# Securing Cloud-Based Internet of Things: Challenges and Mitigations

Nivedita Singh, Rajkumar Buyya, Fellow, IEEE, Hyoungshich Kim Nivedita Singh
and Hyoungshick Kim (corresponding author) are with Sungkyunkwan University in
South Korea. Rajkumar Buyya is with Cloud Computing and Distributed Systems
(CLOUDS) Lab, The University of Melbourne, Australia

###### Abstract

The Internet of Things (IoT) has seen remarkable advancements in recent years,
leading to a paradigm shift in the digital landscape. However, these
technological strides have also brought new challenges, particularly in terms
of cybersecurity. IoT devices are inherently connected to the internet, which
makes them more vulnerable to attack. In addition, IoT services often handle
sensitive user data, which could be misused by malicious actors or
unauthorized service providers. As more mainstream service providers emerge
without uniform regulations, these security risks are expected to escalate
exponentially. The task of maintaining the security of IoT devices while they
interact with cloud services is also challenging. Newer IoT services,
especially those developed and deployed via Platform-as-a-Service (PaaS) and
Infrastructure-as-a-Service (IaaS) models, pose additional security threats.
Although IoT devices are becoming more affordable and ubiquitous, their
growing complexity could expose users to heightened security and privacy
risks. This paper highlights these pressing security concerns associated with
the widespread adoption of IoT devices and services. We propose potential
solutions to bridge the existing security gaps and expect future challenges.
Our approach entails a comprehensive exploration of the key security
challenges that IoT services are currently facing. We also suggest proactive
strategies to mitigate these risks, strengthening the overall security of IoT
devices and services.

###### Index Terms:

Cloud Security, IoT Security, IaaS

##  I Introduction

Internet of Things (IoT) has become an indispensable part of our daily lives,
with its applications ranging from smart home systems, and AI-powered medical
equipment to intelligent agricultural and energy systems and even advancements
in the automotive industry [1]. A significant development in IoT is seen in
health monitoring systems, which have greatly improved the quality of life for
elderly and disabled individuals. Recent incidents, such as the COVID-19
outbreak, have further highlighted the importance and potential of IoT in the
health domain [2]. Despite its numerous benefits, IoT systems come with
inherent limitations, particularly in terms of memory, storage, and
communication capabilities, which have prompted many cloud-based companies to
offer external solutions.

A growing number of third-party service providers are empowering IoT devices
to become smarter by leveraging cloud computing services, such as Amazon Web
Services IoT and Azure IoT. These services provide a spectrum of capabilities,
including data storage, data processing, and application hosting, which can
help IoT devices collect, analyze, and act on data more effectively [3]. As
illustrated in Figure 1, the core components of an IoT cloud system encompass
IoT devices (e.g. temperature sensors, smart air conditioners), an IoT
gateway, the cloud itself, and the consumer. The IoT system is a complex
ecosystem of interconnected components that collect, process, store, and
control data from IoT devices. As depicted in Figure 1, the IoT cloud
ecosystem model showcases the interaction among IoT devices, payment gateways,
the cloud-based infrastructure, and end-users. This interaction is fundamental
to the seamless functioning of the entire system. However, the involvement of
third-party systems plays a crucial role in introducing a new dimension to
this ecosystem, one that demands careful consideration, particularly in terms
of security. For example, inadequately secure third-party systems may lead to
data leaks, compromising the integrity of the IoT ecosystem. Moreover, the
diversity of IoT components introduces additional security challenges as each
component may possess unique vulnerabilities. Consequently prioritizing robust
security measures becomes imperative for ensuring the resilience of IoT
systems, especially since these devices frequently interact with human users
and are sometimes connected to critical infrastructure.

Figure 1: IoT Cloud Ecosystem Model.

Cloud-based IoT has revolutionized our lives, making our homes smarter and
more convenient. However, as this technology expands into more critical life
domains, such as healthcare and transportation, it becomes increasingly
important to address even minor security vulnerabilities. Despite the ongoing
constant efforts by major IT companies, such as Amazon Web Services (AWS),
Microsoft Azure, Google Cloud Platform (GPC), IBM Cloud, and so on, security
remains a notable and significant concern. The security concerns associated
with these systems have garnered significant attention, prompting numerous
researchers seeking to actively identify vulnerabilities in the existing IoT
infrastructure [4, 5, 6, 7, 8, 9, 10]. For example, a hacker could exploit a
vulnerability in a wearable device to gain access to users’ personal health
data. Jin et al. [11] discovered vulnerabilities in 36 cloud-based IoT
devices, including the ‘Hippokura’ medical IoT system, where an attacker could
gain unauthorized access and read conversations between patients and doctors.
Alternatively, an attacker could also hack into a smart car’s system to take
control of the vehicle. For example, the attacker can lure a vehicle to a
different location than the intended one by using a ‘GPS deception attack’
[12]

The integration of IoT cloud systems, which involve continuous two-way
communication, makes them vulnerable to adversarial attacks, eavesdropping,
and packet tampering. These concerns are especially serious when the IoT
devices in question are part of critical systems. For instance, a cyber-attack
on the power grid IoT’s infrastructure may eventually result in widespread
power outages, emphasizing the gravity of these security considerations. Many
different IoT systems serving the same purpose rely on cloud systems, which
poses significant risks of security breaches. The developmental race of IoT
systems often prioritizes cost, with manufacturers frequently overlooking
security aspects. Device security is often neglected because the cloud is seen
as merely a platform. IoT’s unique architecture, complex semantics, syntax,
and constraints introduce new challenges [11]. Although researchers have
attempted to provide comprehensive reviews of vulnerabilities and security
loopholes in IoT cloud systems, there is a lack of frameworks that
systematically categorize IoT cloud security issues. This gap in the
systematic categorization hinders the smoother development of targeted and
effective security measures.

Our work aims to bridge this gap in the literature by providing a
comprehensive review of security issues in cloud-based IoT systems. We
identify persistent security issues across various IoT systems and emphasize
the urgent need to develop mitigation strategies. We also examine available
mitigation approaches and provide a concise overview of current security
challenges. Our review encourages further research into solutions and helps
raise awareness of future security challenges in the rapidly evolving field of
cloud-based IoT systems.

##  II Background

This section delves into the fundamental concepts of IoT and cloud computing.
We explore how these separate domains mutually benefit. However, it is
noteworthy to acknowledge that this integration also brings forth concerns
regarding security and privacy [13].

###  II-A IoT Cloud Ecosystem Model

IoT devices constitute a cohesive system enabling communication between
electronic devices and sensors through the internet, enhancing our daily
lives. Modern IoT cloud systems extend beyond traditional IoT frameworks and
include larger-scale implementations. These systems involve cloud applications
that cater to millions of users and handle vast amounts of data produced by
IoT devices [14]. In this context, the IoT gateway (refer to Figure 1)acts as
a conduit between IoT devices and the cloud, allowing local communication and
data processing at the network edge.

One of the key features of cloud-based IoT systems is their open nature, which
accommodates multiple access points. This openness is facilitated by using
HTTP PUT and GET requests [15]. Any user can enter and access IoT and its data
through these services. Another fundamental component of the IoT cloud system
is the IoT hub, which enables various IoT devices, manufacturers, and users to
join the IoT ecosystem.

####  II-A1 IoT Systems

The concept of IoT revolves around the idea of “smartness,” which refers to
the ability of devices and sensors to autonomously acquire and apply knowledge
[16]. An IoT system is a network of interconnected physical devices, sensors,
and software applications that cooperate to gather, exchange, and analyze
data.

####  II-A2 Cloud Computing in IoT

Cloud computing’s three service models - Infrastructure as a Service (IaaS,
e.g., Amazon Web Services), Platform as a Service (PaaS, e.g., Microsoft
Azure), and Software as a Service (SaaS, e.g., Google Apps) - benefit
standalone IoT devices, depending on their specific requirements and use cases
[17]. Cloud computing is a massive data storage platform for IoT, providing
the necessary scalability, storage, computational power, and infrastructure to
support the extensive data processing and analytics requirements of IoT
applications [18].

###  II-B Literature Review and Surveys on IoT Security and Privacy

Recently, a limited number of research and review papers have addressed IoT
security issues. Notably, papers predating 2015, often neglected the IoT
integration with cloud computing. However, as modern IoT systems typically
rely on cloud computing environments, recent papers include security issues
related to cloud-based IoT see Table I. For instance, Chen et al. [19]
highlighted increasing security risks due to the growing use of IoT devices
and cloud computing in consumer applications.

TABLE I: Comparision with recent surveys. Year |  |  Literature topics
---
IoT Cloud integration | Publication
2015 |  |  IoT security
---
No | [20]
2017 |  |  IoT security
---
No | [21]
2014 |  |  Cloud security
---
No | [22]
2017 |  |  Cloud security
---
No | [23]
2019 |  |  mainstream IoT cloud framework security
---
Yes | [24]
2020 |  |  IoT cloud application security
---
Yes | [25]
2021 |  |  IoT cloud application security
---
Yes | [19]
2023 |  |  IoT cloud application security
---
Yes | [26]
2024 |  |  IoT cloud application security
---
Yes | Our work

They identified common security vulnerabilities, such as weak passwords,
unsecured network communications, and insufficient access controls.
Recommendations included implementing strong security measures and educating
consumers about risks and protective resources. Similarly, Sicari et al. [27]
emphasized the security challenges related to IoT systems. These challenges
extend to forensics [28] and have been comprehensively reviewed by Yasmin et
al. [29]. Similarly, Zhou et al. [30] discussed security and privacy
challenges in cloud-based IoT systems and suggested potential solutions, such
as standardized security and privacy protocols, blockchain integration, and
the use of machine learning and artificial intelligence.

These solutions can help in preserving users’ sensitive data [31]. The
integration of cloud computing and IoT systems is still in its early stages.
Consequently, recent research primarily addresses security issues arising from
IoT integration with cloud servers. As more private players join, new security
challenges arise, many of which have not been comprehensively addressed by
previous research. Modern IoT cloud systems consist of large-scale systems and
cloud applications with millions of users, generating vast data. Protecting
these devices and the generated data presents a significant challenge.

A major issue is the absence of uniform laws and regulations for deployment
and development [32].

The combination of IoT and cloud technology has sparked a revolution in the
production of IoT devices. However, this integration has also led to a
proportional increase in the potential for security vulnerabilities. To
address these concerns and ensure the safety and security of cloud-based IoT
devices, it becomes necessary to categorize the issues into different
sections. This allows for the development of adequate defense mechanisms to
effectively mitigate these vulnerabilities.

##  III Our Contributions

In this article, we offer a comprehensive examination of security concerns
related to cloud-based IoT devices. We have classified these issues into ten
distinct categories based on the purpose of IoT devices. Our rationale behind
this categorization is that each category of cloud-based IoT devices serves a
specific purpose and is accompanied by its own set of security
vulnerabilities.

For instance, we explore the security implications of voice assistant IoT
devices, which are susceptible to voice squatting attacks that can exploit a
users’ voice to carry out malicious activities. Similarly, medical IoT devices
necessitate the storage of sensitive patient information, thereby raising
concerns about the potential leakage of confidential health data. In this
article, we address the following research questions:

RQ1: Can we comprehensively categorize the various cloud-based IoT devices
based on their specific purpose and address their existing or future
security/privacy issues?

RQ2: What mitigation approaches can be employed in each category to address
the above security/privacy issues?

RQ3: Is it feasible to establish standardized security solutions that apply to
all types of cloud-based IoT systems, regardless of their category?

The objective of the research question (RQ1) is to consolidate disparate IoT
devices by categorizing each IoT device according to its specific purpose or
usage. It is important to observe that each distinct cloud-based IoT device
possesses specific features or properties. For example, Wearable IoT devices
typically come in small sizes and are in contact with the customer’s skin,
whereas agriculture IoT devices are connected to heavy agricultural vehicles.
Therefore, if we establish a comprehensive category for each IoT device, it
would greatly facilitate the identification of security and privacy issues
associated with them. We delineated 10 such categories of cloud-based IoT
devices, as illustrated in Figure 2. Subsequently, in the following section,
we discussed the corresponding security and privacy issues in each category.

The next research question (RQ2) endeavors to examine the diverse mitigation
approaches available for tackling the issues outlined in RQ1. Additionally,
the authors sought to determine any remaining gaps in finding solutions for
specific security/privacy issues and identify the open problems requiring
attention from researchers.

Moreover, RQ3 aims to investigate the feasibility of proposing a uniform
security solution applicable to all ten categories of IoT devices and assess
its effectiveness in addressing the issues. Given the global quest for
standardized security solutions across all IoT devices, it is crucial to delve
into this matter. Following the examination of RQ1 and RQ2, it becomes
apparent that if a uniform security solution proves unattainable, identifying
the next best optimal solution becomes imperative.

Figure 2: Article framework.

##  IV Article Organization

The overall structure is depicted in Figure 2, providing a comprehensive
overview of this review. To comprehensively demonstrate the functioning of
cloud-based IoT and highlight areas of maximum security vulnerability, we
present a system model within a framework. To address RQ1, we delineated ten
distinct categories, as illustrated in the second block of Figure 2. The
following blocks subsequently illustrate the examination of security/privacy
risks related to RQ1 and the exploration of mitigation approaches for specific
issues related to RQ2 as outlined in Section V of this article. Finally, in
the last block of Figure 2, we showcase real examples of cloud-based or IoT
devices that aim to address the identified security issues. Additionally,
Section VI is dedicated to addressing and elucidating RQ3.

Towards the conclusion of the article, we have included a summary table that
encapsulates all the content discussed in the article in a concise form.

##  V Categorical study on cloud-based IoT, their security & Privacy
challenges, Mitigation approach and Open Problems

The subsequent section elaborates on the security challenges associated with
each of the ten categories (RQ1) and their corresponding mitigation approaches
(RQ2). Additionally, we have dedicated a section to open problems that
highlight security issues requiring future attention and resolution.

###  V-A Category 1: Consumer-Oriented IoT

####  V-A1 Security challenges

Consumer-oriented devices are designed to improve convenience and streamline
users’ lives, but they also bring forth security and privacy challenges. One
notable security issue in speech-based voice assistant systems is the voice
squatting attack (VSA).

These IoT devices often rely on third-party natural language processing
services, which introduces risks such as security threats and potential data
leaks. IoT vendors commonly outsource natural language processing to third-
party providers, but cloud servers like Amazon and Google may not effectively
identify security vulnerabilities associated with these third-party services.
As a result, malicious apps from third parties can infiltrate users’ phones,
posing a significant risk of stealing sensitive user information.

Precise accuracy in voice command recognition is crucial for reliable
performance in voice-based systems. Attackers can exploit vulnerabilities by
mimicking a user’s voice with certain alterations, potentially leading to
unauthorized access, including for financial accounts. Attackers may also
install malicious apps on users’ phones, increasing the risk of financial loss
[33, 34, 35].

Notable examples of speech-based IoT devices include AI-powered voice
assistants like Google Assistant, Apple’s Siri, and Microsoft’s Cortana. These
devices further emphasize the importance of addressing security issues to
safeguard user privacy and protect against potential attacks. Interoperability
issue and unauthorized access on the interconnected network are other security
issues for cloud-based IoT. Interoperability issue occurs when the device
allows multiple apps to coexist. one such example is Samsung SmartThings,
which is susceptible to 20 different security vulnerabilities [36].

Samsung SmartThings is an IoT device that runs on the Linux operating system
and integrates with popular technologies like ZigBee, Z-wave, and Bluetooth.
However, the regular transmission of information between the server and
connected devices makes the Linux OS of SmartThings a prime target for
attackers [7, 37, 38, 39].

This raises concerns about security breaches and unauthorized access to the
interconnected network. Once attackers gain control of a device, they can
manipulate it remotely, posing risks to data synchronization and the privacy
of exchanged data. Flaws in the app’s source code can grant excessive
privileges to specific apps, potentially enabling spying on the users’ other
installed apps.

Password protection and account security in SmartThings are also concerning,
as the reliance on a single-factor protection mechanism leaves users
vulnerable. Sharing the same Wi-Fi network with an attacker makes it easier
for them to steal passwords and initiate unauthorized actions. Bugs in
SmartThings’s code, varying programming styles, and the utilization of the “If
This, Then That” (IFTTT) platform introduce vulnerabilities and potential
command injection attacks. Concerns over the security of Wi-Fi networks are
heightened by the vulnerabilities inherent in smartThings systems Notably, the
trigger-action rules in the IFTTT platform can be bypassed, conflicts can
arise, and actions may be repeatedly executed, leading to denial of service
attacks. Ensuring robust security measures and addressing these
vulnerabilities is essential to safeguard the integrity and privacy of IoT
systems utilizing SmartThings and the IFTTT platform.

Another significant security concern is the potential for man-in-the-middle
(MITM) attacks in IoT clouds that use a shared private key to encrypt tasks
linked to a specific assistant. In such attacks, hackers can intercept and
decrypt sensitive information exchanged between the IoT cloud and the
assistant, compromising the integrity and confidentiality of the data.

The IoT devices sharing the same network or relying on Wi-Fi are more
susceptible to man-in-the-middle (MITM) attacks [40]. The next security issue
which is data leakage, occurs due to inadequate protection making the devices
susceptible to data extraction via reverse engineering. Notably, crucial
elements such as certificates, keys, algorithms, private authentication, and
other sensitive information are stored within this flash memory (storage
device) device.

A malicious actor who obtains access to confidential encryption data can
readily jeopardize the security of the users’ information [41]. Many IoT
consumer-oriented IoT devices are infected to unprotected debugging interface
vulnerability issue [42]. This issue allows the attacker to exploit for
unauthorized access and misuse.

Many IoT devices are often left unprotected by manufacturers, despite their
intended purpose for device debugging. This oversight exposes a significant
vulnerability, as attackers can easily gain access to the devices’ shell and
manipulate commands or inject malicious instructions, leading to device damage
and, consequently, a breach in security. Data leakage and debugging problems
represent an additional category of security challenges that are causing
apprehension in certain IoT devices, such as smart cameras. [43, 44, 45, 46].

In addition to the above-discussed vulnerabilities, the use of a ‘Hardcoded
password’ is one of the persistent security issues in many IoT devices
including smart cameras. Certain manufacturers employ hardcoded passwords and
authentication software stored in flash memory. However, the lack of adequate
protection for flash memory makes it susceptible to easy cracking. Another
flaw pertains to the hardcoded password itself, which can only be modified by
the manufacturer. Consequently, in unfortunate circumstances where an attacker
obtains the password, updating or resetting the device becomes exceedingly
challenging.

Imperfect authentication mechanism observed in certain cloud-based IoT devices
is primarily attributed to excessive reliance on static identifiers, such as
MAC addresses, for the authentication process. This vulnerability issue can be
exploited to disrupt the connection between the camera and the cloud server.
Moreover, in various instances, there is an absence of authentication in the
data processing from the IoT device like the camera to the cloud which allows
attackers to easily construct URLs to upload videos directly to the cloud. The
insecure communication protocol between the cloud and IoT devices, reliance on
unencrypted HTTP instead of secure HTTPS, and the use of simplistic
proprietary protocols further compromise the systems’ security.

In such scenarios, attackers can intercept communication, decode video
streams, and gain access to sensitive information, such as the SSID and
password of the app used for remote camera connectivity. Another
authentication-related security issue arises due to the use of fixed hash
value, which persists in many current cloud-based IoT devices including hue
light bulb [47]. The vulnerabilities in interconnected devices, which are
essential components of cloud-based IoT systems, are also contributing to the
growing security concerns [48, 49, 50].

The integration of multiple smart IoT devices within the household creates
potential risks of unauthorized access and data breaches. Third-party
companies may exploit these vulnerabilities to intrude upon users’ privacy.
Additionally, the shared usage of devices among different users increases the
likelihood of conflicts and privacy breaches. Furthermore, the failure to
delete user information from the cloud server when a user moves away poses a
persistent risk of information leakage when other users access the device.

Excessive collection of users’ private information also raised security
concerns in many operations cloud-based IoT devices [51, 52]. The device sends
a significant amount of data to the cloud server during its operation.
Additionally, it transmits encrypted data packets whose contents are unknown.
This discrepancy in data size and content raises suspicions about the devices’
communication. Researchers have found that even when restricted to sending
only 20 KB of encrypted data, the server can still trigger emergency
notifications on the users’ mobile app. This suggests that the transmitted
data likely includes the users’ private information collected without explicit
consent. As the device captures human movements and assesses user states based
on lighting conditions, the extensive data received by the cloud server poses
potential privacy breaches. Researchers found this type of excessive data
collection loopholes in ‘Nest smoke alarm’ which is designed to detect smoke
and alert homeowners in case of a potential fire. Addressing these security
issues is crucial to ensure the privacy, integrity, and overall security of
consumer-oriented IoT devices, promoting safer and more trustworthy
experiences for users. We will present some of the available solutions in the
following section.

####  V-A2 Mitigation approaches

As we acknowledge that virtual personal assistants are vulnerable to voice
squatting attacks (VSA) and voice masquerading attacks (VMA). Many solutions
have been proposed so far to mitigate these attacks. Zhang et al. [34]
developed a technique that automatically captures an ongoing masquerading
attack and demonstrates its efficacy for the attack. The author proposed a
context-sensitive detector to evaluate whether an impersonation risk is
present or not and then alert the user once detected.

Fwarz et al. [53] proposed a systems-oriented defense against voice-based
confusion attacks and demonstrated its functionality for Amazon Alexa. Termed
SkillFence by the author, it is a browser extension designed to thwart voice-
based confusion attacks targeting voice assistants, such as Amazon Alexa.
Concurrently, researchers are actively engaged in seeking optimal solutions to
address interoperability challenges in IoT devices, including platforms like
Samsung SmartThings. Similarly, Chatterjee et al. developed a lightweight
identity-based cryptosystem employing a physically unclonable function (PUF)
suitable for IoT to enable secure authentication and message exchange among
the devices [54].

Nazzal et al. propose a multi-stepped categorization of smartThings
vulnerabilities based on the platform’s component, nature of the attack, and
proposed mitigation [55]. Consumer-oriented IoTs are particularly vulnerable
to Distributed Denial of Service (DDoS) attacks, which are currently one of
the most serious virtual threats. For most IoT devices, emerging technologies
like software-defined networking (SDN) can help mitigate DDoS attacks.

One of the mitigation approach for DDoS attack through SDN is flow filtering.
The flow filtering strategy is a straightforward approach for SDN-based
mitigation solutions that blocks malicious flows based on header fields.
However, it may cause delay and bottleneck issues due to statistics gathering
and packet inspection [56, 57, 58]. The honeypot technique is another
mitigation approach that creates a simulated environment to collect
information about malicious traffic and can be used with SDN to update
detection and mitigation policies [59].

Security applications usually adopt rate limiting approach in conjunction with
deep package inspection procedures. The idea implies that to prevent network
overload caused by volumetric attacks, SDN controllers can set a traffic
volume limit and reject subsequent traffic when the limit is reached, often
used in combination with Deep Package Inspection procedures for enhanced
security [59].

Moving Target Defense (MTD), another DDoS mitigation approach that involves
dynamically reconfiguring a network/system based on random values to prevent
attackers from making the system unavailable. This includes techniques such as
randomizing IP and MAC addresses to prevent DDoS attacks. However, there are
concerns about the impact on performance and cost when deploying MTD on large-
scale networks [60, 61].

Moving target defense and Traceback are other two approaches in which the
first one involves dynamically reconfiguring a network to prevent attackers
from making it unavailable [61] and the other Traceback uses the packet header
information to identify an attacker’ origin. SDN’s control plane provides a
holistic view for effective mitigation solutions [62].

Aniruddha et al. proposed the Secure IoT structural design for smart cities as
a whole, which applies to smart homes and the Power Internet of Things (PIoT).
In general, a security framework designed for the Power Internet of Things
(PIoT) is comprised of three layers, including the perception layer, network
layer, and application layer with a hybrid RSA cipher approach [63].

Cryptographic algorithms can prevent security threats to a certain extent for
smart homes or smart cities [64]. The smart home IoT devices are heavily
vulnerable to private and sensitive data of consumers, in this direction
Gerber et al. developed LOKI, an interface that enables control of a smart
home using local information processing and protecting smart home systems from
hacking attacks [65].

####  V-A3 Open problems

Security solutions based on Software-Defined Networking (SDN) have the
potential to address many common issues in IoT, such as DDoS attacks. However,
implementing this approach can be challenging due to the complexity of IoT
environments and the variety of attack techniques employed.

Some open questions still exist regarding security issues in consumer-oriented
cloud-based IoT devices. These include the trustworthiness of cloud service
providers, vulnerability of firmware, lack of standards, privacy concerns, and
complexity of security measures. Addressing these issues will require
collaboration between manufacturers, cloud service providers, policymakers,
and consumers.

###  V-B Category 2: Children’s IoT (Smart Toys)

####  V-B1 Security challenges

Children’s IoTs are specially designed for children’s entertainment,
development, and education consisting of special sensors and firmware to avail
personalized interaction with kids. Regulators prioritize children’s online
privacy by imposing specific requirements, such as confidentiality and
security measures, on online services targeted toward children, as outlined in
the Federal Trade Commission’s COPPA rule [66]. Chu et al. conducted a case
study revealing that the hydrogen tracker, a children’s IoT device, violates
COPPA Rules [8].

Interestingly cloud-based IoT toys are vulnerable not only to children but to
everyone in the home who owns it. The statement ”Someone is watching through
Barbie’s eyes” holds enough significance to warrant sharing it with every
household member, as it highlights the vulnerability at stake [67]. These are
open to eavesdropping attacks by the malicious users [68].

Ling et el. concluded that data security has emerged as a growing concern
regarding Children’s IoT [69].

Jamming attacks is one of the prominent attacks found in entertainment-based
drones where the malicious user intentionally captures and manipulates drone
data via unauthorized transmitting channels [70]. These drones and vibrators
carry privacy concerns too. In this scenario, the attacker can access
sensitive information, the child shared with the toys. In the cloud-based IoT
toys, every video and audio is stored on the cloud server. The hydrogen
tracker, a type of IoT device designed for monitoring a baby’s hydrogen level,
exhibits security vulnerabilities both in its cloud infrastructure and user
applications [5, 8, 67, 71, 72]. The access control mechanism between the
children’s IoT devices and cloud servers exhibits flaws, enabling attackers to
intercept authentication packets exchanged between the IoT and the cloud.
Exploiting this vulnerability, attackers can eavesdrop on sensitive
information, including profile images, and subsequently request the cloud to
access the users’ files. As mentioned and established in the previous section,
the communication between the device and server occurs through the utilization
of HTTP GET and POST requests. Many security issues are reported in the
children’s IoT including the hydrogen tracker, when the POST tokens on the
cloud are to be reused.

For instance, in the hydrogen tracker, whenever the child drinks water, the
user app sends this information to the cloud. Here the attacker can capture
the packets and after pretending as a legitimate user, can reuse the HTTP
header to upload fake content to the cloud which will further affect the
functioning of the hydrogen tracker device. Another security vulnerability
pertains to the inadvertent disclosure of private information through HTTP
response codes.

The URL token for the user pictures contains 12 letters. On the cloud side, it
returns the HTTP 301 response as long as the first three letters pair with the
legitimate token. However, the cloud returns HTTP 404 for the nonexistent
token. This helps to reduce the time to guess the correct tokens. When it is
combined with the two security risks, the attacker can easily use the brute
force attack to exhaust the remaining 9 letters and hence user profile is
leaked.

A notable and crucial security concern lies in the failure to delete expired
files from the cloud, constituting the fourth major concern. There are many
instances where the users’ new profile image remains linked to the previous
image, resulting in a significant privacy breach.

Referring to the security issues for the children’s IoT application side,
researchers primarily acknowledge three main issues.

(1) The primary concern is due to the presence of third-party services
integrated into the user application, posing a substantial security
vulnerability. In the case of the hydrogen tracker mobile app, it utilizes
four third-party analytics and performance monitoring services. Although the
traffic data is encrypted, it remains uncertain whether private data is being
leaked through these services.

(2) Another concern arises from the use of plaintext APIs in applications.
This lack of data encryption during transmission to the cloud server heightens
the risk of privacy breaches, including eavesdropping.

(3) The attacker can obtain the mid packets between the app and the cloud
enabling packet spoof. Spoof packets may change the codes and cause the app to
malfunction. Now the attacker has the ability to intercept the intermediate
packets exchanged between the app and the cloud.

These spoofed packets also allow to leak the other personal data. In a normal
situation, when network errors occur, the user app sends crash reports to
third-party analytics, and this inadvertently exposes personal details such as
name, gender, age, weight, etc. to the third-party developers of IoT devices.
One of the major security issues found in many children’s IoT is remote access
vulnerabilities, where the remote access feature remains enabled even after
the product is released. This oversight provides attackers with an easy entry
point to exploit the device [73]. Furthermore, the use of plaintext API for
communication between the IoT device and the cloud exacerbates the situation,
amplifying the risk of unauthorized interception and data compromise.

A prevalent security issue observed in both consumer-oriented devices and
children’s IoT devices involves the storage of fixed user data in the IoT
memory card, which can be easily accessed by malicious individuals if the card
is detached. This vulnerability raises concerns about the potential exposure
of sensitive user information to unauthorized parties. Having an active
default development account in the IoT device, which grants root privileges
and has vulnerable passwords, presents a major security risk. This allows
attackers to effortlessly access sensitive information and exploit the
devices’ vulnerabilities.

In addition to these existing issues, there are some other critical issues in
children’s IoT devices. In some of the children’s IoT devices, the lack of
protection for the universal asynchronous receiver/transmitter (UART) also
raises security concerns. The UART device, commonly employed for resolving IoT
device problems, utilizes a conventional method. Unfortunately, this also
makes it easy for attackers to manipulate device parameters and extract
sensitive information by exploiting the UART interface [74].

In addition to the previously mentioned security issues, many children’s IoT
devices suffer from security flaws attributed to weak authentication and the
use of plain-text API. These vulnerabilities undermine the overall security of
the devices, making them more susceptible to unauthorized access and potential
data breaches. It is crucial to address these weaknesses by implementing
stronger authentication mechanisms and ensuring secure communication protocols
to protect user data and maintain the integrity of IoT systems.

####  V-B2 Mitigation approaches

Children’s IoT has the potential to collect terabytes of sensitive personal,
contextual, and usage information which may be a subject of cybercrime. Due to
the smart toys’ hardware restrictions, a specific encryption and
authentication mechanism is required. In this direction, Oliva et al. designed
and built specific security mechanisms for the smart toys and also validated
them on the platform [75]. defense.

Children lack an understanding of privacy and online safety, especially in
social media and cloud environments. Huang et al. proposed a model that
somehow puts the obligations for children’s privacy on parents of guardians
and alerts them in case of any violation [76]. Hung et al. present an abstract
forensics investigation framework focused on using non-conventional means that
allow Investigators to successfully “Plan,” “Preserve” “Process” and “Present”
(4P) as a systematic means to conduct digital forensic analysis [77].

####  V-B3 Open problems

Children’s IoT devices inherently come with significant security and privacy
concerns because young children may not fully grasp these vulnerabilities.
Therefore, it is essential that these IoT devices include notifications or
mechanisms that require parental supervision for their operation. Any
forthcoming IoT devices must comply with regulations like COPPA and similar
guidelines specifically designed for Children’s IoT.

###  V-C Category 3: Healthcare IoT and Medical Equipments

####  V-C1 Security challenges

From smart wearable IoT devices, implants, and ingestible electronics to
remote physiological monitoring, IoT technology plays a multifaceted role in
healthcare settings. Post-COVID-19 pandemic, there is a resurgence of interest
in the IoT devices particularly in the healthcare sector. Statistically, IoT
healthcare solutions have demonstrated the potential to dramatically improve
patients’ healthcare and save millions of lives. Some of the examples are
remote patient monitoring (RPM), decentralized clinical trials (DCT) [78],
pulse oximeters, glucometers [79, 80], etc.

These significant shifts in the IoT devices in healthcare have proven to be a
blessing in disguise. However, they also eventually elevate the risk of
cyberattacks targeting interconnected medical devices. A significant number of
cloud-based medical devices transmit data to and from the cloud without
encryption, creating a vulnerability that could enable attackers to manipulate
the data, ultimately jeopardizing the patients’ well-being[81].

Healthcare institutions utilize a range of IoT devices for accurate patient
and asset tracking, commonly referred to as indoor localization facilities in
healthcare [6, 82, 83]. Many security vulnerabilities have been identified in
indoor localization facilities for healthcare within both IoT and cloud server
environments. Broadly there exist primarily two key security concerns. The
first relates to password security, with these devices frequently employing
weak passwords. The second arises from inadequate memory protection measures.
Typically, IoT devices come with a built-in SSH service, with default
passwords that are widely known.

The issue stems from manufacturers and programmers not modifying these default
SSH passwords, making it relatively easy for attackers to crack them. The
second issue of insufficient memory protection arises because these devices
are often deployed in public areas where they can be easily removed and their
data can be read. Manufacturers also store sensitive files in the memory card,
providing attackers with easy access to steal private information.

On the cloud side, there is a solitary security vulnerability where
communication between the cloud and the server takes place using unencrypted
plaintext APIs. Healthcare facilities utilizing indoor localization systems
need to transmit database usernames and table name passwords to the cloud
server every 5-6 seconds, and this information is shared without proper
protection. Attackers can exploit this vulnerability by intercepting data
packets over the network, especially since communication happens via unsecured
Wi-Fi signals, enabling them to access log files stored on the cloud server.
Additionally, attackers could attempt a denial-of-service attack to disrupt
the devices’ functionality [6]. Moreover, cloud-based pulse oximeters and
glucometers, which store health data offline in the absence of the users’
smartphone application, are susceptible to hijacking attacks. In such
scenarios, unauthorized access to all offline readings becomes straightforward
for hackers after obtaining user credentials [84]. Cloud-based health image
IoT systems have reported problems with data integrity, availability, and
confidentiality. These issues mainly stem from the unencrypted processing of
image data between IoT devices and the cloud.

To address this issue, Liu et al. [11] analyzed access policies in 36 IoT
devices, which included medical equipment. The authors discovered several
design deficiencies within medical devices provided by established companies.
As a result of these inaccuracies and various access policy flaws, any user
can gather sensitive health information, including data such as blood
pressure, age, height, and weight, for all consumers of specific medical
equipment companies, such as Biobeat and Hippokkura (used as a case study).

Moreover, a significant number of medical IoT devices are vulnerable to
hardware attacks, where attackers can infiltrate the internal hardware
structure and implant hardware trojans (HTs) during the chip manufacturing
process. These HTs can potentially corrupt data, posing a severe risk to the
functionality and integrity of medical devices, and potentially causing device
damage [85]. In alignment with this, the U.S. Food and Drug Administration
(FDA) has issued numerous reports indicating that tampering with patients’
health data can occur after modifying the hardware of medical IoT devices [86,
87].

Further, the adoption of drones in healthcare services has surged in recent
years, with applications spanning tasks like collecting blood and urine
samples, delivering medications, and supplying essential medical resources,
including during the COVID-19 pandemic [88]. Various types of vulnerability
issues, such as replay, man-in-the-middle, impersonation, and privileged-
insider attacks in drone-aided healthcare services. These attacks are mounted
by malicious attackers due to wireless communication between the deployed
drones and their ground station server. In replay attacks, the attacker
intercepts the communication between the drone and the ground station and
later replies to that communication to deceive one of the parties.

In an MITM attack, a malicious user secretly intercepts and possibly alters
the communication between two parties without their prior knowledge. While
privileged-insider attacks involve a legitimate person with authorized access
to an organization’s resources and information misusing that information
access for malicious purposes. These medical devices not only enable attackers
to compromise security systems but also expose patients’ health data to the
risk of being accessible to the public.

####  V-C2 Mitigation approaches

Alishahi et al. [89] proposed a novel framework for the privacy protection of
indoor positioning information for IoT used in many instances, like hospitals.
It is based on five anonymization techniques k-anonymity, -diversity,
t-closeness, $\alpha$, k-anonymity, and $\delta$-presence. In the proposed
framework, although the LSP cannot find the exact location of the users, it
can provide them with online location services at the same time and publish
the anonymized privacy-protected dataset afterward.

To safeguard the various attacks in drone-aided medical services, it is
crucial to implement reliable authentication, access control, and key
management schemes in the IoD environment. Additionally, incorporating
blockchain mechanisms with authentication deployment can enhance its
robustness against various types of attacks.

To mitigate such issues, Kinsy et al. [90] proposed a robust approach for
guarding against existing and potential communication-based attacks on
implantable medical devices by introducing a secure protocol for authorizing
third-party medical teams to access the internal memory device (IMDs) in the
case of an emergency. The proposed technique, Bulwark, can address Man-In-The-
Middle attacks.

Wazid et al. [88] proposed a private-blockchain-based framework for
establishing secure communication in an IoT-enabled drone-aided healthcare
environment. In this work, blocks containing the predictions related to
medical requirements by the cloud servers in the P2P network are mined,
verified, and then added based on the PBFT consensus algorithm with the voting
mechanism. The security analysis performed on the proposed framework
demonstrates its ability to withstand various potential attacks. Furthermore,
the framework has been practically implemented through a blockchain
simulation.

ML-based approaches are also one of the potential solutions to detect attacks
on healthcare systems. Saeedi et al. demonstrated how a decision tree
algorithm can be used to detect malicious attacks on healthcare IoT devices
[91]. HealthGuard- a novel machine learning-based security framework, that
observes the crucial signs of different connected devices of a medical IoT and
correlates the crucial to understanding the changes in body functions of the
patient to distinguish benign and malicious activities. The authors have used
four different (Artificial Neural Network, Decision Tree, Random Forest,
k-nearest Neighbor) ML-based detection techniques [92].

Srivastava et al. presented an improved method for the secure transmission of
data between a network and storage using lightweight cryptographic techniques,
such as the ARX encryption scheme. The ring signatures have also been
introduced to the communication process, which offers significant privacy
benefits, including Signer’s Anonymity and Signature Correctness [93]. In
addition, the same group of researchers developed GHOSTDAG, a new blockchain
protocol that uses a directed acyclic graph to monitor the health data of
patients remotely. This protocol employs smart contract programs from
blockchain technology to facilitate the monitoring process [94].

The security solutions for hardware attacks are designed to safeguard medical
IoT from hardware-level attacks. Wu and colleagues introduced a ”golden die”
mechanism designed to identify hardware trojans with a substantial footprint,
making them easily distinguishable from the standard base configuration [95].
Finally, it’s worth mentioning that deep learning-based approaches have also
been implemented to enhance the security and resilience of medical IoT devices
[96]. Edge computing, serving as an alternative to cloud-based systems for
processing data nearby, emerges as a promising solution for addressing the
challenges posed by critical IoT devices. Li et al. [97] recognized the
benefits of this approach for medical IoT devices and proposed solutions
incorporating SDN in edge computing in which the IoT devices perform the
authentication by the edge servers. These edge servers are also responsible
for collecting and processing patient data hence avoiding security and privacy
issues that arise from lengthy data movement.

####  V-C3 Open problems

Numerous cloud-based medical IoT devices continue to grapple with security
concerns stemming from inadequate access policies within their cloud services.
The transmission of data between the cloud and IoT devices occurs in
plaintext, thereby enabling malicious actors to intercept their communication.
Privacy-related problems are also prevalent in many medical IoT devices,
exposing patients’ data to unauthorized access. Research efforts are
imperative to address these critical issues.

###  V-D Category 4: Industrial IoT

####  V-D1 Security challenges

Industry 4.0 has transformed the cloud-based Industrial Internet of Things
(IIoT), enabling the integration of data from assets and sensors, even from
systems already in operation on various industry floors, into a cloud server
[98]. Within the realm of the Industrial Internet of Things (IIoT), smart
meters represent an advancing technology used for monitoring a user’s power
consumption.

These meters employ a reader to transmit comprehensive consumption data to the
backend server. [99, 100, 101, 102]. Two significant security concerns
regarding this device have been identified. The first issue pertains to
inadequate internal hardware data protection. Researchers have observed that
because of hardware memory dump and device identity issues, the smart meter
transmits incorrect identity information associated with the energy user.

This situation gives rise to both economic losses and the potential for energy
theft activities [102]. The second concern revolves around unprotected
hardware interfaces. Upon analyzing the devices’ shells, it was discovered
that memory could be readily accessed and modified by reactivating the debug
interface. This vulnerability enables potential attackers to gain access to
memory information through the hardware interface.

In the context of temperature-based control systems, which use an analog
sensor to sense temperature, researchers have also identified intriguing
security issues related to analog signal processing within the IoT [103]. As
this device employs an analog temperature sensor, it can be susceptible to
remote tampering by malicious attackers. The sensor, being a nonlinear
circuit, can have its output altered by electromagnetic interference signals.
This nonlinear physical phenomenon is not unique to this device and is found
in various industrial equipment. Such physical security risks have been
demonstrated in the medical, laboratory, and PID control applications [103].
Numerous IIoTs are vulnerable to Distributed Denial of Service (DDoS) attacks,
which not only interfere with the functioning of crucial infrastructure
systems like power plants, transportation networks, and manufacturing
facilities but also pose safety risks [104].

Cloud-based video surveillance systems, extensively utilized in both
industrial and private settings as a means of crime prevention, have been
found to exhibit several security vulnerabilities. Hutle et al. examined four
video surveillance systems and identified multiple security concerns,
including the utilization of insecure fallback functions, weak passwords,
insecure authentication processes, and the absence of robust security
standards [43].

####  V-D2 Mitigation approaches

The implementation of robust hardware data protection in smart meters is
presently a critical necessity for crafting resilient Industrial Internet of
Things (IoT) devices. In this direction, the Maritsch group proposed a
hardware-secured and transparent multi-stakeholder data exchange framework for
Industrial IoT systems. The framework is crafted to enable secure and
streamlined data sharing among various stakeholders, including manufacturers,
operators, and regulators, all the while maintaining the confidentiality and
integrity of the data.

To accomplish this, the authors propose the use of hardware-based security
modules, such as Trusted Platform Modules (TPMs), to secure the data exchange
process from the local server to the remote server. These modules can be
incorporated into Industrial IoT devices to offer a secure means of storing
and processing sensitive data, including device identities, keys, and
certificates. [105].

Bashir et al. [106] proposed a blockchain-based Shamir’s Threshold
Cryptography (STC) scheme for data protection in IIoT systems. The STC scheme
is designed to provide secure and efficient data sharing among multiple IIoT
devices while preserving data privacy and confidentiality. STC consists of
multiple IIoT devices, a blockchain network, and a trusted authority that
manages the STC keys. The IIoT devices use Shamir’s secret sharing scheme to
split their data into shares, which are then encrypted using the STC scheme
and stored on the blockchain network. The trusted authority manages the keys
and controls access to the data shares. DDoS attacks are another major threat
to industrial IoT, for which many novel approaches have been proposed from
detecting to mitigating it.

Wang et al. propose a method for detecting DDoS attacks within Industrial IoT
devices using a combination of clustering and graph structure features. The
approach involves using unsupervised machine learning algorithms to group the
devices into clusters based on their traffic patterns and then analyzing the
graph structure of the traffic to identify potential DDoS attacks [107].
‘FLEAM’ is another approach to mitigate DDoS attacks by federated learning
[108]. FLEAM consists of a set of edge devices, a coordinator device, and a
cloud server. The edge devices collect data and use machine learning
algorithms to detect anomalous traffic patterns which further indicate a DDoS
attack.

The coordinator device aggregates the data from the edge devices and trains a
global machine-learning model using federated learning techniques. Finally,
the cloud server deploys the trained model to the edge devices, enabling them
to detect and respond to DDoS attacks in real time. Evesti et al. believe that
different IoT, either smart home or smart industry, can be secured via trusted
network edge device [109]. A rectification attack is a type of cyber-attack in
which the attacker can manipulate critical temperature-based control systems.
Hei et al. proposed a prototype design of a low-cost anomaly detector for
critical applications to ensure the integrity of temperature sensor signals
[103].

####  V-D3 Open problems

As the Industrial Internet of Things (IIoT) continues to evolve, emerging
security and vulnerability concerns accompany the introduction of new devices.
In this multifaceted IIoT environment involving multiple stakeholders, the
establishment of transparent data ownership, robust access control policies,
and effective data governance practices becomes imperative. Furthermore, the
efficient handling and analysis of the vast volume of data generated by IoT
devices remain persistent challenges, alongside well-known issues like
interoperability.

###  V-E Category 5: Smart Vehicles’ IoT

####  V-E1 Security challenges

Modern vehicles are experiencing the integration of diverse IoT devices,
establishing connections both within the vehicles themselves and with nearby
devices. These connections give rise to two distinct modes of communication:
vehicle-to-vehicle (V2V) and vehicle-to-internet (V2I). [110]. In connected
vehicle technology, the driving experiences are intensified by stimulating
critical communication and events.

As this technology facilitates communication between neighboring vehicles and
devices, allowing them to exchange crucial information, it also raises
concerns about the potential leakage of sensitive data and poses a privacy
risk. The integration of IoT into the cloud amplifies the vulnerability to
cyberattacks, giving rise to significant concerns, especially in scenarios
involving life-critical systems. In such situations, hackers not only have the
potential to pilfer vehicle data but also to assume complete control over the
vehicles themselves. Furthermore, hackers can infiltrate a car’s secure
sensors, affecting critical functions like airbags, system shutdown, and door-
locking mechanisms. They can also disable the vehicle entirely.

By pilfering data and deploying malicious software updates, they can transmit
false information to drivers, initiate DDoS attacks on vehicle occupants,
unethically reprogram electronic control units (ECUs) with infected software,
and even download inaccurate navigation maps. These attacks have been
categorized into many sections [111].

A data authenticity attack aims to guarantee the integrity of source data by
preventing any unauthorized alterations when data packets are transmitted to
the cloud. On the other hand, an Availability attack encompasses tactics such
as denial of service and channel interference attacks. These assaults exploit
the constraints of bandwidth and transmission power to disrupt the IoV
system’s functioning, causing it to fail [112, 113].

The next category involves Attacks on Authentication, encompassing Sybil
attacks, GPS deception attacks, Masquerading attacks, Wormhole attacks, and
replay attacks. In a Sybil attack, the attacker exploits the dynamic nature of
IoT of vehicle (IoV), where vehicles intermittently and unreliably access IoV.
In the case of Sybil attacks, they exploit the dynamic nature of IoV, making
it easier for attackers to target normal vehicles. GPS deception attacks can
lead to inaccurate location data and unpredictable property damage.
Masquerading attacks involve impersonating a vehicle’s features, making it
simpler for intruders to infiltrate the network. Wormhole attacks conceal the
actual path length between malicious nodes, leading to erroneous routing
algorithms and congestion in the system. In Replay attacks, there’s a
repetitive replay and deletion of numerous messages, resulting in reduced
efficiency and increased bandwidth costs [114].

Data injection attacks represent a grave security concern, posing significant
risks like loss of vehicle control, accidents, and even fatalities. Within the
realm of cloud-based vehicle IoT, these attacks occur when unauthorized access
is gained to the cloud-based system responsible for managing vehicle software
and data. Vulnerabilities arise when the vehicle software or firmware is
outdated or susceptible to known security flaws, or when the cloud-based
service lacks proper security measures. Once access is achieved, attackers can
introduce false or malicious data into the system or modify existing data,
resulting in system malfunctions or unexpected behaviors. For instance, false
data injection into vehicle sensors can lead to misinterpretation of
surroundings and accidents, while altering vehicle software may cause
unpredictable actions like sudden acceleration or breaking. These solutions
present a scenario that must be addressed quickly to harness the full
potential of IoT devices.

####  V-E2 Mitigation approaches

Currently, numerous researchers are putting forth solutions within the
connected car market, and there is ongoing research in various domains of
automotive security. Some of these studies focus on the potential risks
associated with car hacking, while others delve into encryption methods, in-
vehicle network communication modules, and security enhancements for
Electronic Control Units (ECUs). Many researchers are working actively to
tackle the cyber-attack in next-generation automatic cars.

Chen et al. proposed a mitigation approach like ‘secure software development
practices, which includes the adoption of writing secure codes, reviewing,
threat modeling, and vulnerability testing. Secure boot processes and
hardware-based encryption methods can secure the hardware of automotive cars.
Smart vehicles must use network security protocols to prevent unauthorized
access to the car’s communication system [115]. Researchers are delving into
the potential of machine learning and artificial intelligence to improve the
security of smart vehicles.

Girma et al. suggest that incorporating AI/ML technology into IoT security can
help combat emerging cyber threats [116]. The paper proposes several ML/AI
approaches like predictive analysis, threat detection and response, behavior
analysis, and risk assessment which can be used to enhance IoT security. The
authors conclude that by analyzing large amounts of data and detecting
anomalies in real-time, AI/ML algorithms can enhance the security of IoT
devices and the cloud computing environment in which they operate. Blockchain-
based architecture can be another available solution to enhance the security
of smart vehicles. S.Syms argues that as vehicles become increasingly
connected and autonomous, they become more vulnerable to cyber-attacks.

Therefore, they suggest that a distributed ledger technology like blockchain
can provide a secure and tamper-proof platform for managing data in smart
vehicles [117]. The proposed architecture consists of several components,
including a blockchain network, a smart contract layer, and a data management
layer. The blockchain network provides a decentralized and secure platform for
storing and sharing data, while the smart contract layer enables the automated
execution of contracts between different entities in the system. The data
management layer is responsible for managing data storage and access.

Comert et. al. [118] address the problem of false data injection attacks in
connected and automated vehicles, which can compromise the safety and
performance of the vehicle. The authors propose a cloud-based sandboxing
approach to detect and mitigate these attacks. The proposed approach consists
of three main components: a data acquisition module, a cloud-based sandbox,
and a detection module. The data acquisition module collects data from the
sensors and other components of the vehicle, which is then sent to the cloud-
based sandbox for analysis. The sandbox simulates the behavior of the vehicle
and analyzes the incoming data for anomalies that may indicate a false data
injection attack. The detection module then generates an alert if an attack is
detected.

####  V-E3 Open problems

While cloud-based Vehicle IoT (VIoT) and its corresponding security solutions
are still evolving, there remain numerous unanswered questions within this
domain that demand significant attention, especially since they may pertain to
critical life-related issues. The array of adversary issues within cloud-based
vehicle IoT is on the rise, presenting escalating concerns not only for
critical security matters but also for the risk of personal data breaches.
These issues demand substantial attention from researchers.

###  V-F Category 6: Wearable IoT

####  V-F1 Security challenges

Wearable devices are a prominent facet of IoT technology, found in various
forms such as smartwatches, medical patches, fashion items, gaming gadgets,
and VR headsets, often worn close to the body.

Figure 3: Basic architecture for cloud-based wearable IoT device.

The basic architecture of a cloud-based wearable IoT system includes four
layers, namely the wearable device front-end system, the second is
communication system, the third is a cloud support system, and the fourth is
extended user application, as shown in Figure 3. Analyzing the security of
wearable IoT (WIoT) devices is considered a complex task due to their
heterogeneous nature. When we talk about the security issue of WIoT devices,
the three terms are majorly considered i.e., confidentiality, availability,
and integrity collectively called the CIA triad [119].

This IoT poses both security and privacy threats to the consumer because of
their range of functionality and the variety of processes involved in their
operation, including data collection, processing, and storage and transfer -
by, from, and to these smart devices [20]. As these devices are worn on the
body and continuously collect information from the environment, they are
highly conspicuous and easily accessible, especially to potential attackers.
The security and privacy issues of WIoT include three factors. The first one
is device architecture, the second is network connectivity, and the third is
data collected by wearable devices [120]. The device architecture security
issues are considered to be both hardware and software. Due to low-resource
device features (in terms of power source, memory size, and low-bandwidth
communication), it may result in severe security flaws [121].

From the software perspective, the basic operating system used in wearable
devices is highly exposed to known and zero-day vulnerabilities [122].
Software security vulnerabilities also stem from the limited experience of
programmers creating software for wearable IoT devices. Serious bugs in the
software or applications are rarely identified, and the involvement of
multiple parties in the development and deployment of WIoT means that no one
is willing to take responsibility for these flaws. Many IoT devices automate
their functionalities e.g., Google Glass devices, this often makes wearable
devices more exposed to security risks.

Since cloud-based WIoT are connected to the internet, hence they are highly
exposed to traditional attacks like DDoS attacks, data leakage, man-in-the-
middle (MITM) attacks, phishing attacks, eavesdropping, side-channel attacks,
and compromised attacks. These IoT encompass low authentication algorithms,
hence it is quite possible to manipulate and control these devices while
transferring the data. The major concern related to wearable devices is data
collection, storage, and processing. Most of the wearable IoT data includes
personal data that may contain sensitive information about users’ habits, and
situations can become grave, specifically in the case of medical IoT, which
includes a medical history and doctor-patient conversations.

Jin et al. [11] conducted a study focusing on the security vulnerabilities of
medical IoT devices, particularly those utilizing Govee technology and Amazon
cloud services. Their findings revealed that simple modifications to the
devices’ access policies significantly compromised the confidentiality of
doctor-patient communications. This vulnerability was not isolated to Govee
devices alone; the authors identified similar security and privacy issues in a
range of medical equipment, underscoring their susceptibility to cyberattacks.

Apart from major security and privacy concerns, another concern is related to
the theft and loss of wearable IoT devices. The IoT devices contain personally
identifiable information; hence, it is highly risky in case of loss or theft
of the IoT and can be used by attackers to get all the sensitive information,
which is known as identity theft. In short, some of the common security
vulnerability problems with wearable IoT devices include hardcoded password
issues, code injection issues, unsecured API issues, web application
vulnerability issues, and lack of proper encryption in communication [119].

####  V-F2 Mitigation approaches

Well, there is no doubt that it is a complex setting and nightmare as far as
security is concerned. But there has to be a start regarding building security
into solutions and platforms, i.e. within each of the components that make
IoT. Passive and active attacks can exploit security vulnerabilities in
wearables, such as a lack of user authentication. In this direction, Singh et
al. [123] proposed a new authentication protocol called out-of-band biometrics
authentication (OOB-BA) using enhanced out-of-band (e-OOBA) two-factor
biometric authentication to create trust relationships between users and
services and protect users’ data. OOB-BA can provide better security and
minimize information leakage, and it can be an alternative authentication
model for future wearable technology adoption.

Wearable IoT devices include a large number of medical wearable IoT, like
electronic skin patches, ECG, monitors, watches, fit bits, etc. where these
devices are very vulnerable to cyber-attacks. Razaq et al. [124] propose an
”Attack-Surface-Reduction by Design” approach to mitigate security risks,
which includes three components. (1) Network Traffic Analysis: The framework
uses network traffic analysis to detect anomalies in IoMT device
communications. Specifically, it applies machine learning techniques to
identify patterns of behavior that are indicative of an attack.

(2) Attack Surface Reduction by Design: The authors propose a set of
guidelines for reducing the attack surface of IoMT devices. This includes
hardening the devices’ firmware and software, limiting the devices’
functionality to only what is necessary, and ensuring that only authorized
users can access the devices. (3) Forensics: The framework includes a forensic
component to aid in the investigation of security incidents. This component
uses digital forensics techniques to gather evidence of an attack and
reconstruct the sequence of events leading up to the attack.

Overall, the proposed framework aims to increase the security of networked
medical devices and reduce the risk of cyber-attacks that could compromise
patient safety and privacy [116]. To mitigate the issue in case of device
loss/theft, Bhatia et al. proposed a soft computing approach for mitigating
real-time abuse in IoT systems by detecting and predicting anomalies. The
proposed approach uses a hybrid model that combines an online clustering
algorithm with a time-series prediction model. The online clustering algorithm
is used to identify anomalous data points in real-time, while the time-series
prediction model is used to predict future values of the IoT data [125].

Since these devices hold sensitive data, they need a strong authentication
mechanism to make them more secure. One possible mitigation approach can be
continuous authentication which is possible in the case of skin-attached
Medical wearable equipment. Zhao et al proposed a continuous authentication
system based on cardiac biometrics measured from wrist-worn wearables. This
approach aims to address the limitations of traditional authentication methods
by using a biometric that is difficult to forge or steal and can be watched
continuously without causing inconvenience to the user. The proposed system
uses machine learning algorithms to classify the users’ cardiac biometrics and
authenticate the user in real time.

####  V-F3 Open problems

Wearable devices, which are in close proximity to the human body, store a
wealth of user information, including personal biomedical data. The leakage of
such sensitive biomedical information represents a significant concern among
the various security issues associated with these contemporary wearable
devices. Thus, addressing this issue should be a top priority for researchers.

###  V-G Category 7: IoT in Smart Retail and Supply Chain

####  V-G1 Security challenges

The new era of IoT can break the boundaries between brand, product, and
customer. It’s an interesting fact that many brands have already started
turning to IoT in retail which is expected to grow to $94.44 billion by 2025.
In the new era of modern society, retailers are adding smart systems to meet
consumer demand and keep the business agile, whether it is the contactless
point of sale (POS), system, or mobile transactions. Some of the examples
include Smart shelves, Starbucks IoT beacons, fruits and vegetable sales
system [126, 127] etc.

The security risks in the RIoT can be the rising threat of complex
cyberattacks, risk of brand damage, risk of customer loyalty loss if a major
cyber breach occurs, poor visibility of retail IoT and building management
systems, and loss of customer satisfaction linked to operational resiliency
[128]. The utilization of payment platforms like Apple Pay and Google Pay by
major retail companies is causing concerns about cyberattacks and potential
financial losses.it is a noted fact that since 2005, retailers have seen over
10,000 data breaches, mainly due to flaws and vulnerabilities in the payment
system [129]. POS systems frequently utilize a plethora of external hardware,
software, and cloud-based equipment. security vulnerabilities can explode at
any instance and thus it is very cumbersome to tackle RIoT security on a
device-by-device basis.

Cybercriminals have numerous opportunities to exploit retail systems, whether
it’s at the vendor’s source or during on-site technology deployment.
Exploiting a security issue in the software used on point-of-sale devices or
the cloud server could allow the deployment of malware or infected software.
This act not only damages the retail system but can also extract all the
financial information of the customer paying on the POS. This threat may lead
to reputational damage to the brand or the company.

Given that RIoT enhances the customer-brand relationship through purchase
history tracking, attackers might exploit this to access customers’ private
information, which could lead to financial losses and strain the brand-
customer relationship. unreliable code/software of RIoT introduces an
additional layer of security risk, as attackers can easily manipulate the code
to access sensitive information. The other security threat is due to the
surveillance system of RIoT. We know that the RIoT tracks the customers’
movement and purchasing habits, here deliberately as the purchasing behavior
Catenated with consumers’ movement can reveal extremely private habits.
Ransomware attacks are also prevailing in the supply chain networks, due to
overlapping security systems [130]. The ransom is lowest for a hub and spoke
network and highest for a line network.

Supply chain attacks are adversarial attacks on supply chain methods. In
supply chain systems, several IoT act as a network connected sensors that may
be part of cyber-physical. Hence each IoT is being treated as a new door for
adversaries [131, 132]. It is conceivable that this could lead to supply chain
attacks, as the same type of attack that caused a single disruption in
production could potentially be employed to impact and disrupt an entire
supply chain simultaneously. Retail IoT systems are also vulnerable to DDoS
attacks, which can cause disruption to critical systems such as POS terminals
and inventory management systems. These attacks can also result in financial
losses and damage to the retailers’ reputation.

The IoT has a very short life lifespans [133], and after its use and service,
it can be considered a remarkable security threat. If IoTs are then a part of
a greater digital supply chain, they potentially risk losing confidentiality,
integrity, or availability of the entire system.

####  V-G2 Mitigation approaches

The new era of finding security solutions is inclining toward Machine
learning, AI, Blockchain, etc. Fog computing, machine learning (ML), and
artificial intelligence (AI) can all play important roles in enhancing the
security of retail IoT devices and systems.

Fog computing involves processing data at the edge of the network, closer to
the devices generating the data, rather than sending all the data to the cloud
for processing. This approach can improve security by reducing the amount of
sensitive data that needs to be transmitted over the network, and by allowing
for real-time analysis of data. For example, fog computing can be used to
monitor and detect anomalies in device behavior, and trigger alerts or block
suspicious activities.

In this direction, Vidyasankar et al. [134] proposed a fog computing framework
for enhancing the efficiency and security of BlackBerry’s supply chain
management. The framework incorporates various fog computing technologies,
such as edge computing, cloud computing, and the Internet of Things (IoT), to
enable real-time monitoring and analysis of supply chain data. The proposed
framework also includes a security layer to protect the sensitive data
involved in the supply chain.

To address the DDoS attack in retail IoT systems, Swan et al. proposed a
custom hardware solution [135]. The solution consists of two main components:
a hardware module that performs the actual DDoS mitigation, and a software
framework that orchestrates the hardware module and provides an interface for
configuring and managing the mitigation process. The proposed custom hardware
is designed to be placed between the IoT devices and the network. Sudip Das
proposes a model for retail oil outlets (ROO) by incorporating “data security”
into the existent framework of technology, organization, and environment
within the IoT ecosystem [136]. Patnaik et al. propose the use of machine
learning, artificial intelligence (AI), and blockchain technology as potential
solutions [137]. Specifically, these technologies can be used for: Intrusion
detection and prevention: Machine learning and AI can be used to analyze
network traffic and identify anomalous behavior that may indicate a security
breach.

Device authentication and access control: Blockchain technology can be used to
create a secure and decentralized system for authenticating IoT devices and
controlling access to sensitive data. Data encryption and privacy protection:
Machine learning and AI can be used to encrypt data and protect the privacy of
sensitive information. Threat intelligence and incident response: Machine
learning and AI can be used to analyze security data and provide real-time
insights into emerging threats, allowing for more effective incident response.

####  V-G3 Open problems

The primary ongoing concern within the realm of IoT in retail lies in
addressing vulnerabilities related to financial transactions. Many of these
transactions involving IoT devices rely on personal information stored in the
cloud, thereby introducing an additional vulnerability susceptible to
potential malicious attacks.

###  V-H Category 8: IoT in Agriculture

####  V-H1 Security challenges

In the context of the changing climate due to global warming, smart devices
emerge as a prime solution for sustaining the nutritional needs of billions.
Moreover, the integration of AIoT (Agriculture Internet of Things) and cloud
computing promises enhanced crop production through cost reduction, efficient
monitoring of crops, and their maintenance [138, 139, 140].

The most common examples of cloud-based IoT applications in agriculture are
(1) smart sensor-based IoT devices for monitoring crops, soil, fields,
livestock, storage facility, or generally any necessary factor that influences
agriculture production [141, 142]. (2) Smart IoT agriculture vehicles, drones,
autonomous robots, and actuators(e.g.DroneSeed, SenseFly, SoilCares [143]).
(3) smart greenhouse and hydroponics [144]. (4) For data analytics, data
visualization, and data management systems in agriculture, (5) Predictive
modeling and planning (6) Precision agriculture using IoT [145, 146].

The expeditious evolution of IoT and innovative communication technology as
well as the advancement of digitization of the world is bringing new risks and
dangers in terms of IoT in the global market. Possible attacks in various IoT-
based agriculture systems can result in serious security concerns in the
dynamic cyber-physical environment [147, 148]. Mori et al. have discussed the
security issues of IoT-based smart environments. The core reason for security
issues is its complexity, as in the smart environment, multiple IoT devices
work with each other [149].

AIoT relies on multiple sensors operating in synergy, and in such a scenario,
if one IoT sensor or device is compromised, it could make the alteration of
other interconnected devices more vulnerable. The hacker can get access to the
data transmitted from the IoT device to a local weather station or cloud
server and then can alter the processed data. AIoT security vulnerabilities
manifest across all layers of the IoT framework. The first application layer,
where the farmer connects with the IoT devices, is the layer where there is a
high chance of data theft [150]. The various security concern that happens in
this layer is Data theft, access control sniffing attack and service interrupt
attack; due to these attacks, the delivery of the IoT services to the farmers
can be affected [151, 152].

This delivery service will not only affect the farmer-IoT relations but also
affect the farmer-retailers or farmer-stakeholders relationship. As a result
of attacks targeting the application layer, accessibility issues for all
connected individuals can also become vulnerable to security and privacy
threats. The subsequent susceptible layer for potential attacks resides in the
middleware, where a variety of attack vectors can be exploited, rendering AIoT
devices more vulnerable. Some examples of middleware attacks are MITM attacks,
SQL injection attacks, signature wrapping attacks, cloud malware injection
attacks, and flooding attacks in the cloud. This layer functions as an
intermediary between hardware and applications, and thus, the primary concerns
impacting agriculture may revolve around device data, access control issues,
and data analysis [153, 154].

The next security vulnerability can happen on the cloud server side where the
AIoT is connected to the internet [155]. Here the attack can be a phishing
attack, access attack,DDoS attack, data transit attack, and routing attack.
This layer is responsible for conducting communication between device-to-
device, device-to-cloud, device-to-gateway, and back-end data-sharing. A
disruption at this layer could result in the device and service becoming non-
functional. Additionally, if the data transmitted between IoT devices and the
cloud is in plaintext and lacks encryption, it can give rise to privacy
concerns affecting both the IoT device and farmers’ personal data both.

####  V-H2 Mitigation approaches

Due to the complexity of the smart agriculture environment, AIoT is vulnerable
to intrusion attacks where attackers gain unauthorized access to a farm’s IoT
network and steal sensitive data related to crop production, livestock
monitoring, or equipment management. ML can play a vital role in mitigating
these attacks. Phasinam et al. proposed an intrusion detection mechanism using
machine learning techniques [156], designed to detect abnormal behavior in the
smart irrigation system, which could be indicative of a security breach. By
using machine learning algorithms for intrusion detection, the mechanism can
adapt to new threats and improve its accuracy over time.

As machine learning continues to advance, deep learning emerges as a modern
tool that offers a secure and privacy-preserving framework for smart
agriculture. Srivastava et al. proposed a Secured Privacy-Preserving Framework
(SP2F) for smart agricultural unmanned aerial vehicles [157]. The proposed
framework is designed to protect the privacy and security of data collected by
UAVs while still allowing for efficient and effective data analysis.

In the same direction, Liu et al. present a data aggregation scheme that
preserves privacy and offers flexibility by utilizing the ElGamal
Cryptosystem. The proposed scheme has been rigorously analyzed and performance
simulations have been conducted, demonstrating its security and privacy-
preserving capabilities. This approach will solve the privacy-preserving issue
not only in smart agriculture scenarios but also in the other applications of
IoT [158].

Lu et al. have proposed another privacy-preserving solution, for fog-based
agricultural IoT systems. The scheme leverages secure multi-party computation
techniques, allowing data owners to query the maximum value within a specific
range without disclosing any sensitive information about their data to the fog
nodes. The proposed scheme is not only a privacy-preserving solution but is
also designed to minimize computation and communication overhead while
preserving data privacy [159].

Another framework is designed to detect anomalies in data collected from
various sources within a smart farming system while preserving the privacy of
sensitive data using homomorphic encryption techniques [160]. Tripathi et al.
proposed a deep privacy-encoding-based federated learning framework (PEFL) to
address privacy concerns associated with federated learning in smart
agriculture systems by utilizing a deep privacy-encoding mechanism [161]. Dara
et al. believe that standardization could be a potential solution for
interoperability and consistency issues in a smart agriculture environment,
whereas the blockchain and distributed ledger technology could help in
mitigating data integrity and data confidentiality issues and thus making the
data storage system more secure than before [162].

Security monitoring is crucial to ensure the safety of smart farming. Modern
technology can avail better security solutions for a security issue in AIoT.
In this direction, Ravi et al. proposed a cloud-enabled security monitoring
framework that effectively monitors device status and sensor anomalies and can
mitigate security attacks by identifying behavioral patterns. In addition, a
blockchain-based smart-contract application is implemented to securely store
security anomaly information and proactively mitigate similar attacks
targeting other farms.

####  V-H3 Open problems

Since AIoTs are resource-constrained they often lack robust security measures,
making them vulnerable to unauthorized access and data breaches, which can
compromise sensitive agricultural information like crop yields, weather data,
and farm operations. In these, the IoT human factor also poses a challenging
security concern. Human errors, such as weak passwords or poor security
practices by farm personnel, can compromise IoT security. Hence the AIoT
should be robust and usable enough to protect information. due to resource
constraints, implementing strong security measures is difficult. Thus research
for lightweight security protocols suitable for resource-constrained devices
is required.

###  V-I Category 9: IoT in Smart Grids

####  V-I1 Security challenges

As the old conventional grid systems are aging, the world is focused on
adopting and integrating smart grid technology [163], which is being used to
efficiently deliver sustainable, affordable, and safe electricity supplies.

Some examples of IoT in smart grids include smart switches, smart metering
systems [164], Smart thermostats [165], smart batteries [166] etc. Smart grid
IoT devices, which are used to monitor, control, and optimize the distribution
of energy across the power grid, are increasingly being integrated with cloud-
based services to enable remote management and analysis. While cloud-based
smart grid systems offer numerous benefits, they also pose several security
risks that need to be addressed. Some of the security issues that arise in
cloud-based smart grid IoT devices are data privacy issues, malware attacks
issue, DDoS attacks, standardization, transparency issues, etc. Smart grid
systems generate huge amounts of sensitive and private data, including
customer personal information, energy usage patterns, and grid performance
data which are vulnerable to leaks.

This data needs to be protected from unauthorized access, theft, or misuse
[167]. A false data injection attack in which an attacker injects false or
malicious data into the system with the intention to disrupt its operation or
steal information. In a smart grid, IoT devices are used to monitor and
control the flow of electricity, and attackers can exploit vulnerabilities in
these devices to inject false data. This false data can then cause the smart
grid to malfunction or behave in unexpected ways, potentially leading to power
outages or other disruptions.

Despite being a widespread threat in various IoT domains, the smart grid is
not immune to DDoS attacks. Various types of DDoS attacks can be directed at
different components of the smart grid, including meters, communication
networks, and control systems. DDoS attacks, in particular, pose significant
risks to the smart grid infrastructure, potentially resulting in power
outages, data loss, and financial damages [168].

Cloud-based smart grid systems can be vulnerable to malware attacks, which can
be used to disarrange grid operations or steal sensitive data. Malware can be
introduced through compromised IoT devices or phishing attacks on cloud
service providers [169]. DDoS attacks can be used by attackers to overload
cloud-based smart grid systems, leading to system crashes or unavailability.
This can lead to disruptions in energy distribution and other critical
services [170]. Cloud-based smart grid systems are vulnerable to insider
threats, For instance, employees or contractors who have access to sensitive
data may later misuse this private information for personal gain, potentially
engaging in illegal activities. [171].

A lack of standardization in cloud-based smart grid systems can create
vulnerabilities, as different vendors may have different security protocols or
use different data formats that may not be compatible with each other. Lack of
transparency in cloud-based smart grid systems can create vulnerabilities, as
users may not have full visibility into the data being collected, processed,
or shared. Smart batteries are also prone to unauthorized access to battery
data and control systems. The attackers can exploit vulnerabilities in the
battery’s software and hardware and could gain access to sensitive
information. This could possibly result in battery failure, data theft, or
other security issues The smart grid collects a large amount of data from
consumers, which can include sensitive information such as energy consumption
patterns and personal preferences. This data can be exploited further by
attackers to breach the privacy of the consumers.

####  V-I2 Mitigation approaches

To mitigate these security risks, cloud-based smart grid systems need to be
designed with robust security protocols and standards, including strong
authentication mechanisms, data encryption, and intrusion detection systems.
Regular security audits, employee training, and incident response plans are
also important to ensure the security of these systems.

To mitigate these security concerns, manufacturers of smart batteries should
implement strong encryption and authentication measures to protect data and
communication channels. They should also incorporate tamper-evident features
to prevent physical attacks on the battery. Moreover, routine firmware updates
can help mitigate numerous security vulnerabilities and enhance the security
of both the battery’s software and hardware. security vulnerabilities in the
smart grid can be life-threatening as they can lead to a loss of critical
services, physical damage to infrastructure, and potential safety hazards for
individuals. Its early detection and mitigation are of utmost importance.

Uludag et al. [172] propose a framework for anomaly detection and attack
recognition that leverages data from various sources, including IoT devices,
network traffic, and system logs. The mitigation and response mechanism
involves isolating the affected devices and shutting down the affected systems
to prevent further damage.

To address the cybersecurity issue in smart grids Muyeen group suggested the
use of machine learning to tackle the issue. They acknowledge that machine
learning can be used for cybersecurity in smart grids, including intrusion
detection, threat intelligence, anomaly detection, and risk assessment [173].
The smart grid is vulnerable to both faults and cyber-attacks, and a
comprehensive security scheme is necessary to ensure the reliable and secure
operation of the grid. There should be multi-layer security to mitigate
vulnerabilities in the smart grid against faults and cyber-attacks. Annuk et
al. proposed a three-layer security scheme that includes the physical layer,
network layer, and application layer security [174].

To mitigate false data injection attacks, the distributed trust management
system (DTMS) can be used. The DTMS consists of a set of trust nodes that are
responsible for verifying the data received from the sensors and measurement
devices of the smart grid. The trust nodes use a distributed consensus
algorithm to reach a consensus on the correctness of the data [175].

To address the privacy breach, the smart generative adversarial network (GAN)
can be used to obfuscate consumer data. GAN generates synthetic data that is
similar to real data but does not reveal the actual information of the
consumers. The synthetic data is then used for analysis and decision-making,
while the real data is obfuscated to protect the privacy of the consumers
[176]. To mitigate cyber and physical attacks, big data and AI technologies
can be used to analyze and predict the security risks in the smart grid.

To mitigate DDoS attacks in smart grids, various techniques like intrusion
detection systems, firewalls, and load balancing mechanisms can be used. Yang
et al. [177] proposed a framework that consists of four phases: data
collection, data preprocessing, risk modeling, and risk evaluation. The risk
modeling phase among the four phases involves using various AI techniques,
such as machine learning and deep learning, to model the security risks in the
smart grid.

####  V-I3 Open problems

European countries such as Germany are integrating IoT infrastructure and
technology solutions to implement smart grid projects in many of its
provinces. These projects will help the country optimize renewable energy in
the city and monitor the harmonized energy consumption and production in the
city.

It would not be superfluous, that to obtain net zero adoption by 2050, many
capitals of the world are in queue to implement the IoT-based smart grid
system for energy optimization. As the global deployment of smart grid devices
rises to attain net-zero carbon goals, the corresponding increase in the
number of devices also implies a potential growth in security risks and
hacking incidents.

###  V-J Category 10: cloud-based IoT in Aviation

####  V-J1 Security challenges

Cloud-based IoT solutions are transforming aviation by enhancing data
collection, processing, and analysis in the industry. Some of the key
applications of cloud-based aviation IoT are Smart Airport [178], predictive
maintenance [179], [180], improving customer satisfaction [181] safety
management [182], improving the overall performance by reducing emissions
[183], luggage management [184], in-flight entertainment systems [185], [186]
etc.

In addressing security challenges within this category, data security emerges
as a foremost concern. Given that cloud-based Aviation IoT systems extensively
depend on data collection and transmission, safeguarding the integrity and
confidentiality of this data is of utmost importance. Any data breach has the
potential to result in harm to aircraft, passengers, and the airline’s
reputation. [187].

Gritzalis et al. [188] discusses the security challenges and threats faced by
smart airports due to the integration of Industrial IoT and increased use of
smart devices. Malware, cyber-attacks, and insider threats are some of the key
challenges that smart airports face today. The authors emphasize the
importance of implementing robust cybersecurity governance in smart airports
to protect against cyber threats and enhance operational practice.

Aboti et al. [189] provide a case study highlighting the importance of
cybersecurity in commercial aviation, where the complexity of the network, the
large number of devices, and the generated data make it more susceptible to
cyber threats. The main security issue discussed by Bellkens et al. [190] is
the vulnerability of aviation infrastructure to cyber-attacks, particularly
from Advanced Persistent Threat (APT) groups that operate in collaboration
with a particular state actor to steal intellectual property and intelligence
to advance their domestic aerospace capabilities as well as monitor,
infiltrate and subvert other sovereign Nations’ capabilities.

Lazaro group [191] conducted a study by combining interviews with airport
security personnel and a survey of airport users, to gather data on the cyber
security risks and vulnerabilities of Spanish airports. The study identifies
several cyber security risks, including inadequate user authentication
measures, vulnerabilities in airport software systems, and the use of insecure
communication channels. In the context of aviation cyber security, the use of
Electronic Flight Bags (EFBs) adds a layer of risk, as unauthorized access to
EFB servers could potentially compromise the safety and security of aircraft
operations.

Hackers exploit vulnerabilities in the remote desktop protocol or use phishing
attacks to steal login credentials and gain unauthorized access to aviation
IoT systems. This unauthorized access can lead to a variety of negative
consequences, such as stealing sensitive data, causing equipment malfunctions,
and compromising the safety of passengers and crew. Considering the
significant volume of data collected by IoT devices in the aviation industry,
ensuring the privacy and confidentiality of this data becomes a major concern.
Additionally, the complex environment of connected IoT devices in aviation
increases vulnerability to cybersecurity threats. Overall, robust security
measures must be implemented to mitigate these risks and protect the aviation
sector from potential cyberattacks.

####  V-J2 Mitigation approaches

Sam Adhikari proposed a mechanism against cyber defense in the aviation sector
that leverages 5G and intelligent cyber defense mechanisms to enhance the
security of aviation systems against cyber threats [192].

In airports, robust security measures, such as the use of encryption
technologies, regular security audits, and employee training programs. In
another study, Belkens’s group suggested approach consists of three main
components (1) a 5G-enabled communication network that provides high-speed,
low-latency connectivity between aviation systems and enables real-time threat
detection and response; (2) an intelligent cyber defense system that uses
artificial intelligence (AI) and machine learning (ML) algorithms to detect
and mitigate cyber threats in real-time; and (3) a set of best practices and
guidelines for the implementation and operation of the cybersecurity framework
[190].

Lazaro et al. recommended that a proactive and collaborative approach to
cybersecurity is essential to guarantee the safety and security of Spanish
airports and the well-being of passengers [191]. Damien et al. propose a
secure and reliable model for the traceability of records in the airline
supply chain using blockchain and machine learning technologies. The model is
designed to enhance the efficiency and security of the supply chain by
providing real-time tracking and monitoring of records related to cargo and
other goods [193]. ML and AI could be the better alternatives to find
solutions for security attacks that happen due to electronic Flight Bags
attacks.

Shabtai et al. proposed a system that utilizes a combination of feature
engineering and machine learning algorithms to detect and classify intrusions
in real time. The study focuses specifically on securing remote desktop
connections, which are a common attack vector for cybercriminals seeking to
gain unauthorized access to EFB servers [194].

In addition to the general security measures, specific security measures need
to be taken for IoT devices in the aviation sector. These measures include
using secure communication protocols, implementing strong authentication and
access control measures, conducting regular security audits, keeping firmware
up-to-date, and encrypting sensitive data. By putting these security measures
into practice, the aviation sector can reduce the risks associated with IoT
devices and ensure the safe and secure adoption of this technology.

####  V-J3 Open problems

Despite the presence of various defense mechanisms, several security threats
persist within this category. Data security remains a significant challenge,
particularly concerning the risk of sensitive passenger data breaches.
Additionally, continuous concerns revolve around the potential for cyber
threats, including malware and phishing attacks, to compromise system
integrity.

##  VI The Way Forward: In Search of Uniform Solutions for All Security
Challenges

While there is a universal desire for a standardized security solution
addressing the various security and privacy challenges in cloud-based IoT
(RQ3), creating a one-size-fits-all security solution for the diverse security
and privacy challenges in cloud-based IoT is a complex task.

The reason is, that every category of IoT devices possesses unique
characteristics. for instance, consumer-oriented devices can be scaled up to
accommodate more hardware resources for enhanced security. In contrast,
medical wearable devices need to remain compact and easily portable.
Consequently, security solutions must be tailored to the specific features of
each category. Our section on mitigation approaches delves into potential
solutions, recognizing the need for category-specific security measures.

Nonetheless, the authors put forth an optimal approach aimed at mitigating the
security issue to a certain extent. In the realm of IoT devices intended for
consumer use, a complex ecosystem involving multiple third parties is
typically at play, which can generally be categorized into three levels: the
Manufacturer (responsible for hardware components like sensors, memory cards,
etc.), Third-party services (involving tasks such as device code development,
natural language processing, etc), and Cloud services (facilitating internet
connectivity, communication with end-users, etc.).

The authors advocate for the implementation of a standardized protocol
verification process at each of these levels. Prior to the launch of an IoT
product in the market, verification checks should be rigorously conducted at
the manufacturing level, followed by the third-party level, and finally, at
the cloud service level. The progression to the next verification level should
only occur if the previous level’s checks are successfully passed.

The authors posit that this standardized verification mechanism holds the
potential to serve as a significant milestone in addressing security concerns,
particularly in the context of life-critical IoT devices.

##  VII Summary & Conclusions

This paper introduces a novel approach for analyzing security concerns in the
cloud-based IoT by categorizing it into different categories. Each category
exhibits unique security issues related to its specific purpose. Our objective
is to identify and gather the security challenges associated with each IoT
category, and subsequently explore existing solutions. In cases where no
solution currently exists, it highlights the potential for future research to
develop optimal resolutions. By examining the security issues and proposing
solutions, we aim to address unanswered questions surrounding cloud-based IoT.
This proactive approach enables us to foresee and prepare for forthcoming
challenges in advance. The limitation of our study lies in the fact that
certain current IoT devices operate independently of the cloud. Nevertheless,
we foresee an increase in security risks associated with these devices as they
progressively integrate with the cloud. The incorporation of cloud computing
introduces new security concerns, such as potential data breaches and DDoS
attacks. Given that many IoT devices, such as implantable and wearable
devices, are constrained by limited resources, implementing cryptographic
algorithms on these devices is challenging. Hence, it is crucial to carefully
consider the security risks associated with cloud computing during the design
and deployment of IoT devices. By taking proactive measures to address these
risks, we can contribute to ensuring the security of IoT devices and
safeguarding user data.

## References

  * [1] S. Kumar, P. Tiwari, and M. Zymbler, “Internet of things is a revolutionary approach for future technology enhancement: a review,” _Journal of Big data_ , vol. 6, no. 1, pp. 1–21, 2019.
  * [2] M. Kamal, A. Aljohani, and E. Alanazi, “Iot meets covid-19: Status, challenges, and opportunities,” _arXiv preprint arXiv:2007.12268_ , 2020\.
  * [3] S. S. Tabrizi and D. Ibrahim, “A review on cloud computing and internet of things,” _International Journal of Computer and Information Engineering_ , vol. 11, no. 4, pp. 493–498, 2017.
  * [4] O. Alrawi, C. Lever, M. Antonakakis, and F. Monrose, “Sok: Security evaluation of home-based iot deployments,” in _2019 IEEE symposium on security and privacy (sp)_. IEEE, 2019, pp. 1362–1380.
  * [5] N. Apthorpe, D. Reisman, and N. Feamster, “A smart home is no castle: Privacy vulnerabilities of encrypted iot traffic,” _arXiv preprint arXiv:1705.06805_ , 2017.
  * [6] C. Bradley, S. El-Tawab, and M. H. Heydari, “Security analysis of an iot system used for indoor localization in healthcare facilities,” in _2018 Systems and Information Engineering Design Symposium (SIEDS)_. IEEE, 2018, pp. 147–152.
  * [7] Z. B. Celik, P. McDaniel, and G. Tan, “Soteria: Automated $\\{$IoT$\\}$ safety and security analysis,” in _2018 USENIX Annual Technical Conference (USENIX ATC 18)_ , 2018, pp. 147–158.
  * [8] G. Chu, N. Apthorpe, and N. Feamster, “Security and privacy analyses of internet of things children’s toys,” _IEEE Internet of Things Journal_ , vol. 6, no. 1, pp. 978–985, 2018.
  * [9] T. Denning, T. Kohno, and H. M. Levy, “Computer security and the modern home,” _Communications of the ACM_ , vol. 56, no. 1, pp. 94–103, 2013.
  * [10] W. Ding and H. Hu, “On the safety of iot device physical interaction control,” in _Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security_ , 2018, pp. 832–846.
  * [11] Z. Jin, L. Xing, Y. Fang, Y. Jia, B. Yuan, and Q. Liu, “P-verifier: Understanding and mitigating security risks in cloud-based iot access policies,” in _Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security_ , 2022, pp. 1647–1661.
  * [12] A. Samad, S. Alam, S. Mohammed, and M. Bhukhari, “Internet of vehicles (iov) requirements, attacks and countermeasures,” in _Proceedings of 12th INDIACom; INDIACom-2018; 5th international conference on “computing for sustainable global development” IEEE conference, New Delhi_ , 2018, pp. 1–4.
  * [13] L. Surya, “Security challenges and strategies for the iot in cloud computing,” _International Journal of Innovations in Engineering Research and Technology ISSN_ , pp. 2394–3696, 2016.
  * [14] D. Georgakopoulos, P. P. Jayaraman, M. Fazia, M. Villari, and R. Ranjan, “Internet of things and edge cloud computing roadmap for manufacturing,” _IEEE Cloud Computing_ , vol. 3, no. 4, pp. 66–73, 2016.
  * [15] J. Zhou, T. Leppanen, E. Harjula, M. Ylianttila, T. Ojala, C. Yu, H. Jin, and L. T. Yang, “Cloudthings: A common architecture for integrating the internet of things with cloud computing,” in _Proceedings of the 2013 IEEE 17th international conference on computer supported cooperative work in design (CSCWD)_. IEEE, 2013, pp. 651–657.
  * [16] K. Shafique, B. A. Khawaja, F. Sabir, S. Qazi, and M. Mustaqim, “Internet of things (iot) for next-generation smart systems: A review of current challenges, future trends and prospects for emerging 5g-iot scenarios,” _Ieee Access_ , vol. 8, pp. 23 022–23 040, 2020.
  * [17] H. F. Atlam, A. Alenezi, A. Alharthi, R. J. Walters, and G. B. Wills, “Integration of cloud computing with internet of things: challenges and open issues,” in _2017 IEEE international conference on internet of things (iThings) and IEEE green computing and communications (GreenCom) and IEEE cyber, physical and social computing (CPSCom) and IEEE smart data (SmartData)_. IEEE, 2017, pp. 670–675.
  * [18] H. Cai, B. Xu, L. Jiang, and A. V. Vasilakos, “Iot-based big data storage systems in cloud computing: perspectives and challenges,” _IEEE Internet of Things Journal_ , vol. 4, no. 1, pp. 75–87, 2016.
  * [19] F. Chen, D. Luo, T. Xiang, P. Chen, J. Fan, and H.-L. Truong, “Iot cloud security review: A case study approach using emerging consumer-oriented applications,” _ACM Comput. Surv._ , vol. 54, no. 4, may 2021. [Online]. Available: https://doi.org/10.1145/3447625
  * [20] L. Lee, S. Egelman, J. H. Lee, and D. Wagner, “Risk perceptions for wearable devices,” _arXiv preprint arXiv:1504.05694_ , 2015.
  * [21] F. A. Alaba, M. Othman, I. A. T. Hashem, and F. Alotaibi, “Internet of things security: A survey,” _Journal of Network and Computer Applications_ , vol. 88, pp. 10–28, 2017.
  * [22] I. M. Khalil, A. Khreishah, and M. Azeem, “Cloud computing security: A survey,” _Computers_ , vol. 3, no. 1, pp. 1–35, 2014.
  * [23] A. Singh and K. Chatterjee, “Cloud security issues and challenges: A survey,” _Journal of Network and Computer Applications_ , vol. 79, pp. 88–115, 2017\.
  * [24] Z. B. Celik, E. Fernandes, E. Pauley, G. Tan, and P. McDaniel, “Program analysis of commodity iot applications for security and privacy: Challenges and opportunities,” _ACM Computing Surveys (CSUR)_ , vol. 52, no. 4, pp. 1–30, 2019.
  * [25] N. Almolhis, A. M. Alashjaee, S. Duraibi, F. Alqahtani, and A. N. Moussa, “The security issues in iot-cloud: a review,” in _2020 16th IEEE International Colloquium on Signal Processing & Its Applications (CSPA)_. IEEE, 2020, pp. 191–196.
  * [26] M. O. Qays, I. Ahmad, A. Abu-Siada, M. L. Hossain, and F. Yasmin, “Key communication technologies, applications, protocols and future guides for iot-assisted smart grid systems: A review,” _Energy Reports_ , vol. 9, pp. 2440–2452, 2023.
  * [27] V. Sivaraman, D. Chan, D. Earl, and R. Boreli, “Smart-phones attacking smart-homes,” in _Proceedings of the 9th ACM Conference on Security & Privacy in Wireless and Mobile Networks_, 2016, pp. 195–200.
  * [28] M. Stoyanova, Y. Nikoloudakis, S. Panagiotakis, E. Pallis, and E. K. Markakis, “A survey on the internet of things (iot) forensics: challenges, approaches, and open issues,” _IEEE Communications Surveys & Tutorials_, vol. 22, no. 2, pp. 1191–1221, 2020.
  * [29] Y. Harbi, Z. Aliouat, S. Harous, A. Bentaleb, and A. Refoufi, “A review of security in internet of things,” _Wireless Personal Communications_ , vol. 108, no. 1, pp. 325–344, 2019.
  * [30] J. Zhou, Z. Cao, X. Dong, and A. V. Vasilakos, “Security and privacy for cloud-based iot: Challenges,” _IEEE Communications Magazine_ , vol. 55, no. 1, pp. 26–33, 2017.
  * [31] J. Domingo-Ferrer, O. Farras, J. Ribes-González, and D. Sánchez, “Privacy-preserving cloud computing on sensitive data: A survey of methods, products and challenges,” _Computer Communications_ , vol. 140, pp. 38–60, 2019.
  * [32] Z. Jin, L. Xing, Y. Fang, Y. Jia, B. Yuan, and Q. Liu, “P-verifier: Understanding and mitigating security risks in cloud-based iot access policies,” in _Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security_ , ser. CCS ’22. New York, NY, USA: Association for Computing Machinery, 2022, p. 1647–1661. [Online]. Available: https://doi.org/10.1145/3548606.3560680
  * [33] A. J. Obaid, “Assessment of smart home assistants as an iot,” _International Journal of Computations, Information and Manufacturing (IJCIM)_ , vol. 1, no. 1, 2021.
  * [34] N. Zhang, X. Mi, X. Feng, X. Wang, Y. Tian, and F. Qian, “Dangerous skills: Understanding and mitigating security risks of voice-controlled third-party functions on virtual personal assistant systems,” in _2019 IEEE Symposium on Security and Privacy (SP)_. IEEE, 2019, pp. 1381–1396.
  * [35] D. Kumar, R. Paccagnella, P. Murley, E. Hennenfent, J. Mason, A. Bates, and M. Bailey, “Skill squatting attacks on amazon alexa,” in _27th USENIX security symposium (USENIX Security 18)_ , 2018, pp. 33–47.
  * [36] S. smartthing, “Is samsung smarthings hub secure?” [Online]. Available: https://www.smarthomeglobe.com/is-samsung-smartthings-hub-secure/#:~:text=Cisco%20talos%20researches%20said%20that%20Samsung%20SmartThings%20can,smart%20plugs%2C%20turning%20off%20motion%20sensors%20and%20more.
  * [37] E. Fernandes, J. Jung, and A. Prakash, “Security analysis of emerging smart home applications,” in _2016 IEEE symposium on security and privacy (SP)_. IEEE, 2016, pp. 636–654.
  * [38] E. Fernandes, A. Rahmati, J. Jung, and A. Prakash, “Security implications of permission models in smart-home application frameworks,” _IEEE Security & Privacy_, vol. 15, no. 2, pp. 24–30, 2017.
  * [39] W. Zhang, Y. Meng, Y. Liu, X. Zhang, Y. Zhang, and H. Zhu, “Homonit: Monitoring smart home apps from encrypted traffic,” in _Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security_ , 2018, pp. 1074–1088.
  * [40] R. E. Navas, H. Le Bouder, N. Cuppens, F. Cuppens, and G. Z. Papadopoulos, “Do not trust your neighbors! a small iot platform illustrating a man-in-the-middle attack,” in _Ad-hoc, Mobile, and Wireless Networks: 17th International Conference on Ad Hoc Networks and Wireless, ADHOC-NOW 2018, Saint-Malo, France, September 5-7, 2018. Proceedings 17_. Springer, 2018, pp. 120–125.
  * [41] M. Park, H. Oh, and K. Lee, “Security risk measurement for information leakage in iot-based smart homes from a situational awareness perspective,” _Sensors_ , vol. 19, no. 9, p. 2148, 2019.
  * [42] T. Alladi, V. Chamola, B. Sikdar, and K.-K. R. Choo, “Consumer iot: Security vulnerability case studies and solutions,” _IEEE Consumer Electronics Magazine_ , vol. 9, no. 2, pp. 17–25, 2020.
  * [43] J. Obermaier and M. Hutle, “Analyzing the security and privacy of cloud-based video surveillance systems,” in _Proceedings of the 2nd ACM international workshop on IoT privacy, trust, and security_ , 2016, pp. 22–28.
  * [44] Y. Seralathan, T. T. Oh, S. Jadhav, J. Myers, J. P. Jeong, Y. H. Kim, and J. N. Kim, “Iot security vulnerability: A case study of a web camera,” in _2018 20th International Conference on Advanced Communication Technology (ICACT)_. IEEE, 2018, pp. 172–177.
  * [45] A. Tekeoglu and A. S. Tosun, “Investigating security and privacy of a cloud-based wireless ip camera: Netcam,” in _2015 24th International Conference on Computer Communication and Networks (ICCCN)_. IEEE, 2015, pp. 1–6.
  * [46] H. Xu, F. Xu, and B. Chen, “Internet protocol cameras with no password protection: An empirical investigation,” in _International Conference on Passive and Active Network Measurement_. Springer, 2018, pp. 47–59.
  * [47] N. Mangala, K. Venugopal _et al._ , “Short paper: Current challenges in iot cloud smart applications,” in _2021 IEEE International Conference on Cloud Computing in Emerging Markets (CCEM)_. IEEE, 2021, pp. 36–40.
  * [48] C. Geeng and F. Roesner, “Who’s in control? interactions in multi-user smart homes,” in _Proceedings of the 2019 CHI Conference on Human Factors in Computing Systems_ , 2019, pp. 1–13.
  * [49] W. Jang, A. Chhabra, and A. Prasad, “Enabling multi-user controls in smart home devices,” in _Proceedings of the 2017 workshop on internet of things security and privacy_ , 2017, pp. 49–54.
  * [50] E. Zeng and F. Roesner, “Understanding and improving security and privacy in $\\{$Multi-User$\\}$ smart homes: A design exploration and $\\{$In-Home$\\}$ user study,” in _28th USENIX Security Symposium (USENIX Security 19)_ , 2019, pp. 159–176.
  * [51] B. D. Davis, J. C. Mason, and M. Anwar, “Vulnerability studies and security postures of iot devices: a smart home case study,” _IEEE Internet of Things Journal_ , vol. 7, no. 10, pp. 10 102–10 110, 2020.
  * [52] S. Notra, M. Siddiqi, H. H. Gharakheili, V. Sivaraman, and R. Boreli, “An experimental study of security and privacy risks with emerging household appliances,” in _2014 IEEE conference on communications and network security_. IEEE, 2014, pp. 79–84.
  * [53] A. Hooda, M. Wallace, K. Jhunjhunwalla, E. Fernandes, and K. Fawaz, “Skillfence: A systems approach to practically mitigating voice-based confusion attacks,” _Proceedings of the ACM on Interactive, Mobile, Wearable and Ubiquitous Technologies_ , vol. 6, no. 1, pp. 1–26, 2022.
  * [54] U. Chatterjee, R. S. Chakraborty, and D. Mukhopadhyay, “A puf-based secure communication protocol for iot,” _ACM Transactions on Embedded Computing Systems (TECS)_ , vol. 16, no. 3, pp. 1–25, 2017.
  * [55] B. Nazzal, A. A. Zaid, M. H. Alalfi, and A. Valani, “Vulnerability classification of consumer-based iot software,” in _Proceedings of the 4th International Workshop on Software Engineering Research and Practice for the IoT_ , 2022, pp. 17–24.
  * [56] A. Shameli-Sendi, M. Pourzandi, M. Fekih-Ahmed, and M. Cheriet, “Taxonomy of distributed denial of service mitigation approaches for cloud computing,” _Journal of Network and Computer Applications_ , vol. 58, pp. 165–179, 2015\.
  * [57] P. Salva-Garcia, J. M. Alcaraz-Calero, Q. Wang, J. B. Bernabe, and A. Skarmeta, “5g nb-iot: Efficient network traffic filtering for multitenant iot cellular networks,” _Security and Communication Networks_ , vol. 2018, pp. 1–21, 2018\.
  * [58] S. Guozi, W. Jiang, G. Yu, R. Danni, and L. Huakang, “Ddos attacks and flash event detection based on flow characteristics in sdn,” in _2018 15th IEEE international conference on advanced video and signal based surveillance (AVSS)_. IEEE, 2018, pp. 1–6.
  * [59] Q. Yan, W. Huang, X. Luo, Q. Gong, and F. R. Yu, “A multi-level ddos mitigation framework for the industrial internet of things,” _IEEE Communications Magazine_ , vol. 56, no. 2, pp. 30–36, 2018.
  * [60] D. Ma, Z. Xu, and D. Lin, “Defending blind ddos attack on sdn based on moving target defense,” in _International Conference on Security and Privacy in Communication Networks: 10th International ICST Conference, SecureComm 2014, Beijing, China, September 24-26, 2014, Revised Selected Papers, Part I 10_. Springer, 2015, pp. 463–480.
  * [61] W. Connell, D. A. Menascé, and M. Albanese, “Performance modeling of moving target defenses,” in _Proceedings of the 2017 Workshop on Moving Target Defense_ , 2017, pp. 53–63.
  * [62] W. Chen, S. Xiao, L. Liu, X. Jiang, and Z. Tang, “A ddos attacks traceback scheme for sdn-based smart city,” _Computers & Electrical Engineering_, vol. 81, p. 106503, 2020.
  * [63] A. Bhattacharjya, X. Zhong, J. Wang, and X. Li, “Secure iot structural design for smart homes,” in _Smart Cities Cybersecurity and Privacy_. Elsevier, 2019, pp. 187–201.
  * [64] M. Abu-Tair, S. Djahel, P. Perry, B. Scotney, U. Zia, J. M. Carracedo, and A. Sajjad, “Towards secure and privacy-preserving iot enabled smart home: architecture and experimental study,” _Sensors_ , vol. 20, no. 21, p. 6131, 2020.
  * [65] P. Gerber, M. Heidinger, J. Stiegelmayer, and N. Gerber, “Loki: Development of an interface for task-based, privacy-friendly smart home control through local information processing: Loki: Entwicklung eines interfaces für die aufgaben-basierte, privatsphäre-freundliche smart home-steuerung durch lokale informationsverarbeitung,” in _Proceedings of Mensch und Computer 2021_ , 2021, pp. 578–581.
  * [66] C. P. Protection, “Children’s online privacy protection rule (”coppa”).” [Online]. Available: https://www.ftc.gov/legal-library/browse/rules/childrens-online-privacy-protection-rule-coppa
  * [67] D. Holloway and L. Green, “The internet of toys,” _Communication Research and Practice_ , vol. 2, no. 4, pp. 506–519, 2016.
  * [68] M. Ataei Nezhad, H. Barati, and A. Barati, “An authentication-based secure data aggregation method in internet of things,” _Journal of Grid Computing_ , vol. 20, no. 3, p. 29, 2022.
  * [69] L. Ling, N. Yelland, M. Hatzigianni, and C. Dickson-Deane, “The use of internet of things devices in early childhood education: A systematic review,” _Education and Information Technologies_ , pp. 1–20, 2022.
  * [70] W. Yang, S. Wang, X. Yin, X. Wang, and J. Hu, “A review on security issues and solutions of the internet of drones,” _IEEE Open Journal of the Computer Society_ , 2022.
  * [71] P. C. Hung, F. Iqbal, S.-C. Huang, M. Melaisi, and K. Pang, “A glance of child’s play privacy in smart toys,” in _International Conference on Cloud Computing and Security_. Springer, 2016, pp. 217–231.
  * [72] J. Valente and A. A. Cardenas, “Security & privacy in smart toys,” in _Proceedings of the 2017 Workshop on Internet of Things Security and Privacy_ , 2017, pp. 19–24.
  * [73] K. Albrecht and L. Mcintyre, “Privacy nightmare: When baby monitors go bad [opinion],” _IEEE Technology and society magazine_ , vol. 34, no. 3, pp. 14–19, 2015.
  * [74] M. Stanislav and T. Beardsley, “Hacking iot: A case study on baby monitor exposures and vulnerabilities,” _Rapid7 Report_ , 2015.
  * [75] D. Rivera, A. García, M. L. Martín-Ruiz, B. Alarcos, J. R. Velasco, and A. G. Oliva, “Secure communications and protected data for a internet of things smart toy platform,” _IEEE Internet of Things Journal_ , vol. 6, no. 2, pp. 3785–3795, 2019.
  * [76] L. Rafferty, P. C. Hung, M. Fantinato, S. M. Peres, F. Iqbal, S.-Y. Kuo, and S.-C. Huang, “Towards a privacy rule conceptual model for smart toys,” _Computing in smart toys_ , pp. 85–102, 2017.
  * [77] B. Yankson, F. Iqbal, and P. C. Hung, “4p-based forensics investigation framework for smart connected toys,” in _Proceedings of the 15th International Conference on Availability, Reliability and Security_ , 2020, pp. 1–9.
  * [78] M. IoT, “Iot in healthcare.” [Online]. Available: https://www.thalesgroup.com/en/markets/digital-identity-and-security/iot/industries/healthcare
  * [79] K. V. S. S. Ganesh, S. S. Jeyanth, and A. R. Bevi, “Iot based portable heart rate and spo2 pulse oximeter,” _HardwareX_ , vol. 11, p. e00309, 2022.
  * [80] S. A. Okafor, F. M. Arukalam, I. C. Ekuma, E. O. Eziefuna, C. A. Ihetu, C. C. Okey-Mbata, U. L. Ezeamaku, N. C. Iheaturu, and A. L. Okafor, “Design and development of an internet of things based glucometer with wireless transmission,” _Journal of Engineering Research and Reports_ , vol. 22, no. 12, pp. 36–46, 2022.
  * [81] I. Security, “Top 10 biggest iot security issues.” [Online]. Available: https://www.intellectsoft.net/blog/biggest-iot-security-issues/#:~:text=The%20following%20are%20some%20security%20risks%20in%20IoT,and%20software%205%20Insecure%20data%20transfer%20and%20storage
  * [82] B. Farahani, F. Firouzi, V. Chang, M. Badaroglu, N. Constant, and K. Mankodiya, “Towards fog-driven iot ehealth: Promises and challenges of iot in medicine and healthcare,” _Future Generation Computer Systems_ , vol. 78, pp. 659–676, 2018.
  * [83] T. D. McAllister, S. El-Tawab, and M. H. Heydari, “Localization of health center assets through an iot environment (locate),” in _2017 Systems and Information Engineering Design Symposium (SIEDS)_. IEEE, 2017, pp. 132–137.
  * [84] T. Flynn, G. Grispos, W. Glisson, and W. Mahoney, “Knock! knock! who is there? investigating data leakage from a medical internet of things hijacking attack,” 2020.
  * [85] A. I. Newaz, A. K. Sikder, M. A. Rahman, and A. S. Uluagac, “A survey on security and privacy issues in modern healthcare systems: Attacks and defenses,” _ACM Transactions on Computing for Healthcare_ , vol. 2, no. 3, pp. 1–44, 2021.
  * [86] J. West, T. Kohno, D. Lindsay, and J. Sechman, “Wearfit: Security design analysis of a wearable fitness tracker,” _IEEE Center for Secure Design_ , 2016.
  * [87] U. Food and drug administation, “Postmarket management of cybersecurity in medical devices.” [Online]. Available: https://www.fda.gov/regulatory-information/search-fda-guidance-documents/postmarket-management-cybersecurity-medical-devices
  * [88] M. Wazid, B. Bera, A. Mitra, A. K. Das, and R. Ali, “Private blockchain-envisioned security framework for ai-enabled iot-based drone-aided healthcare services,” in _Proceedings of the 2nd ACM MobiCom workshop on drone assisted wireless communications for 5G and beyond_ , 2020, pp. 37–42.
  * [89] A. Fathalizadeh, V. Moghtadaiee, and M. Alishahi, “On the privacy protection of indoor location dataset using anonymization,” _Computers & Security_, vol. 117, p. 102665, 2022.
  * [90] L. Bu, M. G. Karpovsky, and M. A. Kinsy, “Bulwark: Securing implantable medical devices communication channels,” _Computers & Security_, vol. 86, pp. 498–511, 2019.
  * [91] K. Saeedi, “Machine learning for ddos detection in packet core network for iot,” 2019.
  * [92] A. I. Newaz, A. K. Sikder, M. A. Rahman, and A. S. Uluagac, “Healthguard: A machine learning-based security framework for smart healthcare systems,” in _2019 Sixth International Conference on Social Networks Analysis, Management and Security (SNAMS)_. IEEE, 2019, pp. 389–396.
  * [93] G. Srivastava, J. Crichigno, and S. Dhar, “A light and secure healthcare blockchain for iot medical devices,” in _2019 IEEE Canadian conference of electrical and computer engineering (CCECE)_. IEEE, 2019, pp. 1–5.
  * [94] G. Srivastava, R. M. Parizi, A. Dehghantanha, and K.-K. R. Choo, “Data sharing and privacy for patient iot devices using blockchain,” in _Smart City and Informatization: 7th International Conference, iSCI 2019, Guangzhou, China, November 12–15, 2019, Proceedings 7_. Springer, 2019, pp. 334–348.
  * [95] T. F. Wu, K. Ganesan, Y. A. Hu, H.-S. P. Wong, S. Wong, and S. Mitra, “Tpad: Hardware trojan prevention and detection for trusted integrated circuits,” _IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems_ , vol. 35, no. 4, pp. 521–534, 2015.
  * [96] H. Rathore, A. Mohamed, and M. Guizani, “Deep learning-based security schemes for implantable medical devices,” in _Energy Efficiency of Medical Devices and Healthcare Applications_. Elsevier, 2020, pp. 109–130.
  * [97] J. Li, J. Cai, F. Khan, A. U. Rehman, V. Balasubramaniam, J. Sun, and P. Venu, “A secured framework for sdn-based edge computing in iot-enabled healthcare system,” _IEEE Access_ , vol. 8, pp. 135 479–135 490, 2020.
  * [98] M. Zverev, R. Agüero, P. Garrido, and J. Bilbao, “Network coding for iiot multi-cloud environments,” in _Proceedings of the 9th International Conference on the Internet of Things_ , 2019, pp. 1–4.