# A Security Framework for the Internet of Things in the Future Internet Architecture
## 4 MobilityFirst-Based IoT Architecture
### Protect IoT through Existing MobilityFirst Network Services  
As shown in Figure 4, the MobilityFirst-based IoT architecture consists of four basic building blocks: _Devices_, _IoT middleware_, _MobilityFirst network_ and _Applications_. Our goal is to provide clean and secure data to various applications/services in the upper layer and make their development/management easy. Thus, as illustrated in Figure 6, we integrate the security/privacy mechanisms into the network, the IoT middleware and the lower layer \"devices\", but not the application layer. The rich in-network services of MobilityFirst enable many powerful functionalities to protect against a wide variety of attacks. For example, the NCRS serves the role of a certificate registration center that associates human-readable names to certificates. This enables various security methods, such as encryption and authentication, to secure the data transmission above the IoT device layer. Together with the security schemes at the device level, which provide secure communication channels between IoT devices and the Internet, the confidentiality of the data flow from the bottom (IoT devices) to the top (applications) can be achieved. Figure 5: MobilityFirst-based unified IoT architecture. Figure 6: Security/privacy mechanisms are introduced into devices, IoT middleware and MobilityFirst network. The security mechanisms enabled by network services, i.e., the GNRS and the NCRS, build a shield against many attacks, such as false registration attacks and device misplacement attacks. _False registration attack_ refers to an adversary registering a device with a fake location. _Misplacement attack_ is another form of attack involving manipulating device location by moving a device to another location without updating the new location. The common characteristic of these two attacks is _location forgery_ and is similar to _GNRS false announcement attack_, which is defined as a network object with identifier \(GUID_{1}\) in network \(NA1\) inserting or updating a GNRS mapping \(<GUID_{1},NA2>\) with wrong network address to the GNRS. Therefore, we can apply the same philosophy of preventing GNRS false announcement attacks to location forgery attacks in the context of the IoT. These protection mechanisms are presented in [37] and hence we will not discuss them in this paper due to the space limitation. Another significant contribution provided by network services is privacy protection, such as GNRS access control discussed in [38]. The access control in the GNRS protects the data privacy, and also increases the difficulty of launching attacks by restricting adversarial access to information that is essential for launching an attack, whatever that attack might be. Access control enforced at the GNRS query is a powerful tool as it can provide the GNRS mapping owner, who is typically the data owner or a surrogate in the context of IoT, the ability of choosing who it is willing to communicate with. With the support of access control in the GNRS, IoT devices or data owners can protect the IoT data's location information contained in the GNRS mappings against unauthorized disclosure, while at the same time ensure the mapping's accessibility to legitimate subscribers or applications. In addition, GNRS access control can support advanced services, such as allowing the mapping owner to decide when and where it is reachable. These fine-grained functionalities provided by GNRS access control make it possible to specify detailed policies/regulations while distributing the data collected by the IoT devices. Our MobilityFirst-based IoT architecture provides a unified solution to solve issues of inter-operability as well as support mobility. Our design also can benefit from many built-in security features of the MobilityFirst network infrastructure. However, this architecture still has some unique security concerns that arise and are related to general security concerns mentioned in Section 3.