# Analysis of Security Issues and Countermeasures for the Industrial Internet of Things
## 4 Security Countermeasures in IIoT systems
### Network Layer  
This layer consists of various wired and wireless networks. The major functionality of this layer is to provide seamless communication to other layers. It is also accountable for transferring information from the perception layer to the support layer. The immense heterogeneous networks in this layer are WSNs, WLANs, 3G, 4G, Wi-Fi, Bluetooth, etc. [148]. Figure 7: An outline of a simple trust management process. Returning to our devised security issues, we find that the security issues 1 (i.e., controlling over communication), 2 (i.e., infecting data packets), 3 (i.e., flooding attacks), 9 (i.e., heterogeneity of networks), 10 (i.e., non-trusted network connections), and 11 (i.e., dynamic infrastructure) are major concerns in this layer. To address security issue 1, an attack-resistance trust-management-based routing protocol can be employed [149]. The proposed routing protocol can evaluate propagation reputation in a distributed system using a beta function (i.e., probability density function). This protocol is useful for the IIoT systems where a reliable trust relationship can easily be established among the self-organized nodes that are known to each other and interacted with previously. Further, a context-aware, secure multi-hop routing protocol can also be employed to address the security issue 1 [150]. Nodes need to authenticate themselves before joining a network using multi-level security parameters (e.g., authentication, authorization, and trust) in this routing. The protocol is based on a user-controllable multi-layer (UML)-aware secure algorithm [151], which further enhances IIoT security issues by improving inter-connectivity using trust levels among the devices. It is also useful when applied in IIoT systems, as this protocol reduces significant overhead in the network. In this, users are located at the application layer. The UML layer provides appropriate network addressing by the routing agents. The address unit checks the users' pre-assigned applications and addresses to access a particular resource. The User-Controllable Entry (UCID) and Unique Code Generator (CG) are two modules that also help to verify the pre-assigned applications. To address security issue 2, intrusion detection system (IDS)-based security architecture, e.g., [152], can be used. This architecture provides end-to-end security between two IoT nodes connected in a 6 LoWPAN-based network. To address security issue 3, privacy-preserving data mining (PPDM) techniques can be used [153]. This technique integrates a random number generator in the IoT tag and readers and applies cryptographic one-way hash functions on them; thus, if an IoT node is attacked, it is infeasible to invert the number. This minimizes sensitive data disclosure by a compromised node and thus protects the resources' privacy. A privacy preserved access control protocol [154] can be used to address security issue 9. This protocol helps entities to understand and locate who is collecting and accessing their data and which part of the data is being collected and accessed and at what time it is happening. Using this protocol, a user can separate and place their data in different privacy levels in an IIoT system. Then, according to the data privacy level, they give appropriate access control permission to other users. This helps to balance data authenticity and data integrity in the system. Moreover, the access control permission is performed based on the context-aware k-anonymity technology and role-based (e.g., authority and responsibility) access policies [155], in which access control systems can determine a user's access privileges based on their roles assigned to different privacy levels. To address security issues 10 and 11, secure mobile handshake mechanisms e.g., [156; 157], can be employed. The proposed mechanisms verify insecure mobile nodes over an insecure channel using attribute-based encryption matching handshaking scheme. In this, a node's attributes (e.g., IP-address, location, timestamp, etc.)