two page research paper on "Security Issues with IoT Based Smart Home Devices"

Internet of Things has enabled homes to get linked to technology and the Internet for making daily activities more convenient (Razzaq et al., 2017). There is a strong need to address the vulnerabilities in these devices and spread awareness regarding them since a lot of users are unaware of these security issues (Yoon et al., 2015). The different types of attacks need to be identified, and their threat levels should be determined. Only then can we find solutions that can be implemented (Razzaq et al., 2017).

Devices are linked with real-life and can cause severe damage to families (Yoon et al., 2015). There are direct impacts on the privacy and security of the user due to confidentiality, authentication, and access issues being a few (Razzaq et al., 2017).

2.3 Significance

Once the security of a user is compromised, the consequences of that could be severe. A weakness in the smart home architecture can compromise confidentiality, integrity, and availability of user data(Usha and Bobby, 2018, p.567). The security issues that come with a smart home can be prevented if we are aware of how the users and their privacy are put at risk.

The purpose of the project is to investigate various security issues with IoT based smart home devices. The paper will utilize a qualitative case study approach to research different security issues related to the IoT based smart home devices. This research aims to explore how the security issues are affecting the individual users, how different protocols and unencrypted communication instigate different privacy and security issues. Further, it explores the underlying architecture and the technologies behind the security issues. Furthermore, this research provides solutions to various security issues explored during the research

What are the security issues of IoT based smart home devices?

Like computer networks, IoT devices are prone to security issues that need to be addressed. Apart from the benefits of IoT devices, users should not overlook the Security aspect of IoT based smart home devices (D. Bastos et al., 2018). According to (Zhi-Kai Zhang et al., 2014, p.232), Unauthorized access to data can expose the user and breach privacy.

Since IoT is intended to connect devices at large scale, IP based protocols are implemented. These IP based protocols increase the risk as they can communicate with any other device/attacker via open ports and security misconfigurations (Ashvini Kamble, & Sonali Bhutad. 2018 )

According to Usha and Bobby (2018, p. 567), unencrypted communication in IoT devices will lead to a breach of Data privacy. Security threats like Man-in-the-Middle attacks, Eavesdropping, and spoofing are possible with unencrypted communication. Data captured by malicious users can lead to data theft and unauthorized account takeover.

Users should be aware of what data is collected by IoT devices and their limitations. Securing the privacy of IoT devices should be a shared responsibility by both users and software providers.

A research paradigm is a broadly diverse system of interconnected actions and thought processes that define the quest for knowledge within the three dimensions of the universe. Every way of doing research can be traced back to some fundamental philosophical assumptions rooted in what constitutes pertinent research and the research method that is fitting for the application of new ideas to practical problems in a given study (Denscombe, 2008). This writing seeks to discuss the entire research framework strategies underpinning this study.

Additionally, this section discusses the research methodology used in the case study, inclusive of the strategies, instruments, data collection techniques, and analytical approaches (Denscombe, 2008). The stages and processes involved in the research study incorporate a descriptive and interpretive case study that will be analyzed through qualitative methods. Nonetheless, the interpretive paradigm was selected and identified as the framework of the research study. Common assumptions will also be examined, reviewed, and exhibited. To add in, detailed open-ended questionnaires will be used to evaluate the satisfaction levels of the participants in the case study.

A case study approach is used in generating an in-depth, multifaceted understanding of a complicated issue in its real-life context. This design is very established, and its use is applicable in a variety of scientific disciplines. This design is also referred to as a "naturalistic design" as it majorly explores phenomena in their natural context without any sort of manipulation of the variables or controlling the environment. The findings of a case study have implications on the development of a theory and its testing. According to Crowe et al. (2011), a case study approach is used in generating an in-depth, multifaceted understanding of a complex issue in its real-life context. Case Study may be characterized into three broad categories which are:

● Case studies may be intrinsic, instrumental, or collective. (Crowe et al., 2011)

● Intrinsic analyses the uniqueness of a phenomenon while the collective assesses multiple cases sequentially to attain a broader perspective about a phenomenon.

● The paper explores a case study of security issues with IoT based smart home devices.

The intrinsic nature in which the security issues with IoT is the subject of the case study, which forms the primary factor of the home-based smart home devices. Security issues in IoT are one of the constraints in realizing smart energy-efficient homes' vision. The main security requirements of smart home devices comprise integrity, confidentiality, availability, and authorization. The realization of these security requirements ensures the integration of smart home systems into a well-structured network (Usha and Bobby, 2018, p.566). Privacy is the key security issue experienced in smart homes.

Smart home devices are prone to privacy issues as hackers can easily attack them due to the availability of information when connected to the Internet. Ali, Dustgeer, Awais, and Shah (2017, p. 530) to secure these devices' data encryption of the firmware of the IoT is necessary. Protecting the user and encrypting communication links, therefore, is critical for the secure operation of IoT in smart home devices.

According to M. Gordon Hunter from the University of Lethbridge (2004), "qualitative research is an interpretive approach to investigating subjects in their natural surroundings." This method helps to clarify the perspective of people. Qualitative research involves the use of qualitative data, such as interviews, documents, case studies, and participant observation data, to understand and explain social phenomena (Hunter, 2004).

A book review is done by Cairney & St Denny (2015), which points to the most common qualitative research characteristics of acknowledgment of personal feelings, tastes, or opinions. The evaluation and the research of occurrences in their natural and real-world environments is another character they pointed out. They also mentioned the tendency in qualitative research to analyze a limited number of cases, which makes it easier to apply to any field of study (Cairney & St Denny, 2015). Among the most appropriate applications for qualitative research is the assessment, analysis, and way to solve failures in the information system. The qualitative method also helps in identifying the relationship between technological innovation and the need for the target consumers, the cultural, social, personal beliefs, and behavioral impact (Zahran & Galal-Edeen, 2006).

Instruments in the context of a research paper are the tools that are used to collect the data. These research instruments can include questionnaires, interviews, scales, examples, reviewing existing literature, among others. Since, for this research paper purposes, as we are not allowed to collect any data and only use the existing peer-reviewed journals for any research purpose, we have chosen to use existing peer-reviewed journals as the instrument to conduct our research. These peer-reviewed journal papers would be used to understand the existing IoT's architecture with reference to the home devices, its limitations, recent improvements, and the current state. It will then be used to help us conduct our analysis of the Security Issues with IoT based Smart Home Devices and provide a summary and conclusion.

In order to identify and address the vulnerabilities in the devices, we used qualitative research from case studies to understand the cyber flaws of having a smart home. When using a case study to conduct research, we are able to explore the structure of the study, the events that led up to the results and conclusion of the study, and the actions to be taken after the study(Razzaq et al., 2017). Hence, this makes it one of the most effective research design approaches and the reason why we chose it.

There are many methods that fall under qualitative research, such as interviews, focus groups, participant observation, and existing data. In order to better comprehend the cyber flaws of a smart home, we utilized existing data. For this research paper, we selected multiple peer-reviewed journals that discussed our main research question. A specific qualitative method that was used was a thematic analysis in which the existing data was examined, and general themes and patterns were acknowledged for our research (Denscombe, 2008). Some of the general themes and patterns that were identified were the types of security issues that came with smart homes and how the architecture of the smart home could affect the security of the users of it.

By using existing data in our research, we were able to be efficient with the time spent on conducting this research. This was mainly due to the fact that we did not need to collect data to conduct an experiment to answer the research question. Instead, we were able to comprehend our research question on a deeper level in the same amount of time.

10.2 IoT Architecture

There are different layered architectures. Each one of them is explained in detail below.

Three-layer architecture is the very basic architecture, and this architecture provides the basic idea of the IoT. This three-layer architecture was proposed in the earlier stages of IoT development. Since then, there have been many new proposals, varying in the number of layers the IoT architecture should consist of. The three different layers of this architecture are listed below, along with the diagram (Burhan, Rehman, Khan & Kim, 2018).

· Application Layer

· Network Layer

· Perception Layer

Picture source: Burhan, Rehman, Khan & Kim, 2018

In the four-layered architecture, it has all the layers similar to the three-layered architecture, but it has an additional layer called the Support layer. This layer was proposed by researchers as the existing three-layered architecture was not able to meet the new technologies and address the security threats posed. The support layer provides the architecture to first send the information to this layer and then pass it to the next layer. This confirms the validity of the information as well as the sender. The four different layers of this architecture are listed below, along with the diagram (Burhan, Rehman, Khan & Kim, 2018).

· Application Layer

· Support Layer

· Network Layer

· Perception Layer

Picture source: Burhan, Rehman, Khan & Kim, 2018

Since the four-layered architecture was also not able to address all the concerns, it played a very important role and laid the foundation in formulating the Five Layered Architecture. This architecture was proposed by the researchers to make it even more secure than the previous architecture. Both the application layer and network layer were replaced by three new layers, namely Business layer, Processing layer, and Transport layer. Researchers thought that this would bring stability to the architecture. The five different layers of this architecture are listed below, along with the diagram (Burhan, Rehman, Khan & Kim, 2018).

· Business Layer

· Application Layer

· Processing Layer

· Transport Layer

· Perception Layer

Picture source: Burhan, Rehman, Khan & Kim, 2018

One of the basic fundamentals that researchers understood was that the architecture of the IoT is different from the architecture of the Internet. For this reason, researchers understood that the aforementioned different architectures would not be suitable for IoT, and they proposed a new generic architecture that would fulfill the requirements of privacy and security that were subjected to various security risks. In this new architecture, there were six different layers, and they called it Six Layered Architecture. With this six-layered architecture, they provided the mechanisms to enhance and improve various functions to any layer with very minimal impact on the other layers. The six different layers of this architecture are listed below, along with the diagram (Burhan, Rehman, Khan & Kim, 2018).

· Application Layer

· Network Layer

· Security Layer

· Processing Layer

· Observer Layer

· Perception Layer

Picture source: Burhan, Rehman, Khan & Kim, 2018

The ability of IoT to deliver linkages of "things" across the world through miniature systems and sensor networks allows global connectivity. This poses questions regarding protection, privacy, and confidence issues when the information is exchanged (Ahanger & Aljumah, 2019).

Similar to every other IP-based System, actively behaving adversaries may try to scrutinize usable communications in order to collect information that can either be used to track consumer activity, or gathered and manipulated in the later stage of an aggressive attack. Adversaries may aim to catch the traffic at different points in the smart home network based on their strengths and priorities to obtain this kind of knowledge. Adversaries may, therefore, have an effect on the security and privacy of consumers, as they will gather details about the state of the smart home (Geneiatakis et al., 2017).

There are several relatively common standardized Smart Home protocols, such as X.10 powerline carrier communications, without some form of encryption, and built prior to linking such home control networks to the Internet. A plethora of networking protocols are now found in a household (Zwave, Insteon, Bluetooth, Zigbee, Ethernet, Wifi, RS232, RS485, C-bus, UPB, KNX, EnOcean, Thread). Each has its advantages and disadvantages, and it poses major difficulties to expect a heterogeneous network of several separate protocols to be handled effectively and safely by non-experts (Lin & Bergmann, 2016)

IoT offers a whole new means of connecting with people, devices, and even among devices themselves. The Internet of Things has reworked the Internet's destiny to make human life easy to communicate with all those wireless devices around us to control and to organize their tasks without our intervention. Now, these clever devices are attacked by some evil hackers, who ultimately jeopardize the protection of these IoT devices and have the potential to spread these threats far more widely than the Internet has to date (Kamble & Bhutad, 2018).

There has been ever-increasing use of smart home devices such as lights, smoke-alarms, baby monitors, etc. With more and more smart home devices being manufactured and put into use, the means by which the attacker can gain access to the device or the network increases, which in turn makes the security implementation challenging due to the factors such as mode of operation, device capabilities, manufacturer, etc. (Sivaraman et al., 2015). Hence there is a need to have a common security solution that can augment the security features offered by device manufacturers. This can be achieved through a network-level security solution with the use of SDN (Software-defined networking) to implement dynamic security rules (Sivaraman et al., 2015).

10.4.1 Middleware Architecture

According to Lin and Bergmann (2016), the middleware layer has a common interface, and the structure of data exchange is to extract the complicated details of the hardware. Lin and Bergmann (2016) mentioned that VIRTUS middleware is a solution based on XMPP (eXtensible Messaging and Presence Protocol). Lin and Bergamann (2016) stated that due to the complex software layers and cryptographic routines involved, it is hard to implement this architecture since IoT devices do not have the computational power or memory to support it. Also, if there are any coding errors by developers, it will directly translate to security issues in the IoT devices. Therefore, Lin and Bergmann (2016) rejected middleware architecture as a feasible solution for IoT devices.

A cloud architecture based on the three stages has been proposed, which uses IETF's CoAP protocol in Lin and Bergmann's (2016) paper. The positive aspects of cloud-based security architecture are it can allow for ease to connect and cooperate amongst the IoT devices. But due to the nature of cloud architecture, which needs continuous, uninterrupted connectivity, Lin and Bergmann (2016) concluded that this is not a viable option for providing security to smart home devices.

IoT gateway architecture works on the same LAN with other IoT devices and can allow for connectedness also a way to manage these devices from a central point. Lin and Bergmann (2016) stated that it also acts as a firewall to guard these smart home devices. Lin and Bergmann (2016) have suggested Server-Based Internet-Of-Things (SBIOTA) as a server that can provide an excellent solution for IoT. This concept uses an auto-configuration method, so it does not have to be interrupted with manual configuration. Lin and Bergmann (2016) have concluded this method to be their recommendation for preferred architecture and the reasoning for it being that even in the temporary absence of the Internet, it can still provide security through firewall and proxy and does not need complex middleware for the IoT devices.

Connectivity and Data protocols play a key role in IoT architecture. Data protocols provide rules/guidelines on how communications should be handled between IoT devices. According to (D. Bastos et al., 2018), some of the popular Data transfer protocols in IoT devices are HTTP/REST.  HTTP is a widely used Data transfer protocol in IoT devices to send and receive data. RESTful web services are stateless and utilize HTTP methods like GET, POST, PUT, DELETE. To secure HTTP communication, TLS should be implemented for data encryption (D.Bastos et al., 2018). Implementation of TLS will ensure a secure channel for communication and help prevent Man-in-the-Middle attacks.

10.5.3 Protocol # 3: CoAP

Constrained Application Protocol (CoAP) is an emerging message transfer protocol like HTTP as it uses request/response for communication (D. Bastos et al., 2018).  Giuseppe Nebbione, & Maria Carla Calzarossa (2017, p.8) classified the security threats of CoAP enabled devices as Message parsing, proxying and caching, IP spoofing, key generation. Vulnerabilities like Remote code execution are possible when messages are not properly parsed by the client-server parser. Improper implementation of access control checks will lead to unauthorized disclosure of data, which will break the confidentiality and integrity of messages.

As per Shouran, Ashari & Priyambodo (2019), many studies have concentrated on password security. One of the issues faced by the users is they are not able to change the default passwords that come up with the applications, and that helps the hackers to get control of the devices. These kinds of devices or any devices whose username and password have not also been changed also becomes the target for hackers. In order to overcome this, users need to have different passwords for different applications. User awareness and education are thus required when it comes to maintaining the security of IoT based smart home devices.

While performing qualitative research, it is essential to consider ethical concerns into account. Some of the key ethical concerns are anonymity, confidentiality, and informed consent (Sanjari et al., 2014).

Anonymity, confidentiality, and informed consent are usually more prevalent in the research that involves human subjects. The study conducted as a part of this research did not include any human subjects. Instead, it entirely relied on secondary data disclosed by the other researchers in peer-reviewed journals. The data researched doesn't include personally identifiable information and protected health information. This paper ensured to cite the references of the original researchers as and when the idea or quote is retrieved from the said journals and also ensured not to affect the original idea presented in peer-reviewed journals.

This paper is a qualitative study on various security issues with IoT based smart home devices. The paper explores case studies from various peer-reviewed journals. The research will follow the descriptive method to present the results.

This paper identified the various security issues with IoT smart home devices such as IoT being IP based, could expose the state of smart home, the complexity involved in handling different protocols in the heterogeneous network, and issues with verification and access control(Lin & Bergmann, 2016). We then compared the security features of multi-layered IoT architectures and highlighted the benefits of 6 layered architecture over other available architectures. The use of different protocols such as HTTP, MQTT & CoAP with IoT is explored. Apart from manufacturers trying to improve the security features of smart home devices, there is a need to enhance the security at the network level, which can be accomplished by implementing dynamic security rules using software-defined networking(SDN)(Sivaraman et al., 2015). User awareness and education plays a crucial role in the effective implementation and to realize the benefits of all security features either at the network level or on smart home devices. This includes educating users not to use the default passwords, not use the same password for multiple applications, and change the set password regularly.

Over the past decade, with the significance of IoT, "it has led to new threats and attacks that pose security issues to IoT devices, and there have been several improvements in the security features of the devices that use IoT (BV & G, 2017). Ultimately the main objective of these devices is to improve the quality of life and make the world a better place for human beings by making the devices around us understand and act according to our needs (Dohr, Modre-opsrian, Drobies & Schreier (as cited by BV & G, 2017)). There are several issues such as, as pointed out by Burhan, Rehman, Khan & Kim (2018, p. 6) that "Eavesdropping is an unauthorized real-time attack where private communications, such as phone calls, text messages, fax transmissions or video conferences are intercepted by an attacker. It tries to steal information that is transmitted over a network". Six layered architecture provides most of the tools to address the security issues (Burhan, Rehman, Khan & Kim, 2018). Using the HTTP makes IoT more secured than other protocols (Bastos, 2018). Burhan, Rehman, Khan, and Kim (2018) have not listed various security threats, but they also contended that future research is needed to overcome the existing security issues by stating there are several new challenges that currently exist, and with every new technological development, it brings its new challenges. Similarly, Gaikwad, Gabhane & Golait (2015) also expressed that there is very low security on the server-side of the Smart home systems, and designing a new secured system should be part of the future work.

Alhalafi, N., & Veeraraghavan, P. (2019). Privacy and Security Challenges and Solutions in IoT: A review. IOP Conference Series: Earth and Environmental Science, 322, 012013. doi:10.1088/1755-1315/322/1/012013

Ali, W., Dustgeer, G., Awais, M., & Shah, M. A. (2017). IoT based smart home: Security challenges, security requirements, and solutions. 2017 23rd International Conference on Automation and Computing (ICAC). doi:10.23919/iconac.2017.8082057

Bastos, D., Shackleton, M., & El-Moussa, F. (2018). Internet of Things: A Survey of Technologies and Security Risks in Smart Home and City Environments. Living In The Internet Of Things: Cybersecurity Of The IoT - 2018. doi: 10.1049/cp.2018.0030