IoT Security Model for Smart Cities based on a Metamodeling Approach
Received: 23 February 2024 | Revised: 8 March 2024 and 21 March 2024 | Accepted: 28 March 2024 | Online: 12 April 2024
Corresponding author: Daifallah Zaid Alotaibe
Abstract
Security solutions for the Internet of Things (IoT) in smart cities are complex and require a comprehensive approach to success. Several models and frameworks have been developed focusing on IoT security. Some deal with access controls and security and some with authentication and authorization in various forms. Literature still lacks a comprehensive IoT security model for smart cities, which can support the implementation of IoT. Accordingly, this study has set two objectives: to explore the present studies in IoT security for smart cities and to develop an IoT security model for smart cities based on the metamodeling approach. According to the findings of the study, the existing IoT security models for smart cities consider seven security aspects: authentication and authorization, device management, intrusion detection and prevention, device integrity, secure communication, secure data storage, and response to security incidents. The model developed in this study, called IoT Security Metamodel (IoTSM), combines these aspects. IoTSM captures the main qualities of IoT security practices in smart cities through domain security processes.
Keywords:
IoT security, Smart cities, Metamodel, MetamodelingDownloads
References
K. M. Alam, M. Saini, and A. E. Saddik, "Toward Social Internet of Vehicles: Concept, Architecture, and Applications," IEEE Access, vol. 3, pp. 343–357, 2015.
F. Alotaibi, A. Al-Dhaqm, and Y. D. Al-Otaibi, "A Conceptual Digital Forensic Investigation Model Applicable to the Drone Forensics Field," Engineering, Technology & Applied Science Research, vol. 13, no. 5, pp. 11608–11615, Oct. 2023.
M. H. Miraz, M. Ali, P. S. Excell, and R. Picking, "A review on Internet of Things (IoT), Internet of Everything (IoE) and Internet of Nano Things (IoNT)," in Internet Technologies and Applications, Wrexham, UK, Sep. 2015, pp. 219–224.
K. Xu, Y. Qu, and K. Yang, "A tutorial on the internet of things: from a heterogeneous network integration perspective," IEEE Network, vol. 30, no. 2, pp. 102–108, Mar. 2016.
D. Wang, B. Bai, K. Lei, W. Zhao, Y. Yang, and Z. Han, "Enhancing Information Security via Physical Layer Approaches in Heterogeneous IoT With Multiple Access Mobile Edge Computing in Smart City," IEEE Access, vol. 7, pp. 54508–54521, 2019.
R. Geisler, M. Klar, and C. Pons, "Dimensions and Dichotomy in Metamodeling," in 3rd BCS-FACS Northern Formal Methods Workshop, Ilkley, UK, Sep. 1998, pp. 1–20.
A. Alshammari, "A Novel Security Framework to Mitigate and Avoid Unexpected Security Threats in Saudi Arabia," Engineering, Technology & Applied Science Research, vol. 13, no. 4, pp. 11445–11450, Aug. 2023.
J. Whittle, "Workshops and Tutorials at the UML 2002 Conference," in International Conference on Model Driven Engineering Languages and Systems, Dresden, Germany, Oct. 2002, pp. 442–447.
R. M. S. Martins, "Secure and High Performance Framework for Smart Cities Based on Iot," M.S. thesis, Universidade do Minho, 2018.
A. Fayad, B. Hammi, and R. Khatoun, "An adaptive authentication and authorization scheme for IoT’s gateways: a blockchain based approach," in Third International Conference on Security of Smart Cities, Industrial Control System and Communications, Shanghai, China, Oct. 2018, pp. 1–7.
L. Prathibha and K. Fatima, "Exploring Security and Authentication Issues in Internet of Things," in Second International Conference on Intelligent Computing and Control Systems, Madurai, India, Jun. 2018, pp. 673–678.
R. Bellefleur and D. Wang, "IoT-Enabled Smart City Security Considerations and Solutions," 2018, [Online]. Available: https://repository.library.georgetown.edu/handle/10822/1053223.
M. A. Rashid and H. H. Pajooh, "A Security Framework for IoT Authentication and Authorization Based on Blockchain Technology," in 18th IEEE International Conference On Trust, Security And Privacy In Computing And Communications/13th IEEE International Conference On Big Data Science And Engineering (TrustCom/BigDataSE), Rotorua, New Zealand, Aug. 2019, pp. 264–271.
J. C. Ware, "Secure Authentication Mechanisms for Smart City IoT Infrastructure," M.S. thesis, Utica College, Utica, NY, USA, 2019.
S. Anawar, N. Zakaria, Z. Masud, M. Zulkiflee, N. Harum, and R. Ahmad, "IoT Technological Development: Prospect and Implication for Cyberstability," International Journal of Advanced Computer Science and Applications, vol. 10, no. 2, pp. 428–437, Jan. 2019.
S. M. Muzammal and R. K. Murugesan, "A Study on Secured Authentication and Authorization in Internet of Things: Potential of Blockchain Technology," in International Conference on Advances in Cyber Security, Penang, Malaysia, Aug. 2019, pp. 18–32.
R. M. A. Mohammad and M. M. Abdulqader, "Exploring Cyber Security Measures in Smart Cities," in 21st International Arab Conference on Information Technology, Giza, Egypt, Nov. 2020, pp. 1–7.
N. Chaabouni, "Intrusion detection and prevention for IoT systems using Machine Learning," Ph.D. dissertation, Universite de Bordeaux, Nouvelle-Aquitaine, France, 2020.
T. Mudawi, "IoT-HASS: A Framework For Protecting Smart Home Environment," Ph.D. dissertation, Dakota State University, Madison, WI, USA, 2020.
D. M. Mendez Mena, "Blockchain-based security framework for the internet of things and home networks," Ph.D. dissertation, Purdue University, West Lafayette, IN, USA, 2021.
M. Asif, Z. Aziz, M. Bin Ahmad, A. Khalid, H. A. Waris, and A. Gilani, "Blockchain-Based Authentication and Trust Management Mechanism for Smart Cities," Sensors, vol. 22, no. 7, Jan. 2022, Art. no. 2604.
A. Mohammad, H. Al-Refai, and A. A. Alawneh, "User Authentication and Authorization Framework in IoT Protocols," Computers, vol. 11, no. 10, Oct. 2022, Art. no. 147.
P. M. Rao and B. D. Deebak, "Security and privacy issues in smart cities/industries: technologies, applications, and challenges," Journal of Ambient Intelligence and Humanized Computing, vol. 14, no. 8, pp. 10517–10553, Aug. 2023.
A. Bhardwaj et al., "IIoT: Traffic Data Flow Analysis and Modeling Experiment for Smart IoT Devices," Sustainability, vol. 14, no. 21, Jan. 2022, Art. no. 14645.
U. Khalil, O. A. Malik, M. Uddin, and C.-L. Chen, "A Comparative Analysis on Blockchain versus Centralized Authentication Architectures for IoT-Enabled Smart Devices in Smart Cities: A Comprehensive Review, Recent Advances, and Future Research Directions," Sensors, vol. 22, no. 14, Jan. 2022, Art. no. 5168.
W. Fei, "Raspberry House: An Intrusion Detection And Prevention System For Internet Of Things (IOT)," M.S. thesis, Dalhousie University, Halifax, NS, Canada, 2022.
M. Polychronaki, D. G. Kogias, H. C. Leligkou, and P. A. Karkazis, "Blockchain Technology for Access and Authorization Management in the Internet of Things," Electronics, vol. 12, no. 22, Jan. 2023, Art. no. 4606.
S. Alghamdi, A. Albeshri, and A. Alhusayni, "Enabling a Secure IoT Environment Using a Blockchain-Based Local-Global Consensus Manager," Electronics, vol. 12, no. 17, Jan. 2023, Art. no. 3721.
S. Ahmed and M. Khan, "Securing the Internet of Things (IoT): A Comprehensive Study on the Intersection of Cybersecurity, Privacy, and Connectivity in the IoT Ecosystem," AI, IoT and the Fourth Industrial Revolution Review, vol. 13, no. 9, pp. 1–17, Sep. 2023.
U. A. Usmani, A. Happonen, and J. Watada, "Secure Integration of IoT-Enabled Sensors and Technologies: Engineering Applications for Humanitarian Impact," in 5th International Congress on Human-Computer Interaction, Optimization and Robotic Applications, Istanbul, Turkiye, Jun. 2023, pp. 1–10.
C. Zhonghua, S. B. Goyal, and A. S. Rajawat, "Smart contracts attribute-based access control model for security & privacy of IoT system using blockchain and edge computing," The Journal of Supercomputing, vol. 80, no. 2, pp. 1396–1425, Jan. 2024.
A. Kiran, P. Mathivanan, M. Mahdal, K. Sairam, D. Chauhan, and V. Talasila, "Enhancing Data Security in IoT Networks with Blockchain-Based Management and Adaptive Clustering Techniques," Mathematics, vol. 11, no. 9, Jan. 2023, Art. no. 2073.
A. S. Alraddadi, "A Survey and a Credit Card Fraud Detection and Prevention Model using the Decision Tree Algorithm," Engineering, Technology & Applied Science Research, vol. 13, no. 4, pp. 11505–11510, Aug. 2023.
S. Thavamani and C. Nandhini, "Major Security Issues and Data Protection in Cloud Computing and IoT," in Intelligent Techniques for Cyber-Physical Systems, 1st Edition., Boca Raton, FL, USA: CRC Press, 2023, pp. 317–336.
S. Cherbal, A. Zier, S. Hebal, L. Louail, and B. Annane, "Security in internet of things: a review on approaches based on blockchain, machine learning, cryptography, and quantum computing," The Journal of Supercomputing, vol. 80, no. 3, pp. 3738–3816, Feb. 2024.
S. C. Avik et al., "Challenges in Blockchain as a Solution for IoT Ecosystem Threats and Access Control: A Survey." arXiv, Nov. 26, 2023.
A. K. Tyagi, "Blockchain and Artificial Intelligence for Cyber Security in the Era of Internet of Things and Industrial Internet of Things Applications," in AI and Blockchain Applications in Industrial Robotics, Hershey, PA, USA: IGI Global, 2024, pp. 171–199.
I. U. Khan, M. Ouaissa, M. Ouaissa, Z. A. E. Houda, and M. F. Ijaz, Cyber Security for Next-Generation Computing Technologies. Boca Raton, FL, USA: CRC Press, 2024.
A. M. Rashad Al-dhaqm and M. A. Nagdi, "Detection and Prevention of Malicious Activities on RDBMS Relational Database Management Systems," International Journal of Scientific & Engineering Research, vol. 3, no. 9, Sep. 2012.
A. A. Alhussan, A. Al-Dhaqm, W. M. S. Yafooz, S. B. A. Razak, A.-H. M. Emara, and D. S. Khafaga, "Towards Development of a High Abstract Model for Drone Forensic Domain," Electronics, vol. 11, no. 8, Jan. 2022, Art. no. 1168.
A. M. R. Al- Dhaqm, S. H. Othman, S. Abd Razak, and A. Ngadi, "Towards adapting metamodelling technique for database forensics investigation domain," in International Symposium on Biometrics and Security Technologies, Kuala Lumpur, Malaysia, Aug. 2014, pp. 322–327.
A. Al-Dhaqm, S. H. Othman, W. M. S. Yafooz, and A. Ali, "Review of Information Security Management Frameworks," in Kids Cybersecurity Using Computational Intelligence Techniques, W. M. S. Yafooz, H. Al-Aqrabi, A. Al-Dhaqm, and A. Emara, Eds. New York, NY, USA: Springer, 2023, pp. 69–80.
M. Salem, S. H. Othman, A. Al-Dhaqm, and A. Ali, "Development of Metamodel for Information Security Risk Management," in Kids Cybersecurity Using Computational Intelligence Techniques, W. M. S. Yafooz, H. Al-Aqrabi, A. Al-Dhaqm, and A. Emara, Eds. New York, NY, USA: Springer, 2023, pp. 243–253.
A. Al-Dhaqm, W. M. S. Yafooz, S. H. Othman, and A. Ali, "Database Forensics Field and Children Crimes," in Kids Cybersecurity Using Computational Intelligence Techniques, W. M. S. Yafooz, H. Al-Aqrabi, A. Al-Dhaqm, and A. Emara, Eds. New York, NY, USA: Springer, 2023, pp. 81–92.
M. Saleh et al., "A Metamodeling Approach for IoT Forensic Investigation," Electronics, vol. 12, no. 3, Jan. 2023, Art. no. 524.
A. M. R. Al-Dhaqm, "SimplifiedI Database Forensic Invetigation Using Metamodeling Approach," Ph.D. dissertation, University of Technology Malaysia, Johor, Malaysia, 2019.
V. R. Kebande and I. Ray, "A Generic Digital Forensic Investigation Framework for Internet of Things (IoT)," in 4th International Conference on Future Internet of Things and Cloud, Vienna, Austria, Aug. 2016, pp. 356–362.
V. Kebande and H. Venter, "Requirements for achieving digital forensic readiness in the cloud environment using an NMB solution," in 11th International Conference on Cyber Warfare and Security, Boston, MA, USA, Mar. 2016, pp. 399–406.
A. Al-Dhaqm, S. Razak, R. A. Ikuesan, V. R. Kebande, and S. Hajar Othman, "Face Validation of Database Forensic Investigation Metamodel," Infrastructures, vol. 6, no. 2, Feb. 2021, Art. no. 13.
A. Al-Dhaqm, S. A. Razak, R. A. Ikuesan, V. R. Kebande, and K. Siddique, "A Review of Mobile Forensic Investigation Process Models," IEEE Access, vol. 8, pp. 173359–173375, 2020.
A. Al-Dhaqm et al., "Categorization and Organization of Database Forensic Investigation Processes," IEEE Access, vol. 8, pp. 112846–112858, 2020.
A. Al-Dhaqm, S. A. Razak, K. Siddique, R. A. Ikuesan, and V. R. Kebande, "Towards the Development of an Integrated Incident Response Model for Database Forensic Investigation Field," IEEE Access, vol. 8, pp. 145018–145032, 2020.
V. R. Kebande, R. A. Ikuesan, N. M. Karie, S. Alawadi, K.-K. R. Choo, and A. Al-Dhaqm, "Quantifying the need for supervised machine learning in conducting live forensic analysis of emergent configurations (ECO) in IoT environments," Forensic Science International: Reports, vol. 2, Dec. 2020, Art. no. 100122.
A. Al-Dhaqm, S. Razak, and S. H. Othman, "Model Derivation System to Manage Database Forensic Investigation Domain Knowledge," in IEEE Conference on Application, Information and Network Security, Langkawi, Malaysia, Nov. 2018, pp. 75–80.
A. Aldhaqm, S. A. Razak, S. H. Othman, A. Ali, and A. Ngadi, "Conceptual Investigation Process Model for Managing Database Forensic Investigation Knowledge," Research Journal of Applied Sciences, Engineering and Technology, vol. 12, no. 4, pp. 386–394, Feb. 2016.
A. Ali, S. A. Razak, S. H. Othman, and A. Mohammed, "Extraction of Common Concepts for the Mobile Forensics Domain," in International Conference of Reliable Information and Communication Technology, Johor Bahru, Malaysia, Apr. 2017, pp. 141–154.
A. Ali, S. Razak, S. Othman, and M. Arafat, "Towards Adapting Metamodeling approach for the Mobile Forensics Investigation Domain," in 1st International Conference on Innovation in Science and Technology, Kuala Lumpur, Malaysia, Apr. 2015, pp. 364–368.
M. A. Saleh, S. Hajar Othman, A. Al-Dhaqm, and M. A. Al-Khasawneh, "Common Investigation Process Model for Internet of Things Forensics," in 2nd International Conference on Smart Computing and Electronic Enterprise, Cameron Highlands, Malaysia, Jun. 2021, pp. 84–89.
A. Alshammari, "Detection and Investigation Model for the Hard Disk Drive Attacks using FTK Imager," International Journal of Advanced Computer Science and Applications, vol. 14, no. 7, pp. 767–774, 2023.
F. Ullah, C.-M. Pun, O. Kaiwartya, A. S. Sadiq, J. Lloret, and M. Ali, "HIDE-Healthcare IoT Data Trust ManagEment: Attribute centric intelligent privacy approach," Future Generation Computer Systems, vol. 148, pp. 326–341, Nov. 2023.
U. Khalil, Mueen-Uddin, O. A. Malik, and S. Hussain, "A Blockchain Footprint for Authentication of IoT-Enabled Smart Devices in Smart Cities: State-of-the-Art Advancements, Challenges and Future Research Directions," IEEE Access, vol. 10, pp. 76805–76823, 2022.
S. Kelly and R. Pohjonen, "Worst Practices for Domain-Specific Modeling," IEEE Software, vol. 26, no. 4, pp. 22–29, Jul. 2009.
A. Al-dhaqm, S. Razak, S. H. Othman, A. Ngadi, M. N. Ahmed, and A. A. Mohammed, "Development and validation of a Database Forensic Metamodel (DBFM)," PLOS ONE, vol. 12, no. 2, Feb. 2017, Art. no. e0170793.
A. Ali, S. Razak, S. Othman, R. Marie, A. Al-dhaqm, and M. Nasser, "Validating Mobile Forensic Metamodel Using Tracing Method," in Advances on Intelligent Informatics and Computing, New York, NY, USA: Springer, 2022, pp. 473–482.
S. R. Selamat, R. Yusof, and S. Sahib, "Mapping Process of Digital Forensic Investigation Framework," International Journal of Computer Science and Network Security, vol. 8, no. 10, pp. 163–169, 2008.
R. Ibrahim, N. S. Leng, R. C. M. Yusoff, G. N. Samy, S. Masrom, and Z. I. Rizman, "E-learning acceptance based on technology acceptance model (TAM)," Journal of Fundamental and Applied Sciences, vol. 9, no. 4S, pp. 871–889, 2017.
D. Pilone and N. Pitman, UML 2.0 in a Nutshell, Oreilly & Associates Inc, 2005.
Downloads
How to Cite
License
Copyright (c) 2024 Daifallah Zaid Alotaibe
This work is licensed under a Creative Commons Attribution 4.0 International License.
Authors who publish with this journal agree to the following terms:
- Authors retain the copyright and grant the journal the right of first publication with the work simultaneously licensed under a Creative Commons Attribution License that allows others to share the work with an acknowledgement of the work's authorship and initial publication in this journal.
- Authors are able to enter into separate, additional contractual arrangements for the non-exclusive distribution of the journal's published version of the work (e.g., post it to an institutional repository or publish it in a book), with an acknowledgement of its initial publication in this journal.
- Authors are permitted and encouraged to post their work online (e.g., in institutional repositories or on their website) after its publication in ETASR with an acknowledgement of its initial publication in this journal.
