Integration of the Internet of Things (IoT) into various application domains not only expands capabilities but also brings forth a multitude of challenges. These challenges revolve around the security of IoT devices, many of which are characterized by limited resources such as memory, power consumption, and computational power. This article examines key challenges associated with ensuring the security of IoT devices and proposes potential solutions and strategies adapted to resource constraints. Emphasis is placed on the development and analysis of lightweight cryptographic algorithms capable of providing robust data protection with minimal resource utilization. Strategies for eficient energy management and memory usage optimization are also discussed, critical for ensuring the stable and uninterrupted operation of IoT devices. The article highlights the necessity of developing adaptive security mechanisms that can efectively respond to dynamic operational conditions and resource constraints. The key importance of continuously updating security mechanisms to adapt to changing conditions and to guard against new and future cyber threats is underscored. In addition to technical aspects, the importance of strategic planning and innovation in IoT security is also illuminated. It is noted that further research and development should focus on creating integrated solutions that combine hardware, software, and managerial aspects to optimize overall eficiency and security of IoT systems. This article contributes to the understanding and resolution of security issues in IoT devices operating under resource constraints. It provides a broad overview of existing challenges and opportunities while suggesting directions for future research and development in this dynamically evolving field.
Embedded Internet of Things (IoT) devices are compact, integrated devices embedded in various objects
capable of collecting, processing, and utilizing data, as well as exchanging it over a network without
direct human involvement [
The significance of embedded IoT devices lies in their ability to add intelligence and functionality
to diferent systems, facilitating data collection, process automation, and productivity enhancement
[
However, the security of embedded IoT devices has become a key issue limiting their application [
Overcoming challenges related to the security of embedded IoT devices becomes a critical task in the context of their widespread integration into our everyday living spaces and industrial environments. The limited resources of these devices pose not only technical challenges but also serious potential consequences for user safety and infrastructure security. Failure to address the issue of limited resources and inadequate protection may lead to uncontrolled widespread access to confidential information, destruction of critical systems, or even the use of devices for malicious purposes.
The main security challenges of embedded IoT devices are associated with their inadequate protection and vulnerability to cyber attacks due to limited support for encryption and authentication, as well as insuficient capabilities for detecting and responding to potential threats. The aim of this research is to develop efective cryptographic protection strategies for embedded IoT devices with limited resources.
In the context of researching the security of embedded IoT devices, it is important to identify development perspectives aimed at ensuring their security and reliability. The development of efective cryptographic protection strategies is a key element of this process. Applying modern encryption and authentication methods will improve the reliability and accountability of embedded devices, providing a high level of protection in conditions of limited resources.
There are numerous studies dedicated to the security issues of embedded IoT devices with limited
resources [
Security of embedded IoT devices has been the subject of many works investigating vulnerability
issues related to limited computational capabilities, restricted memory capacity, and limited power
supply [
A significant research theme has been cryptographic protection strategies with limited resources
[
Further research should focus on efective methods to ensure the security of embedded IoT devices, considering resource constraints and the requirement for a high level of protection. Emphasizing eficient authentication and cryptographic mechanisms that take into account limited resources is identified as a key direction for future scientific research in this area.
The architecture of embedded IoT devices is presented as the interaction of three main components
[
The typical properties of embedded IoT devices, which form the core spectrum of their functional
and technical advantages, are accompanied by limitations related to deployment platforms and methods
of ensuring autonomy. In general, these limitations encompass the following aspects [
These outlined limitations impact the capabilities of embedded devices in implementing robust security measures and pose a challenge in ensuring data reliability and protection.
One of the key issues in the field of embedded IoT devices is the presence of vulnerabilities that can
be exploited for attacks and security breaches. Securing embedded IoT devices becomes a crucial
task as these devices are used in various life domains, ranging from household systems to critical
infrastructure [
() = × 100%, where () is the probability of an attack, is the number of successful attacks, is the total number of attack attempts. 2. Insuficient Cryptographic Protection: The use of weak or outdated encryption algorithms in IoT devices makes data more vulnerable to interception and compromise. If encryption employs keys of insuficient length or is vulnerable to known attacks, there is a risk of compromising the confidentiality and integrity of data, as well as threats to their availability. To determine the efectiveness of encryption, the Shannon encryption model can be utilized: where – the channel capacity, – the signal power, – the noise level.
= 2(1 +
), 3. Insuficient Software Updates: Limited memory in embedded devices can complicate the software update process. This creates a risk of temporary or permanent vulnerability of the device to new threats or vulnerabilities, as it may remain without updates to apply security patches or fix software defects that ensure security.
In the network of embedded IoT devices, ensuring security remains one of the main challenges. This is particularly crucial due to the limited resources characterizing these devices. Examining memory, energy consumption, and computational power issues, it can be observed that these aspects serve as potential security threats.
The limitation of memory in embedded systems complicates not only data storage but also the implementation of efective encryption methods. The reduced operational duration due to limited energy consumption becomes a starting point for potential DoS attacks. Additionally, limited computational power complicates the application of robust encryption and authentication methods.
Examining memory, energy consumption, and computational power, we can determine that: • Memory limitations in embedded devices can lead to bufer overflows and constraints in storing encryption keys, complicating the cryptographic protection of information. • Energy supply is a fundamental factor limiting the operational duration of devices and the risk of potential DoS attacks due to targeted expenditure of limited energy. • Limited computational power complicates the application of complex encryption algorithms and may contribute to the execution of malicious code in case of insuficient input data validation.
The discussed limitations expose risks that need to be carefully considered and adequately addressed in embedded IoT devices to ensure the reliability, confidentiality, and integrity of the processed data.
Limited memory capabilities can cause issues in implementing cryptographic protection for embedded devices due to bufer overflows and restricted capacity for key storage: 1. Bufer overflow creates the possibility of embedding malicious code or executing code in vulnerable areas. The result is the emergence of vulnerabilities that can be exploited by attackers. Attacks leveraging these vulnerabilities may lead to system compromise, unauthorized code execution, or leakage of sensitive data. 2. As a result of the limited memory capabilities of embedded IoT devices to store encryption keys, there is a risk of their compromise. This is due to the complexity in the processes of storing and managing encryption keys, which are critical elements for ensuring data security. Typically, for system security, it is important to have diverse keys for various encryption tasks. However, due to limited memory, it may be challenging to provide the necessary volume of unique keys for data encryption. 3. Key management also becomes a challenge due to limited resources. For information security, keys need to be eficiently stored, updated, and rotated. However, limited memory can restrict the capacity for storing and processing key information, complicating their efective management. Thus, the complex storage and management of keys can serve as a foundation for their compromise. If keys are not stored or managed properly, it can make them more accessible to attackers or increase the likelihood of system vulnerabilities to attacks aimed at obtaining these keys.
Considering the limited memory capabilities of embedded IoT devices, cryptographic protection may become vulnerable due to bufer overflows and dificulties in storing encryption keys.
Energy consumption of an embedded system may be insuficient for the operation of cryptographic protection, both due to the design features of autonomous IoT module and intentional unauthorized impact on their power components. Threats related to energy consumption pose a wide range of security risks for the system: 1. Energy Attacks. Attacks aimed at reducing the energy consumption of IoT devices pose a serious threat to their normal functioning. These attacks can be implemented by constantly activating devices, prompting them to consume excessive energy. The consequence of such excessive energy consumption can be the depletion of the device’s battery, leading to its shutdown or disruption of normal operation. This can be problematic, especially for devices operating on batteries or in conditions of limited power supply. Continuous excessive energy consumption can lead to a decrease in device performance and eficiency, making it more vulnerable to various types of attacks or limiting security capabilities due to insuficient energy for the normal operation of protective mechanisms. 2. Interruptions in Operation. Limited charge in an autonomous energy source can cause unforeseen interruptions in the device’s operation, creating serious security risks. When energy becomes limited, the device may abruptly shut down or transition into a low-power mode. Such interruptions in operation can lead to a decrease in the device’s reliability and may be exploited by malicious actors for attacks. As a result, data being processed or stored in the device at that moment may be lost or damaged. These unforeseen halts can create a window of opportunity for attacks on the device or its data, as they may be unavailable for protection or remain unprotected during such times. 3. Reaction Delays. Limited energy consumption in embedded IoT devices, aimed at energy conservation, can significantly impact their response time when detecting threats or attacks. This can lead to delays in identifying anomalies or responding to potential threats in the network. For energy-saving purposes, a device may operate in a standby mode, during which it is inactive or does not perform specific operations. In this mode, it may be less responsive to changes or anomalous situations, as it consumes a minimal amount of energy, afecting its ability to respond to real-time events. This delay in response can be critical in the case of rapidly evolving threats or attacks where an immediate response is required to avoid potential consequences. Limited energy consumption may impede the detection or reaction to such events, increasing the risk to the security of the system. These delays in detection or response can impact the overall reliability and security of the device in the face of persistent attacks or threats. 4. Impact on Encryption Algorithms. To ensure the security of IoT device data, encryption algorithms may be employed. However, in low energy consumption modes, their usage may be restricted, and less efective algorithms may be selected. This creates a risk of reducing the level of data protection, as the use of less reliable encryption methods can make data more vulnerable to attacks by malicious actors. Limited energy consumption can afect the eficiency of encryption in embedded devices. The compromise between energy savings and encryption eficiency can be a factor in increasing the vulnerability of devices to potential threats and cyber-attacks. In turn, the reduction in the level of data protection due to the use of less reliable encryption methods can complicate the recovery or protection of information in the event of attacks or unauthorized access to the device. 5. Low battery levels can significantly impact the efectiveness of cryptographic methods used to protect data. Cryptographic algorithms that demand substantial computational resources may operate unstably or lose eficiency due to limited energy supply. This can lead to a reduction in the speed or accuracy of applying cryptographic methods, diminishing the level of data protection. With low battery charges, a device may lack suficient power to efectively implement complex encryption algorithms, resulting in increased data processing times or even a decrease in the level of protection. Such unstable operation of cryptographic methods can compromise the security of the device, making it more vulnerable to attacks. 6. Recovery after power loss. Restoring the operation of an embedded IoT device to its correct functional state can be challenging following a power loss. This is because, during sudden shutdowns or disconnections, the device may lose information about its previous state and current data. The dificulty or even impossibility of returning to the previous state directly afects its reliability and functionality.
Let’s consider the efectiveness of protection against attacks when using an encryption algorithm, where eficiency is denoted as , the battery level is , and the type of cryptographic methodology is . One of the possible models of eficiency has the form of a linear function:
= · + · , where and are parameters reflecting the influence of the battery level and the type of cryptographic methodology, respectively.
Let’s assume the values of the coeficients are as follows: = 0.5 and = 0.8. The battery level () varies from 1 to 10, and the cryptographic methodology parameter () can take values of 1 or 2. The possible values of data protection eficiency (), calculated using model (1) and these parameters, are presented in table 1. (3) (4)
= · 2 + · 2 + · · + , where , , , are coeficients reflecting the interaction of the battery level and the type of cryptographic methodology on the efectiveness of data protection.
Models (3), (4) can be supported and refined through experiments, data analysis, and parameter tuning, taking into account the influence of various factors on the efectiveness of data protection at specific battery levels and specific types of cryptographic methodologies.
Cryptographic protection algorithms, in general, are quite complex and resource-intensive in terms of the computational resources of their technical platform. Therefore, insuficient computational power of IoT devices has several consequences for their security: 1. Limited capacity for strong encryption application. The incompatibility of the computational resources of the embedded device with the requirements of strong, computationally complex encryption algorithms creates a risk of resorting to weaker encryption methods. This limitation may compel the device to choose less resource-intensive computational methods, which, in turn, may have lower resistance to cyberattacks. 2. Authentication failure due to resource constraints. Computational limitations can diminish the suitability of an embedded device for implementing robust identity verification methods, such as biometric data or complex encryption algorithms, thereby increasing vulnerability to attacks. Additionally, the limited memory of embedded devices can complicate the storage and management of authentication-related data, such as passwords, keys, or ciphers. This may lead to the use of less secure methods for storing identification information or a reduction in the number of available authentication methods. Therefore, the challenge of implementing proper authentication in embedded devices is associated with both the potential complexity of authentication algorithms and ensuring secure processes for storing and managing identity information. Moreover, the constraint on computational power may negatively impact the authentication process itself, resulting in the implementation of slower or less reliable authentication processes. The limited speed of the embedded device in processing authentication requests can make them less responsive to user requests in real-time or increase response times. Overall, the rejection of robust authentication methods decreases the device’s level of protection.
In the context of security for embedded IoT devices, a key aspect is considering their resource constraints.
These constraints directly impact the efectiveness of implementing security mechanisms and strategies.
It is important to realize that each type of constraint – whether it’s memory, battery charge, or energy
consumption – poses unique challenges and requires specific solutions [
Creates the risk of unpredictable interruptions in the device’s operation.
Reduces cryptography eficiency due to low battery charge.
Leads to a transition to low-power mode, restricting the use of powerful encryption algorithms. Afects response speed to threats due to standby mode for energy conservation.
Memory limitations often impact the device’s ability to store encryption keys and other essential data, increasing the risk of unauthorized access and information leakage.
Meanwhile, battery charge limitations may lead to unforeseen disruptions in the device’s operation, reducing its reliability and the efectiveness of protective mechanisms. Finally, limited energy consumption can restrict the application of resource-intensive protective algorithms, particularly in the field of cryptographic security.
Each of these aspects requires detailed consideration and analysis to ensure efective and adequate protection for embedded IoT devices.
Memory constraints in IoT devices can pose a significant risk to data security. On one hand, limited memory can complicate the storage of large amounts of data or complex software algorithms necessary for efective cryptographic protection. On the other hand, insuficient memory can reduce the eficiency of key management, which is critically important for ensuring the security of communication processes. Memory limitations in IoT devices can lead to inadequate storage and management of encryption keys, increasing vulnerability to attacks.
The degree of impact of memory constraints on key storage, security management, and system vulnerabilities is illustrated in the diagram (figure 1). It is based on a conceptual analysis of the impact of memory constraints on these security aspects of IoT devices. The percentages indicated on the diagram reflect widely accepted expert estimates in the field of IoT cybersecurity, based on their experience and analysis of current trends in IoT technology development. These data do not represent specific quantitative research but rather provide a general understanding of trends in the field.
Battery charge limitations in IoT devices can cause disruptions in their operation, especially in critical situations. This may lead to a failure to perform essential security operations and unauthorized access to data. Additionally, a low battery charge can limit the efectiveness of encryption and other protective mechanisms. The limited battery life of IoT devices can result in unexpected shutdowns or reduced security functionality, increasing the risk of data leaks.
Let’s define a function that relates the battery charge level to the runtime of security protocols. Let be the initial battery charge level, and be the duration of security algorithm operation in hours. Then: = · ln () + , (5) where and are constants based on the energy consumption characteristics of the device.
The diagram (figure 2) illustrates the impact of battery charge limitations on the activity of security protocols, the risk of data loss, and the constraints of protective mechanisms. This diagram is developed based on a qualitative analysis of the efects that battery charge limitations may have on the security aspects of IoT devices. The percentages on the diagram reflect estimated conclusions derived from theoretical considerations and expert opinions in this field, emphasizing the importance of considering energy aspects in the development of protective strategies for IoT. The diagram shows that battery charge limitations have the most significant impact on the risk of data loss during interruptions in operation. This underscores the importance of developing energy-eficient solutions to ensure the reliability and continuity of security functions.
Limitations on energy consumption in IoT devices can be an obstacle to using resource-intensive security algorithms, especially in the field of cryptographic protection. This may lead to the selection of less powerful, and therefore less secure, encryption algorithms. Additionally, limited energy can slow down the processes of detecting and responding to potential cyber threats. The dificulty of using complex cryptographic algorithms in IoT devices makes them vulnerable to advanced cyber-attacks.
Let’s model the eficiency of cryptographic algorithms in relation to energy consumption. Let represent the efectiveness of the applied algorithm’s security properties, and represent energy consumption. Then, the eficiency of cryptographic algorithms can be described by a polynomial function: = 1 · 2 + 2 · + 3, (6) where 1, 2 and 3 are coeficients determined based on the computational capabilities of the device.
The figure 3 depicts the diagram of the impact of energy consumption constraints on the security of IoT devices. The data for this diagram were formulated based on expert discussions and an assessment of potential consequences of limited energy consumption on the protective mechanisms of IoT devices. The percentage indicators reflect the generalized expert opinion on the importance of this aspect in the context of the development and application of cryptographic security systems. The diagram shows that limited energy consumption most significantly afects the selection and efectiveness of secure algorithms. This emphasizes the need for the development of energy-eficient cryptographic solutions that can provide an adequate level of security with constrained energy consumption.
In the context of ensuring the security of IoT devices, optimizing their limited resources becomes crucial. This requires an innovative approach that takes into account both technical constraints and security needs. By focusing on key aspects of such limitations, such as memory, battery charge, and energy consumption, efective strategies can be developed to enhance the security level of IoT systems. 1. Lightweight Cryptographic Algorithms: Development and use of cryptographic algorithms that require minimal resources for execution but still provide reliable data protection. 2. Eficient Energy Management Algorithms: Implementation of algorithms that optimize energy consumption without compromising security can ensure longer device runtime and security system reliability. 3. Memory Usage Optimization: Development of methods for eficient utilization of limited memory space, including compact storage of encryption keys and using memory for security functions. 4. Adaptive Security Mechanisms: Creation of security systems capable of adapting to changing resource constraints to maintain an optimal level of protection in diferent operating conditions. 5. Improvement of Authentication Algorithms: Implementation of efective authentication algorithms that provide a high level of security with limited computational resources. 6. Secure Communication Protocols: Development of specialized communication protocols for IoT that are optimized for eficient resource utilization and ensure reliable data protection.
These strategies form the foundation for ensuring the security of IoT devices operating in resourceconstrained environments. They enable a balance between security needs and constraints in memory, energy consumption, and operational resources, providing efective protection against potential threats.
In light of the presented analysis, it is crucial to delve deeper into the discussion of the perspectives for further research in the field of IoT security with constrained resources. One of the key directions is the development and implementation of more eficient algorithms that consider the specificity of IoT devices. This includes not only technical aspects but also taking into account the diversity of applications of IoT devices in various industries.
The need for improvement in cryptographic protection methods is evident, especially in the context of limited memory and computational resources. The development of lightweight yet robust cryptographic algorithms can be key to enhancing overall security. Additionally, there is a necessity to develop flexible and adaptive security systems capable of efectively operating under resource constraints and quickly adapting to new threats and challenges.
Significant potential lies in research on energy-eficient technologies for IoT devices. Energy is a critical resource for many IoT systems, so developing methods for eficient energy management can significantly increase the autonomy and reliability of devices. It is also essential to consider the interaction between diferent components of IoT systems to optimize overall eficiency and security.
In the context of ensuring security for IoT devices with limited resources, it is important to recognize that efective security requires a multidimensional approach. This approach should involve the integration of technical innovations and strategic planning. Considering the constraints in memory, power consumption, and computational power, the development of lightweight cryptographic algorithms that utilize minimal resources becomes a priority to ensure reliable data protection.
Adapting security systems to the changing operational conditions of IoT devices is another crucial aspect. Security systems should be flexible, adaptive, and capable of maintaining a high level of security despite resource limitations. This includes not only technical aspects but also operational resource management, especially concerning energy and memory.
Innovations in authentication algorithms and energy-eficient technologies are essential for enhancing the autonomy and reliability of IoT devices. Further research in these areas should focus on developing solutions that can eficiently operate under resource constraints while providing reliable protection against current and future cyber threats.
Given the rapid advancement of technologies and the constant growth of cyber threats, continuous updating and adaptation of security mechanisms are integral parts of a security assurance strategy. Updating security solutions in response to new threats will help maintain a high level of protection while expanding the possibilities of applying IoT technologies in various domains. 10. Authors contribution The authors confirm contribution to the paper as follows: study conception and design: I. Rozlomii, A. Yarmilko; data collection: I. Rozlomii; analysis and interpretation of results: I. Rozlomii, A. Yarmilko, S. Naumenko; draft manuscript preparation: I. Rozlomii, A. Yarmilko, S. Naumenko. All authors reviewed the results and approved the final version of the manuscript.