Yes / Web of Things (WoT) can be considered as a merger of newly emerging paradigms of Internet of Things (IoT) and cloud computing. Rapidly varying, highly volatile and heterogeneous data traffic is a characteristic of the WoT. Hence, the capture, processing, storage and exchange of huge volumes of data is a key requirement in this environment. The crucial resources in the WoT are the sensing devices and the sensing data. Consequently, access control mechanisms employed in this highly dynamic and demanding environment need to be enhanced so as to reduce the end-to-end latency for capturing and exchanging data pertaining to these underlying resources. While there are many previous studies comparing the advantages and disadvantages of access control mechanisms at the algorithm level, vary few of these provide any detailed comparison the performance of these access control mechanisms when used for different data handling procedures in the context of data capture, processing and storage. This study builds on previous work on token-based access control mechanisms and presents a comparison of two different approaches used for handling sensing devices and data in the WoT. It is shown that the aggregated data submission approach is around 700% more efficient than the serial payload submission procedure in reducing the round-trip response time.

Yes / The proliferation of inter-connected devices in critical industries, such as healthcare and power grid, is changing the perception of what constitutes critical infrastructure. The rising interconnectedness of new critical industries is driven by the growing demand for seamless access to information as the world becomes more mobile and connected and as the Internet of Things (IoT) grows. Critical industries are essential to the foundation of today’s society, and interruption of service in any of these sectors can reverberate through other sectors and even around the globe. In today’s hyper-connected world, the critical infrastructure is more vulnerable than ever to cyber threats, whether state sponsored, criminal groups or individuals. As the number of interconnected devices increases, the number of potential access points for hackers to disrupt critical infrastructure grows. This new attack surface emerges from fundamental changes in the critical infrastructure of organizations technology systems. This paper aims to improve understanding the challenges to secure future digital infrastructure while it is still evolving. After introducing the infrastructure generating big data, the functionality-based fog architecture is defined. In addition, a comprehensive review of security requirements in fog-enabled IoT systems is presented. Then, an in-depth analysis of the fog computing security challenges and big data privacy and trust concerns in relation to fog-enabled IoT are given. We also discuss blockchain as a key enabler to address many security related issues in IoT and consider closely the complementary interrelationships between blockchain and fog computing. In this context, this work formalizes the task of securing big data and its scope, provides a taxonomy to categories threats to fog-based IoT systems, presents a comprehensive comparison of state-of-the-art contributions in the field according to their security service and recommends promising research directions for future investigations.

Yes

Yes / Technological advancements have been evolving for so long, particularly Internet of Things (IoT) technology that has seen an increase in the number of connected devices surpass non IoT connections. It has unlocked a lot of potential across different organisational settings from healthcare, transportation, smart cities etc. Unfortunately, these advancements also mean that cybercriminals are constantly seeking new ways of exploiting vulnerabilities for malicious and illegal activities. IoT is a technology that presents a golden opportunity for botnet attacks that take advantage of a large number of IoT devices and use them to launch more powerful and sophisticated attacks such as Distributed Denial of Service (DDoS) attacks. This calls for more research geared towards the detection and mitigation of botnet attacks in IoT systems. This paper proposes a feature selection approach that identifies and removes less influential features as part of botnet attack detection method. The feature selection is based on the frequency of occurrence of the value counts in each of the features with respect to total instances. The effectiveness of the proposed approach is tested and evaluated on a standard IoT dataset. The results reveal that the proposed feature selection approach has improved the performance of the botnet attack detection method, in terms of True Positive Rate (TPR) and False Positive Rate (FPR). The proposed methodology provides 100% TPR, 0% FPR and 99.9976% F-score.

Reaping the benefits of the Internet of Things (IoT) system is contingent upon developing IoT-specific security and privacy solutions. Conventional security and authentication solutions often fail to meet IoT requirements due to the computationally limited and portable nature of IoT objects. Privacy in IoT is a major issue especially in the light of current attacks on Facebook and Uber. Research efforts in both the academic and the industrial fields have been focused on providing security and privacy solutions that are specific to IoT systems. These solutions include systems to manage keys, systems to handle routing protocols, systems that handle data transmission, access control for devices, and authentication of devices. One of these solutions is Blockchain, a trust-less peer-to-peer network of devices with an immutable data storage that does not require a trusted party to maintain and validate data entries in it. This emerging technology solves the problem of centralization in systems and has the potential to end the corporations control over our personal information. This unique characteristic makes blockchain an excellent candidate to handle data communication and storage between IoT devices without the need of oracle nodes to monitor and validate each data transaction. The peer-to-peer network of IoT devices validates data entries before being added to the blockchain database. However, accurate authentication of each IoT device using simple methods is another challenging problem. In this dissertation, a complete novel system is proposed to authenticate, verify, and secure devices in IoT systems. The proposed system consists of a blockchain framework to collect, monitor, and analyze data in IoT systems. The blockchain based system exploits a method, called Sharding, in which devices are grouped into smaller subsets to provide a scalable system. In addition to solving the scalability problem in blockchain, the proposed system is secured against the 51% attack in which a malicious node tries to gain control over the majority of devices in a single shard in order to disrupt the validation process of data entries. The proposed system dynamically changes the assignment of devices to shards to significantly decrease the possibility of performing 51% attacks. The second part of the novel system presented in this work handles IoT device authentication. The authentication framework uses device-specific information, called fingerprints, along with a transfer learning tool to authenticate objects in the IoT. The framework tracks the effect of changes in the physical environment on fingerprints and uses unique IoT environmental effects features to detect both cyber and cyber-physical emulation attacks. The proposed environmental effects estimation framework showed an improvement in the detection rate of attackers without increasing the false positives rate. The proposed framework is also shown to be able to detect cyber-physical attackers that are capable of replicating the fingerprints of target objects which conventional methods are unable to detect. In addition, a transfer learning approach is proposed to allow the use of objects with different types and features in the environmental effects estimation process. The transfer learning approach was also implemented in cognitive radio networks to prevent primary users emulation attacks that exist in these networks. Lastly, this dissertation investigated the challenge of preserving privacy of data stored in the proposed blockchain-IoT system. The approach presented continuously analyzes the data collected anonymously from IoT devices to insure that a malicious entity will not be able to use these anonymous datasets to uniquely identify individual users. The dissertation led to the following key results. First, the proposed blockchain based framework that uses sharding was able to provide a decentralized, scalable, and secured platform to handle data exchange between IoT devices. The security of the system against 51% attacks was simulated and showed significant improvements compared to typical blockchain implementations. Second, the authentication framework of IoT devices is shown to yield to a 40% improvement in the detection of cyber emulation attacks and is able to detect cyber-physical emulation attacks that conventional methods cannot detect. The key results also show that the proposed framework improves the authentication accuracy while the transfer learning approach yields up to 70% additional performance gains. Third, the transfer learning approach to combine knowledge about features from multiple device types was also implemented in cognitive radio networks and showed performance gains with an average of 3.4% for only 10% relevant information between the past knowledge and the current environment signals. / Doctor of Philosophy / The Internet of things (IoT) system is anticipated to reach billions of devices by the year 2020. With this massive increase in the number of devices, conventional security and authentication solutions will face many challenges from computational limits to privacy and security challenges. Research on solving the challenges of IoT systems is focused on providing lightweight solutions to be implemented on these low energy IoT devices. However these solutions are often prone to different types of attacks. The goal of this dissertation is to present a complete custom solution to secure IoT devices and systems. The system presented to solve IoT challenges consists of three main components. The first component focuses on solving scalability and centralization challenges that current IoT systems suffer from. To accomplish this a combination of distributed system, called blocchain, and a method to increase scalability, called Sharding, were used to provide both scalability and decentralization while maintaining high levels of security. The second component of the proposed solution consists of a novel framework to authenticate the identity of each IoT device. To provide an authentication solution that is both simple and effective, the framework proposed used a combination of features that are easy to collect, called fingerprints. These features were used to model the environment surrounding each IoT device to validate its identity. The solution uses a method called transfer learning to allow the framework to run on different types of devices. The proposed frameworks were able to provide a solution that is scalable, simple, and secured to handle data exchange between IoT devices. The simulation presented showed significant improvements compared to typical blockchain implementations. In addition, the frameworks proposed were able to detect attackers that have the resources to replicate all the device specific features. The proposed authentication framework is the first framework to be able to detect such an advanced attacker. The transfer learning tool added to the authentication framework showed performance gains of up to 70%.

Yes / The rapid proliferation of internet-connected devices in public and private spaces offers humanity numerous conveniences, including many safety benefits. However, unlocking the full potential of the Internet of Things (IoT) would require the assurance that IoT devices and applications do not pose any safety hazards to the stakeholders. While numerous efforts have been made to address security-related challenges in the IoT environment, safety issues have yet to receive similar attention. The safety attribute of IoT systems has been one of the system’s vital non-functional properties and a remarkable attribute of its dependability. IoT systems are susceptible to safety breaches due to a variety of factors, such as hardware failures, misconfigurations, conflicting interactions of devices, human error, and deliberate attacks. Maintaining safety requirements is challenging due to the complexity, autonomy, and heterogeneity of the IoT environment. This article explores safety challenges across the IoT architecture and some application domains and highlights the importance of safety attributes, requirements, and mechanisms in IoT design. By analysing these issues, we can protect people from hazards that could negatively impact their health, safety, and the environment. / The full text will be available at the end of the publisher's embargo: 11th Feb 2025

Internet of things (IoT) is envisioned as a promising paradigm to interconnect enormous wireless devices. However, the success of IoT is challenged by the difficulty of access management of the massive amount of sporadic and unpredictable user traffics. This thesis focuses on the contention-based random access in massive cellular IoT systems and introduces two novel frameworks to provide enhanced scalability, real-time quality of service management, and resource efficiency. First, a local communication based congestion control framework is introduced to distribute the random access attempts evenly over time under bursty traffic. Second, a multi-agent reinforcement learning based preamble selection framework is designed to increase the access capacity under a fixed number of preambles. Combining the two mechanisms provides superior performance under various 3GPP-specified machine type communication evaluation scenarios in terms of achieving much lower access latency and fewer access failures. / Master of Science / In the age of internet of things (IoT), massive amount of devices are expected to be connected to the wireless networks in a sporadic and unpredictable manner. The wireless connection is usually established by contention-based random access, a four-step handshaking process initiated by a device through sending a randomly selected preamble sequence to the base station. While different preambles are orthogonal, preamble collision happens when two or more devices send the same preamble to a base station simultaneously, and a device experiences access failure if the transmitted preamble cannot be successfully received and decoded. A failed device needs to wait for another random access opportunity to restart the aforementioned process and hence the access delay and resource consumption are increased. The random access control in massive IoT systems is challenged by the increased access intensity, which results in higher collision probability. In this work, we aim to provide better scalability, real-time quality of service management, and resource efficiency in random access control for such systems. Towards this end, we introduce 1) a local communication based congestion control framework by enabling a device to cooperate with neighboring devices and 2) a multi-agent reinforcement learning (MARL) based preamble selection framework by leveraging the ability of MARL in forming the decision-making policy through the collected experience. The introduced frameworks are evaluated under the 3GPP-specified scenarios and shown to outperform the existing standard solutions in terms of achieving lower access delays with fewer access failures.

The Internet of Things (IoT) is composed of billions of sensors and actuators that have varying tasks aimed at making industry, healthcare, and home life more efficient. These sensors and actuators are mainly low-powered and resource-constrained embedded devices with little room for implementing IP security in addition to their main function. With the fact that more of these devices are using IPv6 addressing, we seek to adapt a moving-target defense measure called Moving Target IPv6 Defense for use with embedded devices in order to add an additional layer of security. This adaptation, which we call Micro-Moving Target IPv6 Defense, operates within IPv6 over Low power Wireless Personal Area Networks (6LoWPAN) which is used in IEEE 802.15.4 wireless networks in order to establish IPv6 communications. The purpose of this defense is to obfuscate the communications between a sensor and a server in order to thwart a potential attacker from performing eavesdropping, denial-of-service, or man-in-the-middle attacks. We present our work in establishing this security mechanism and analyze the required control overhead on the wireless network. / Master of Science

Advances in speech recognition and voice synthesis software now allow "smart agents" (e.g., voice-controlled devices like Amazon's Alexa and Google Home) to interact naturally with humans. The machines have a skills repertoire with which they can "communicate" and form relationships with consumers – managing aspects of their daily lives and providing advice on various issues including purchases. This dissertation develops three essays that examine the role played by the smart agent's voice (rational vs. emotional) in such relationships. The social cognition and persuasion literature on interpersonal communication serves as a comparison backdrop. In Essay 1, I investigate how identical purchase recommendations delivered in a rational or an emotional voice elicit different consumer responses, when the voice is ascribed to a human versus a smart agent. I argue that consumers distinctively categorize smart agents and humans, which, in turn, leads them to have different expectations when interacting with them. In Essay 2, I focus on how a smart agent's vocal tone (rational vs. emotional) influences consumer compliance with the agent's recommendation as well as the role of trust as a mediator of the underlying process. I find that the level of intimacy in the relationship between the smart agent and the human user moderates whether the voice effect on persuasion operates through trust that is cognitively or affectively rooted. In Essay 3, I examine the proposition that consumers may anthropomorphize a smart agent both mindfully (consciously) and mindlessly (non-consciously), depending on the agent's voice. In addition to using extant measures of the degree to which anthropomorphism is explicit (conscious), I develop an auditory analog of the implicit association test (IAT) that assesses implicit (non-conscious) anthropomorphism. In additional experiments, I further assess the robustness of the auditory IAT test and demonstrated a dissociation between the measures of the explicit and implicit subconstructs of anthropomorphism. Taken together, these essays contribute to our understanding of the factors driving consumer relationships with smart agents in the rapidly evolving IoT world. / Doctor of Philosophy / Advances in artificial intelligence technologies are creating "smart devices," i.e., machines that can "understand" how people talk and respond meaningfully to such communication in their own voices. Thus, familiar voice-controlled devices like Amazon's Alexa and Google Home are now increasingly able to "communicate" and form relationships with consumers – managing aspects of their daily lives and providing advice on various issues including purchases. However, little is known about how a smart agent's vocal tones (rational vs. emotional) may influence how consumers perceive and relate to the smart agent. My primary goal in this research is to contribute to our understanding of the role played by the smart agent's voice (rational vs. emotional) in such relationships. Specifically, in Essay 1, I investigate how identical purchase recommendations delivered in a rational or an emotional voice elicit different consumer responses, when the voice is ascribed to a human versus a smart agent. I argue that consumers perceive smart agents and humans as belonging to distinct categories, which leads them to have different expectations when interacting with them. In Essay 2, I focus on how a smart agent's vocal tone (rational vs. emotional) influences consumer compliance with the agent's recommendation as well as the role of trust as a mediator of the underlying process. The level of intimacy in the relationship between the smart agent and the human user influences whether the voice effect on persuasion is driven by trust that is rooted in cognition (knowledge, competence) or affect (caring, warmth). In Essay 3, I examine whether consumers imbue humanlike qualities (anthropomorphize) a smart agent both mindfully (consciously) and mindlessly (non-consciously) based on the agent's voice. In addition to using available measures of conscious anthropomorphism, I develop an auditory analog of the implicit association test (IAT) to assesses implicit (non-conscious) anthropomorphism. In additional experiments, I assess the robustness of the auditory IAT test and the relationship between measures of mindful and mindless anthropomorphism. Taken together, the research reported in these three essays contributes to our understanding of the factors driving consumer relationships with smart agents in the rapidly evolving IoT (Internet of Things) world.

Internet of Things require a continuous power supply for longevity and energy harvesting from ambient sources enable sustainable operation of such embedded devices. Using selfpowered power supply gives raise two scenarios, where there is surplus or scarce harvested energy. In situations where the harvester is capable of harvesting beyond its storage capacity, the surplus energy is wasted. In situations where the harvester does not have sufficient resources, the sparse harvested energy can only transiently power the device. Transiently powered devices, referred to as intermittent computing devices, ensure forward progress by storing checkpoints of the device state at regular intervals. Irrespective of the availability of energy, the device should have adequate security. This thesis addresses the security of energy harvested embedded devices in both energy scenarios. First, we propose precomputation, an optimization technique, that utilizes the surplus energy. We study two cryptographic applications, namely bulk encryption and true random number generation, and we show that precomputing improves energy efficiency and algorithm latency in both applications. Second, we analyze the security pitfalls in transiently powered devices. To secure transiently powered devices, we propose the Secure Intermittent Computing Protocol. The protocol provides continuity to underlying application, atomicity to protocol operations and detects replay and tampering of checkpoints. Both the proposals together provide comprehensive security to self-powered embedded devices. / Master of Science / Internet of Things(IoT) is a collection of interconnected devices which collects data from its surrounding environment. The data collected from these devices enable emerging technologies like smart home and smart cities, where objects are controlled remotely. With the increase in the number of such devices, there is a demand for self-powered devices to conserve electrical energy. Energy harvesters are suitable for this purpose because they convert ambient energy into electrical energy to be stored in an energy buffer, which is to be used when required by the device. Using energy harvesters as power supply presents us with two scenarios. First, when there is sufficient ambient energy, the surplus energy, which is the energy harvested beyond the storage capacity of the buffer, is not consumed by the device and thus, wasted. Second, when the harvested energy is scarce, the device is forced to shutdown due to lack of power. In this thesis, we consider the overall security of an energy harvested IoT device in both energy scenarios. We optimize cryptographic algorithms to utilize the surplus energy and design a secure protocol to protect the device when the energy is scarce. Utilizing both the ideas together provides adequate security to the Internet of Things.