## 4 End to End Security Analysis on the Proposed IIoT Security Architecture
### Device Layer
#### 4.1.1 Electronic Product Code (EPC)  
Auto-ID Labs, MIT developed electronic product code (EPC), and it is widely used today to issue a unique 64-bit or 96-bit globally unique identifier (GUID) for physical \"things\" [59; 60]. In most cases, EPC uses RFID tags to identify \"things\", although it can also be used with optical data carriers, including linear bar codes, 2D barcodes, and data matrix symbols. Header, EPC manager number, object class, and serial number are the four components of an EPC identifier. The header identifies the length, structure, type, version and generation of the EPC. The EPC manager number is an entity responsible for maintaining the subsequent partitions. In most case refers to the manufacturer or company that produces the product and responsible for attaching the EPC. The object class identities  
\begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Security Requirements** & **Description** & **IIoT Security Properties** \\ \hline \multirow{8}{*}{Confidentially(C)} & & The security defences and mechanisms should be able to: \\  & & \(\bullet\) & Protect the connection between “things”, sensing technologies, communication networks \\  & & \(\bullet\) & Protect data being stored in a data centre or data warehouse (data-at-rest protection) \\  & The protection of IIoT from unauthorized disclosure and access. & \(\bullet\) & Protect data being transmitted to/from “things”, sensing technologies, communication networks and IIoT applications (data-in-transit protection) \\  & & \(\bullet\) & Protect the information that being deliver to end-users, such as an analytical result \\ \hline \multirow{4}{*}{Integrity(I)} & The assurance of IIoT consistency, accuracy, and trustworthiness of data or services over its entire life cycle. & The security mechanisms should be able to detect any data modification and manipulation such as insertion, deletion or replay attacks on the “things” or data of IIoT. \\ \hline \multirow{3}{*}{Authentication(A)} & The assurance that the communicating entity is the one that it claims to be. & The security mechanisms should be able to ensure: \\  & The assurance that the communicating entity is the one that it claims to be. & \(\bullet\) & ”Things” authentication. \\  & & \(\bullet\) & Data-origin authentication \\ \hline \multirow{4}{*}{Authorization and Access Control (A)} & The prevention of unauthorized use of IIoT resources. & The security mechanisms should be able to ensure: \\  & The prevention of unauthorized use of IIoT resources. & \(\bullet\) & Only authorized “things” and users can access IoT networks \\  & & \(\bullet\) & IIoT edge devices are able to verify whether certain entities are authorized to access their measured data \\ \hline Availability (A) & The assurance that the IIoT resources are always available. & The security defences and mechanisms should prevent or detect denial of service attacks on IIoT resources. \\ \hline \hline \end{tabular}
\end{table}
Table 3: CIA+ model of IIoT security.  
a class of objects. The object is a product type, and it most likely refers to the stock keeping unit (SKU) [59; 60].  
Meanwhile, the object name service (ONS) is responsible for handling EPC information lookup services. However, ONS is established under the domain name system and lacks an authorization and authentication mechanism for handling ONS queries. The detailed security analysis of the EPC and its ONS lookup service are summarised in Table 4. Overall, the enforcement of more robust security properties (e.g., MD5 and SHA-1 hashing algorithms) on EPC is currently limited by its very constrained storage and computation power, i.e., less than 1000 bits in EPC Gen2 tags [60]. Subsequently, the scalability and extendibility of ONS and EPC networks issues need to be addressed to support the IIoT applications.