WoT Communication Protocol Security and Privacy Issues
WoT Communication Protocol Security and Privacy Issues
复制标题
WoT 通信协议安全和隐私问题
DOI：
10.14569/ijacsa.2020.0110319
复制
发表时间：
2020
影响因子：
0.9
通讯作者：
Khuda Bux
中科院分区：
文献类型：
--
作者：
Sadia Murawat;Fahim Tahir;M. Anjum;M. A. Soomro;Saima Siraj;Zojan Memon;Anees Muhammad;Khuda Bux
在本文中，我们提出了一种新的方法来防止物联网（IoT）受到假冒设备的侵害，并通过在物联网（WoT）中使用第三方应用程序接口（RestAPI）来强调隐私问题。为了方便生活，物联网设备、传感器和射频识别（rfid）的使用迅速增加。例如用于交通运输的车辆监控、出租车服务、用于患者健康状况监测的医疗保健、智能汽车、智能电网和智能家居等。因此，为了获得经济利益，攻击者将这些网络或协议作为目标，而对手则试图破坏组织的声誉或窃取知识产权。从过去的二十多年来看，注入漏洞对web应用的威胁更大，安全风险仍然存在。新的安全挑战以IoT或WoT（物联网）通信协议的形式出现在安全专业人员或安全研究人员身上。这些协议消息队列遥测传输（MQTT）、约束应用协议（CoAP）、WebSockets和RestAPI具有不同类型的安全问题。分别插入假设备，在WebSocket连接中不实现身份验证，使用未经验证的RestAPI可能泄露用户隐私。我们在个人主页（PHP）中开发了一个程序，用于检测物联网网络中的新设备。有了这个，用户的隐私和数据将得到保护，以及WoT底层协议的一些关键安全问题。
In this paper, we have proposed a novel approach for the prevention of the Internet of Things (IoT) from fake devices and highlighted privacy issues by using third party Application Program Interface (RestAPI) in Web of Things (WoT). For the ease of life, the usage of IoT devices, sensors, and Radio-Frequency Identifications (RFIDs) increased rapidly. Such as in transport for monitoring vehicles, taxi services, healthcare for patient’s health condition monitoring, smart cars, smart grids, and smart homes, etc. Due to this for financial gain attackers are targeting these networks or protocol and adversaries are trying to damage the reputation of the organization or to steal intellectual property. From the last two decades or more, the injection vulnerabilities are more threatening security risks for the web application still exists. The new security challenges occur for the security professional or security researchers in the form of IoT or WoT (Web of Things) communication protocols implementation. These protocol Message Queuing Telemetry Transport (MQTT), Constrained Application Protocol (CoAP), WebSockets, and RestAPI have a different type of security issues. Respectively insertion of fake devices, authentication is not implemented in WebSocket connections, and user’s privacy can be leaked with the use of RestAPI without its validation. We have developed a program in Personal Home Pages (PHP) for the detection of new devices in the IoT network. With this, the user’s privacy and data will be protected along with some critical security issues of WoT underlying protocols.