# Analysis of Security Issues and Countermeasures for the Industrial Internet of Things
## 4 Security Countermeasures in IIoT systems
### Support Layer  
The core functionality of this layer is analysis and processing of data received from the network layer. From the architectural analysis (cf. Section 2), we noted that the middleware technology is the base of the support layer. This layer is designed based on the usability of applications and the scale of the number of devices in an IIoT system that satisfies the common service requirements.  
We argue that to design an effective security strategy in this layer, security issues 3 (i.e., flooding attacks), 5 (i.e., impacts on devices' performance), 6 (i.e., device impersonation), 8 (i.e., data confidentiality), 9 (i.e., heterogeneity of networks), and 15 (i.e., cascading services) are necessary address. To address security issue 3, in this layer, lightweight security and privacy-enhanced middleware infrastructure can be employed [158]. The infrastructure uses lightweight symmetric encryption for data and asymmetric encryption for key exchange in Trivial File Transfer Protocol (TFTP). The infrastructure ensures security, privacy, and trust in service compositions by employing a secure TFTP protocol. In an IIoT system, because of its high number of devices and their distributed nature in data processing, sometimes protecting users' confidentiality is more computationally intensive than traditional server-based data processing and computation systems. Towards this, to address security issue 5, a secure and dynamic trust management system can be used [159]. This system helps when building trust-based service composition applications in IIoT systems based on a dynamic trust management protocol, which allows detecting misbehaving nodes that change their behavior more often. This is useful in IIoT systems where a centralized trust management authority may not be present. Furthermore, the system is capable of adaptively adjusting the trust parameters (following the autonomous and independent interactions with objects) in response to dynamically changing systems to maximize application performance, thus, in turn, helping to address data confidentiality from non-trusted entities.  
To address security issue 6, attribute-based signature schemes that support user's privacy can be employed [160]. In this scheme, a service requester is required to generate a signature with attributes (i.e., attribute-based encryption and attribute-based signature) that satisfies certain policies before accessing any information. Therefore, a user is not able to forge or tamper information, nor consume resources using a false signature and attributes that they do not possess. To address security issue 8, policy-based access control mechanisms e.g., [161] can be enforced. The proposed mechanism is based on a role-based access control model. The use of role-based access control has improved service composition and service division by using roles to manage the relationship between subjects and policies. It is beneficial within an organizational context that controls resources locally.  
To address security issue 9, security countermeasures i.e., [154], can be employed. To address security issue 15, strong access control mechanisms can be applied. For this, a hierarchical access control model, e.g., [162], can be exercised. This model proposes an access control technique for resource-limited devices with short processing power and storage capacity. Moreover, the model uses key-based authentication systems to protect the communications of hierarchical data access. The novelty of the proposed model is that the authentication is done using a single key and allows it limited distribution among entities, which further strengthens the resource security and reduces storage costs.