc/rfc2828.txt.
[23] J. S. Kumar and D. R. Patel, "A Survey on Internet of Things: Security
and Privacy Issues," International Journal of Computer Applications , vol.
90, no. 11, 2014. 


. Can you
think of a solution that is not writeen to fix any of the security or privacy issues in this paper? Also,
what are the main security or privacy factors that prevent IoT smart home device
consumers from purchasing more devices?