# Analysis of Security Issues and Countermeasures for the Industrial Internet of Things
## 4 Security Countermeasures in IIoT systems
### Application Layer  
This layer provides structure, behavior, and interaction of the applications to the end-users. The different functional components of this layer are commerce applications, e.g., smart healthcare, smart grid, and smart logistics. That said, this layer represents the various utilizations to regulate and monitor the connected devices. However, the application layer is likely to target the attackers as this layer provides typical e-commerce services. Furthermore, the application layer strongly depends on various applications, and therefore, security issues in those applications are a major concern. Returning to our devised security issues, the security issues 7 (i.e., privacy disclosure), 9 (i.e., heterogeneity of networks), 12 (i.e., anonymity), 14 (i.e., heterogeneous infrastructure), 15 (i.e., cascading services), and 16 (i.e., the emergence of resources) are significant concerns in this layer. To address security issue 7, a privacy-preserving data mining technique can be employed [163]. This technique helps to minimize sensitive data disclosure and protects sensitive content analysis from attackers in a distributed system, using sensitivity detection, analysis, and a privacy content quantification detection scheme. To address security issue 9, a two-way authentication security scheme can be used [164]. This scheme absorbs the existing Internet standards, specifically the Datagram Transport Layer Security (DTLS) protocol. This scheme further uses a public key cryptography system (e.g., RSA) for securing communications over standard communication stacks that offer UDP/IPv6 networking for 6 LoWPANs. To address security issue 12, an identity-based encryption scheme, e.g., [165], can be used. The usefulness of this scheme is that it uses a secure generic model that helps anonymous communications between the various edge IIoT nodes and WSN. Moreover, this scheme protects the sender's and receiver's anonymities from the malicious actors (e.g., hackers) trying to steal a real identity. Further, to address security issue 14, a distributed capability-based access control (DCapBAC) framework that is used for IoT devices can be employed [166], where the edged IoT devices are capable of being authorized themselves without any centralized control systems. That is, the authorization is performed at the edge devices in real-time, improving the disadvantages of a highly centralized system. A capability can be defined as a communicable token. This token is associated with an object and the corresponding access rights (along with the specified conditions of access). Such a framework also considers context-aware access control based on local conditions, which is highly applicable to IIoT scenarios. This approach, in general, uses public-key cryptography while managing the scalability and interoperability among devices with a strong security foundation. Furthermore, in [166], a highly optimized version of the Elliptic Curve Digital Signature Algorithm (ECDSA) has been implemented inside the end devices (i.e., the edge devices), which ensure end-to-end authentication, integrity, and non-repudiation. In Figure 8, we provide an outline of the process. To address security issue 15, a capability-based delegation model for the federated networks can be employed [167]. This model supports a delegation process that supports a context-aware access control mechanism. The intention of this model reclines in the principle of identity-based access control supported by capability, where capability becomes the pivotal point on access control mechanisms. It also uses an identifier that is used to improve the scalability and control the capability propagation through access control delegation. To address security issue 16, a cryptography-based security mechanism can be used [168]. The proposed security mechanism is based on the public key infrastructure (PKI) that includes a set of roles, policies, and procedures to create, manage, and distribute resources in a large-scale IIoT system.