Anonymity feature for the signature holder’s identity is provisioned by short group signature mechanism. Prominent drawback of this mechanism is that it needed secret key to be stored in all associated devices for anonymizing identity. Limited storage availability with IoT devices was not in favor of this method. Above all this scheme needed very higher number of message exchange for authentication, thereby introducing unnecessary latency.
In Gong et al. [8] made use of remote validation mechanism for identifying node trust as well as for monitoring their behavior. This proposal consists of a model for measurement of trust where behavior of the sensing node data for transmission is considered. Hashing operation is used to prepare a threshold. Its storage was unable to address single point of failure. Observed drawback in a real time environment was pertaining to remote authentication deployment was unable to validate trust level of a node. Similarly, the mechanism could not provide tracking information regarding the associated nodes. Subsequently in order to generate trust threshold, a hash operation is performed and then the hash-value is stored at local server. The aforesaid means is found to be insecure with respect to vulnerability relating to single point of failure. High time and space complexity for processing resultantly makes it unsuitable for resource limited IoT devices.
In [9] the authors have proposed a specific mechanism which was intended for group authentication. Devices were required to be pre authenticated before being deployed in the system. This mechanism comprised of three aspects, namely the device, the group leader and subscriber server. It is mandatory for the device to be pre-registered and also pre-authenticated with the subscriber server for participating in the IoT network. The main drawback was single point of failure as the server was storing all credential and also desired authentication data regarding various groups of IoT devices.
The authors in [10] proposed blockchain technology for handling security issues in IoT. A decentralized authentication method was followed for IoT devices. It had a prominent drawback in terms of interoperability between different interconnected systems. There is a prominent drawback with this system that the devices of one could not be able to communicate with other system devices. Accordingly, this was not very useful for seamless integration between systems where there was requirement to communicate between IoT devices belonging to different systems.
In Feng et al. [11], emphasized regarding remote use of a concept of attestation mechanism for IoT as well as Cyber-Physical Systems. IoT devices being resources constraint, were not able to meet the requirements of complex computations. Accordingly basing upon physical behavior of devices a software based remote authentication method was proposed. This needed storage of hardware properties and other related details of IoT devices on a local server. Whenever a device needs an authentication, corresponding hardware signature of device is matched with the details available at the local server. Further it was observed to be less efficient involving resource constrained devices.
Authors in [12] proposed a two-factor authentication mechanism for IoT devices which was easier for processing. It incorporated authentication details of IoT device along with physical properties of the devices. Along with device identification it was found useful for eliminating any type of physical attack on the device. To name a few, it could be impersonation attack or even side channel attack. Apart from processing latency delay, prominent drawback of this mechanism was dependent on storage of a centralized server.
3.5 Proposed Method for IoT Cloud IAM
A Distributed Ledger is implemented for the establishment of a Blockchain. A blockchain essentially is a decentralized, distributed and also an immutable shared ledger which keeps resources and all transaction within a peer-topeer network. From its structural point of view, it contains interconnected blocks of data which are timestamped and also validated with consensus algorithm. Each block contains a list of all transactions and a hash to the previous block. The blockchain uses Elliptic Curve Cryptography (ECC) and Secured Hashing (SHA-256) cryptographic means to ensure data integrity and authentication. Blockchain stores entire past events of all transactions after due verification. Such verification is done with a majority consensus of miner nodes, which also are used to validate each transaction. Out of the two categories, Private or permissioned Blockchain is used for restricted access to a certain group of participants, whereas Public or permission less Blockchain is open for anyone to access. Permissioned Blockchain is a preferred choice to provide privacy solution implementation and also better access control enforcement.
3.5.1 Distributed Ledger Approach for IoT Security
Both academia and industry have conducted several researches to arrive at a conclusion that Distributed Ledger and Blockchain technology can potentially play a crucial role to manage, control and secure all networked device. Schematic diagram of Blockchain empowered IoT Cloud is depicted at Figure 3.3. Accordingly, this can be seen as a promising security solution to counter the challenges with IoT related security issues. Some vital features of blockchain which are useful for IoT in general and IoT security specifically are described below.
For Addressing: Typically, Blockchain uses 160 bit address. As a standardized cryptographic function in Blockchain, it is capable to address 20 bytes or a 160 bit hash of the public key which is the output of Elliptic Curve Digital Signature Algorithm (ECDSA). Hence it is found to be a better addressing means than IP V6 (128 bit) for provisioning of Global Unique Identifier (GUI) at the time of allocating and assigning address for an IoT device.
Figure 3.3 Blockchain empowered IoT Cloud.
For Authentication: Smart contracts can be deployed with Blockchain to provide authentication using decentralized means. This can also be used to provide authentication to smart devices connected to the IoT system. Inherent advantages of Blockchain can also be suitably utilized for effective authentication establishment.
For Authorization: Using Smart contracts deployed over Blockchain and also integrating multiple smart contracts, effective authorization and access control mechanism for connected IoT devices can be established. This mechanism is found to be faster and efficient compared to commonly used protocols like Oath, Open ID, etc.
For Privacy: Smart contracts are such versatile tools, whereby using this over Blockchain enables ensuring data privacy. This technique can control access by enforcing a designated set of conditions and time to allow or deny access to users or group of users to control the acquired data or even transit data for the IoT system. Smart contracts can also be programmed to decide on patch updation. Using this means, changing of ownership and provisioning of IoT devices are found to be smooth exercises.
For Data Integrity: In a Blockchain based arrangement, the connected IoT devices are cryptographically safeguarded and signed by a verified and legitimate sender who is holding a unique public key and GUID. Secure storage mechanism along with its event time stamping of the distributed ledger facilitates data integrity for the interconnected IoT devices. For example, to maintain data integrity in a distributed system TrustChain is proposed with an aim to perform trusted transactions using blockchain.
For Identity of Things: Blockchain technology can be used to identify IoT devices with a set of attributes. Attribute management for the connected smart devices of IoT system holds a key factor for the Identity and Access Management (IAM). Attributes in terms of deployment location coordinates as registered by GPS, make, model and device serial no of IoT device along with its ownership, change or renovation of ownership play a crucial role with respect to identity of things.
3.5.2
