# Securing the Future of Web-Enabled IoT: A Critical Analysis of Web of Things Security
## 5 Security Analysis of WoT  
### Modeling WoT Architecture  
Before we delve to the WoT threats, we need to realize the building blocks of the WoT architecture. We have used a patterned approach to describe the WoT architecture [43]. Patterns can be used to model and design complex systems as well as improve the quality of systems. They can also be used in describing security solutions in an abstract and generic way. A pattern solution is represented using a UML class diagram. Our WoT architecture is shown in Figure 3[43]. We use UML cardinality in which \"1\" represent a single instance while \"*\" indicate multiple instances. It is worth keeping in mind that the architecture is partial, and we only focus on the components that keep IoT devices up and running over the web. This model is used as a reference to indicate what aspects of the system are threatened by attacks, and where the security aspects can be placed to mitigate attacks. Figure 3: Class diagram of the WoT architecture [43]. In Figure 3, a thing represents a physical entity or multiple IoT devices in a network, which are responsible for collecting data and performing actions. Multiple things can interact with one another, forming a complex web of interconnected devices. The heterogeneity and varying implementations of things introduce distinct security challenges. For instance, things can vary significantly in their capabilities, protocols, and security levels, leading to compatibility issues and inconsistent security enforcement across the system. Connections between various things can create opportunities for attackers to exploit these inconsistencies. For example, a weakly secured thing may act as a vulnerable entry point for an attacker to compromise other things within the network. Such threats can arise from unpatched vulnerabilities, misconfigured permissions, or incompatible security protocols between things. A node device, which can be an edge/fog or cloud server, might manage the interactions of multiple things; each of these things is described by its own thing description, which provides a vocabulary for describing the physical thing in a machine-readable format. Thing descriptions can be implemented over multiple protocols, each requiring a different Binding Template. WoT discovery handles many thing descriptions for various things; when a thing is discovered, its thing description is retrieved by the WoT discovery component. This allows clients or services to understand the capabilities and interaction affordances of the discovered thing. Also, the WoT discovery communicates with the node to register new things that join the network and to query for things based on specific criteria. In this case, the node may act as a client to the discovery service when looking for new devices to manage or integrate. Users send commands to things through the API. Further, we delve into the operational aspects of our WoT architecture to elucidate how the various elements of the WoT architecture interact and coordinate in practical scenarios through illustrative sequence diagrams. The following is a use case scenario for a thing (a sensor) that measures the moisture level of the soil and starts irrigation upon reaching a certain moisture level. Use Case-1 (UC1): Adjust Irrigation  
Summary: The use case shows that an IoT moisture sensor autonomously monitors soil moisture levels, activating an irrigation process through a smart ecosystem when needed. Upon detecting low moisture, the sensor's data prompts either user intervention or triggers an automated response, engaging an irrigation controller to hydrate the soil. In this case, we show the scenario where another thing (controller) initiates an irrigation request based on predefined rules within the node. Figure 4 shows the sequence diagram for the described use case. Figure 4: Sequence diagram for adjust irrigation use case. Actor: The IoT sensor. Precondition: The IoT sensor is monitoring the moisture level in the soil and detects that the soil moisture is below the predetermined threshold.