Threat Taxonomy in IOT

Threat Taxonomy in IOT

1. Identity Management

   • Authentication
     • Brute Force
     • Insufficient Authentication
     • Weak Password Recovery Validation
   • Access Control
   • Privacy Control
   • Authorization
     • Authorization security models
       • Peer 2 Peer
         • Block Chain
           • Research Question / Gap
             • What is the problem of Other models ?
             • What are criteria to meet ?
             • The linkage between peer to peer and cloud based and client server
         • Attribute based Authorization
       • Client Server
         • CoAP
         • OATH 2.0
       • Cloud based
         • Cloud Authorization
         • Fog based Authorisation
     • Authorization Threats
       • session hijacking
       • replay attacks.
       • Blackhole attack
       • Eavesdropping attack
       • Identity theft attack
       • Successive-response attack
       • Packet analysis attack
       • Stolen-verifier attack
     • Requirements
       • IoT adoption is set to rise exponentially in the coming years, but security, and a lack of in-house skills to manage that security risk, still feature at the top of business leaders’ concerns.
       • IoT devices can generate, process, and exchange vast amounts of critical data as well as privacy-sensitive information, and hence are appealing targets of various cyber attacks
       • The IoT devices interact with each other and connected systems and infrastructures in a secure manner
       • Authentication & Data integrity
       • Confidentiality (Encryption) is a NOT always required!
       • Secure against node(s) key leakage

2. Communication Threat

   • DOS
   • Spoofing
   • Network Injection

3. Embedded Security

   • Device Authentication
   • Secure Environment

4. Storage Management

   • Integrity
   • Confidentiality
   • Key management

5. Physical Threat

   • Micro-probing
   • Reverse Engineering

6. Dynamic Binding

   • Integration Of service and names
   • Management of Implicit names
   • Naming and Address mechanism

7. Side Channel Threat

   • Cache attack
   • Timing attack
   • Power-monitoring attack
   • Electromagnetic attack
   • Acoustic cryptanalysis
   • Acoustic cryptanalysis
   • Differential fault analysis
   • Data remanence
   • Software-initiated fault attacks
   • Optical attack

8. Kernel Attack

   • initiated by user
   • Public API
   • Architecture Flaws
   • Bug exploitation
   • Subverting OS initialization
   • Modifying on disc
   • Drivers
     • Application driver
     • Protocol Driver

Bilder und Dateien der Mindmap