1. Towards a Formal IoT Security Model
- Author
-
Ioannis Kounelis, Tania Martin, Igor Nai Fovino, Stephanie Kerckhof, and Dimitrios Geneiatakis
- Subjects
IoT ,Physics and Astronomy (miscellaneous) ,Computer science ,General Mathematics ,02 engineering and technology ,security ,Computer security ,computer.software_genre ,01 natural sciences ,Universal model ,Task (project management) ,0202 electrical engineering, electronic engineering, information engineering ,Computer Science (miscellaneous) ,Confidentiality ,Security level ,Soundness ,business.industry ,lcsh:Mathematics ,010401 analytical chemistry ,020206 networking & telecommunications ,Computer security model ,Adversary ,lcsh:QA1-939 ,0104 chemical sciences ,cryptographic model ,Chemistry (miscellaneous) ,Internet of Things ,business ,computer - Abstract
The heterogeneity of Internet of Things (IoT) systems has so far prevented the definition of adequate standards, hence making it difficult to compare meaningfully the security degree of diverse architectural choices. This task can be nonetheless achieved with formal methodologies. However, the dedicated IoT literature shows no evidence of a universal model allowing the security evaluation of any arbitrary system. Based on these considerations, we propose a new model that aims at being global and all-encompassing. Our model can be used to fairly analyse the security level of different IoT systems and compare them in a significant way. It is designed to be adaptive with realistic definitions of the adversary’s (1) actions of interacting with IoT systems; (2) capabilities of accessing the data generated by and exchanged in IoT systems with established rules; and (3) objectives of attacking IoT systems according to the four recognised security properties of confidentiality, integrity, availability and soundness. Such a design enables the straightforward characterization of new adversaries. It further helps in providing a fine-grained security evaluation of IoT systems by either accurately describing attacks against the analysed systems or formally proving their guaranteed level of security.
- Published
- 2020