A Novel IoT Framework for Identifying and Mitigating Security Threats

The popularity of Internet of Things (IoT) devices has surged due to their applications in diverse areas such as e-Health, smart vehicles, and smart cities. However, the rapid deployment of these devices has led to an exponential increase in security attacks targeting IoT systems, making security a prime concern for the community. Securing IoT-based systems is challenging because the devices involved are often resource-constrained. Providing security to these systems requires a thorough understanding of their specific security needs, along with a systematic security engineering approach. Previous research lacks a systematic methodology for identifying and implementing security requirements. Therefore, there is a growing demand for a structured approach to identify security requirements, select appropriate algorithms, and ensure their effective implementation. While existing studies have extensively explored IoT security threats, they fall short of offering a structured method to comprehensively address these threats. This paper proposes a comprehensive security engineering framework that systematically identifies security threats by analyzing assets present over various layers of IoT system, considering their diverse roles. It includes creating repositories to identify potential vulnerabilities and applicable threats. Once threats are identified, they are evaluated for their severity level based on risk analysis. Following this, the framework focuses on designing the security solutions, where we proposed to add two new security services namely trust and data freshness besides the existing security services, algorithms are selected to mitigate threats by considering the domain and constraints of the devices involved. Ultimately, the security of the entire system is validated to ensure robustness. Throughout this process, we have developed comprehensive repositories for asset management, vulnerability-threat mapping, and algorithm-threat matching to help identify and analyze security needs and recommend algorithms for implementation.