Internet of Things is an emerging technical ecosystem, composed of heterogeneous technological smart objects which are seamlessly connected to the Internet. Provisioning of high-speed data and bandwidth for connectivity for growing variety of IoT services would increase their exposure for fraudulent activity as well as cyber-attacks. Since security issues are significant for the deployment of many IoT services with its amalgamation with cloud implementation, threats severity and vulnerability associated show multiplying effect. This article highlights the emerging security issues associated with IoT Cloud and specifically addresses the challenges faced due to Identity and Access Control of the IoT Cloud. Internet of Things is getting established as a technological ecosystem enabling application of computing to anything, anywhere, and at any time. For such unique versatility and openness, such interconnected devices and users are vulnerable to cyber-attacks. In such a scenario a small lapse in identity management will have exponential effects from such attacks. In this work, an effort has been done to critically examine aspects of IoT security and particularly regarding identity and access management for IoT over Cloud infrastructure. This chapter analyses the identity and access management challenges in IoT, followed by a proposal of cloud identity management model for IoT using distributed ledger technology.
Keywords: Distributed ledger, Internet of Things, IoT security, cloud IoT, identity and access management
3.1 Introduction
The concept of Internet of Things (IoT), for the first time was proposed in 1999 by Auto-ID laboratory of the Massachusetts Institute of Technology (MIT). IoT extensively uses Machine to Human (M2H) as well as Machine to Machine (M2M) communication models. Various Dedicated Short-Range Communication (DSC) techniques have enabled interconnection of sensors, receivers, actuators and associated computational nodes for IoT devices for exchanging the acquired data. Since inception, IoT has been continuously growing as a technological ecosystem. It is also noticed that IoT devices are generally constrained from high availability of resources point of view. It is observed that the interconnected systems comprise of a huge number of sensing devices which have less memory coupled with smaller processing capability as well as their firmware or driver software are seldom updated. Usually, they are also deployed at physically unsecured, even at public places and left unattended for prolonged duration. Hence there is a definite requirement to secure IoT infrastructure as well as the network. A principal factor in securing an IoT infrastructure is envisaged regarding device identity and mechanisms to authenticate them in the ecosystem. Well known and existing authentication mechanisms require sufficient computing requirement which are generally not possible by the IoT devices. Associated problems such as issues related to authentication, security, data privacy of the IoT devices are increasing with passage of time. In general, huge volume of data is acquired by various sensors and other IoT devices in the IoT system. Such data, if at all saved using a centrally controlled mechanism or under the supervision of a single Trusted Third Party (TTP) administrator, may lead to the data security and privacy issues. To securely control and manage issues of IoT, classical protection mechanisms like cryptographic means and secured communication protocols are insufficient. In order to tackle these problems, there is a requirement of efficient mechanism having distributed storage, thereby avoiding a central point of failure or control. The mechanism should also facilitate secured authentication and access control having capability of sustaining security related attacks on the system.
Similarly, another evolving area, Cloud computing, is also making its presence felt in almost all technical ecosystems. This is also emerging as a vital processing nodal system for IoT. Accordingly, an efficient and robust cloud IoT identity management framework merits its development due to its definite relevance. Due to the above mentioned concepts, systematic analysis with visualization of associated risks with various elements of IoT for identity management is of paramount importance. Visualizing its importance, some research by academia and related developments have been initiated by industries in this regard.
The organization of the rest of the chapter is as follows: Section 3.2 provides details on Internet of Things (IoT) Security. Section 3.3 discusses details on IoT Cloud and Identity related aspects. Section 3.4 elaborates related Developments for Securing IoT for better Identity and Access management. A Distributed Ledger based solution for Identity and Access Management (IAM) security of IoT Cloud is covered in Section 3.5 and Section 3.6 concludes the chapter.
3.2 Internet of Things (IoT) Security
IoT ecosystem essentially comprises of a network of enabled and smart sensing devices. Such devices drive the IoT system by means of data acquired and the purpose it is deployed for. However due to the openness as well as growing popularity and density of the IoT devices, it is generally under continuous scanning by the malicious users. These users try to gather legitimate user credentials and try for intrusion to the IoT ecosystem. Further they fraudulently take control of the devices associated, there by posing a great threat to the system as a whole. Hence there is a need to deliberate on the salient aspects which have an impact on the security of IoT system.
3.2.1 IoT Security Overview
IoT infrastructure and associated services are generally established using network enabled endpoint devices. Such devices function with integrated service platform components that work with similar technology to interact with many communication equipment, computing devices and IT services [1]. The terminal-end device of such system is primarily a TCP/IP network Protocol facilitated & internet enabled computing hardware. This could range from PCs, laptop computers, smart phones, tablet PCs, thin-client machines, network printers to some of the special hardware like IP Phone, IP Camera, smart metering systems, POS terminals, etc. In most cases, these devices are used for sensing and capturing data driving events to further enable their provisioning for various services and applications. In the event of any device of IoT ecosystem being compromised, related service could be controlled by attacker which could result in stealing of sensitive information and may be disrupting the services. For effective functioning of IoT ecosystem, undermentioned security aspects are required to be kept in mind with respect to network operators as well as service providers [2].
1 (i) Availability: To ensure uninterrupted and errorfree communication between endpoint devices and their corresponding services.
2 (ii) Identity: To ensure proper authentication among users, endpoints and the associated services.
3 (iii) Privacy: To ensure prevention of any harm or misuse of the subscribed service-related information as well as end user’s location and data.
4 (iv) Security: To ensure system’s integrity and communication confidentiality to further facilitate verification, monitoring and tracking of user’s activities and corresponding services.
3.2.2 IoT Security Requirements
IoT systems, due to their simultaneous and huge amount of data handling among many users, subsystems and devices are becoming lucrative destination for cyber-attack activities. Such attacks are mainly aimed for mischievously stealing and gaining sensitive system information by eavesdropping. Every connected device of the ecosystem could be potentially leading to some kind of sensitive and critical data of interconnected system of the IoT infrastructure. Due to their multidimensional impact, concerns related to data security are very much relevant and important. Risks associated with the IoT could be much higher as automated processing, decision making and interoperability along with security loopholes can show
