Keywords: Distributed ledger, Internet of Things, IoT security, cloud IoT, identity and access management
3.1 Introduction
The concept of Internet of Things (IoT), for the first time was proposed in 1999 by Auto-ID laboratory of the Massachusetts Institute of Technology (MIT). IoT extensively uses Machine to Human (M2H) as well as Machine to Machine (M2M) communication models. Various Dedicated Short-Range Communication (DSC) techniques have enabled interconnection of sensors, receivers, actuators and associated computational nodes for IoT devices for exchanging the acquired data. Since inception, IoT has been continuously growing as a technological ecosystem. It is also noticed that IoT devices are generally constrained from high availability of resources point of view. It is observed that the interconnected systems comprise of a huge number of sensing devices which have less memory coupled with smaller processing capability as well as their firmware or driver software are seldom updated. Usually, they are also deployed at physically unsecured, even at public places and left unattended for prolonged duration. Hence there is a definite requirement to secure IoT infrastructure as well as the network. A principal factor in securing an IoT infrastructure is envisaged regarding device identity and mechanisms to authenticate them in the ecosystem. Well known and existing authentication mechanisms require sufficient computing requirement which are generally not possible by the IoT devices. Associated problems such as issues related to authentication, security, data privacy of the IoT devices are increasing with passage of time. In general, huge volume of data is acquired by various sensors and other IoT devices in the IoT system. Such data, if at all saved using a centrally controlled mechanism or under the supervision of a single Trusted Third Party (TTP) administrator, may lead to the data security and privacy issues. To securely control and manage issues of IoT, classical protection mechanisms like cryptographic means and secured communication protocols are insufficient. In order to tackle these problems, there is a requirement of efficient mechanism having distributed storage, thereby avoiding a central point of failure or control. The mechanism should also facilitate secured authentication and access control having capability of sustaining security related attacks on the system.
Similarly, another evolving area, Cloud computing, is also making its presence felt in almost all technical ecosystems. This is also emerging as a vital processing nodal system for IoT. Accordingly, an efficient and robust cloud IoT identity management framework merits its development due to its definite relevance. Due to the above mentioned concepts, systematic analysis with visualization of associated risks with various elements of IoT for identity management is of paramount importance. Visualizing its importance, some research by academia and related developments have been initiated by industries in this regard.
The organization of the rest of the chapter is as follows: Section 3.2 provides details on Internet of Things (IoT) Security. Section 3.3 discusses details on IoT Cloud and Identity related aspects. Section 3.4 elaborates related Developments for Securing IoT for better Identity and Access management. A Distributed Ledger based solution for Identity and Access Management (IAM) security of IoT Cloud is covered in Section 3.5 and Section 3.6 concludes the chapter.
3.2 Internet of Things (IoT) Security
IoT ecosystem essentially comprises of a network of enabled and smart sensing devices. Such devices drive the IoT system by means of data acquired and the purpose it is deployed for. However due to the openness as well as growing popularity and density of the IoT devices, it is generally under continuous scanning by the malicious users. These users try to gather legitimate user credentials and try for intrusion to the IoT ecosystem. Further they fraudulently take control of the devices associated, there by posing a great threat to the system as a whole. Hence there is a need to deliberate on the salient aspects which have an impact on the security of IoT system.
3.2.1 IoT Security Overview
IoT infrastructure and associated services are generally established using network enabled endpoint devices. Such devices function with integrated service platform components that work with similar technology to interact with many communication equipment, computing devices and IT services [1]. The terminal-end device of such system is primarily a TCP/IP network Protocol facilitated & internet enabled computing hardware. This could range from PCs, laptop computers, smart phones, tablet PCs, thin-client machines, network printers to some of the special hardware like IP Phone, IP Camera, smart metering systems, POS terminals, etc. In most cases, these devices are used for sensing and capturing data driving events to further enable their provisioning for various services and applications. In the event of any device of IoT ecosystem being compromised, related service could be controlled by attacker which could result in stealing of sensitive information and may be disrupting the services. For effective functioning of IoT ecosystem, undermentioned security aspects are required to be kept in mind with respect to network operators as well as service providers [2].
1 (i) Availability: To ensure uninterrupted and errorfree communication between endpoint devices and their corresponding services.
2 (ii) Identity: To ensure proper authentication among users, endpoints and the associated services.
3 (iii) Privacy: To ensure prevention of any harm or misuse of the subscribed service-related information as well as end user’s location and data.
4 (iv) Security: To ensure system’s integrity and communication confidentiality to further facilitate verification, monitoring and tracking of user’s activities and corresponding services.
3.2.2 IoT Security Requirements
IoT systems, due to their simultaneous and huge amount of data handling among many users, subsystems and devices are becoming lucrative destination for cyber-attack activities. Such attacks are mainly aimed for mischievously stealing and gaining sensitive system information by eavesdropping. Every connected device of the ecosystem could be potentially leading to some kind of sensitive and critical data of interconnected system of the IoT infrastructure. Due to their multidimensional impact, concerns related to data security are very much relevant and important. Risks associated with the IoT could be much higher as automated processing, decision making and interoperability along with security loopholes can show exponential results towards potential vulnerabilities.
A prominent and essential requirement related to IoT ecosystem is that devices are mandatorily required to be interconnected. Upon these interconnected resources various IoT activities like sensing, communicating and processing are facilitated. IoT system generally acquires information from end-nodes or devices. After acquiring, data is transmitted and processed at certain nodes designated for their processing towards accomplishment of associated complex tasks. The inherent capability of the system must provide security related protection for various applications for secured online transaction, as well as for maintaining data integrity. Accordingly, concerns for the need of a comprehensive, robust and a effectively secured mechanism merit its relevance to the constantly evolving IoT ecosystem.
From the above discussion, broadly the following three objectives for security aspects of IoT and the associated networks have been assessed. Firstly, desired mechanism to protect IoT devices and associated