Lightweight cryptography in IoT networks: A survey

Highlights

• We first discuss essentiality of security for resource constrained IoT networks. We also discuss the IoT architectural model and various threat according to the IoT environment.

• We then classified the most recent developed algorithm into two parts and evaluate recently developed block cipher and stream cipher algorithms in terms of security.

• We also present a comparative study of recently proposed IoT-related state-of-art security ciphers.

• Finally, we discuss some future challenges for security ciphers that need to be addressed in the future.

Abstract

With the advent of advanced technology, the IoT has made possible the connection of numerous devices that can collect vast volumes of data. Hence, the demands of IoT security is paramount. Cryptography is being used to secure the authentication, confidentiality, data integrity and access control of networks. However, due to the many constraints of IoT devices, traditional cryptographic protocols are no longer suited to all IoT environments, such as the smart city. As a result, researchers have been proposing various lightweight cryptographic algorithms and protocols to secure data on IoT networks. This paper discusses state-of-the-art lightweight cryptographic protocols for IoT networks and presents a comparative analysis of popular contemporary ciphers. In doing so, it has classified the most current algorithms into two parts: symmetric and asymmetric lightweight cryptography. Additionally, we evaluate several recently developed block cipher and stream cipher algorithms in terms of their security. In the final section of this paper, we address the changes that need to be made and suggest future research topics.

Introduction

The Internet of Things (IoT) refers to everyday things that are readable, addressable, locatable, and identifiable via data sensing devices and manageable through the Internet. IoT devices are accessible by communication techniques such as RFID, wireless, wired, or other methods. Everyday objects not only include high-tech electronic devices such as mobile phones and vehicles, but things that we do not generally consider as electronic at all, like food items, animals, clothing, water, waste bins, trees, and so on. The IoT objective is to allow things to be communicated anywhere, anytime, with anything, preferably applying any network or service. In the last few years, the IoT has grown exponentially and now occupies our lives in areas as diverse as cities, agriculture, hospitals, the environment, homes, roads, etc. IoT end devices are usually equipped with different types of sensors and actuators, which collect numerous data and send the accumulated data through cyberspace to monitor, analyse, control, and reach various conclusions [1]. Most of these data are real-time data and help us make correct decisions in different service domains. However, this Internet-driven raw data needs to be transferred securely and switched to human-understandable information to gather knowledge and use this knowledge in various domains such as the smart city, agriculture, the environment, interactive transport, and electricity grids.

The smart city is one example of an IoT domain that has security problems that can be overcome by improving cryptography. Seventy percent of smart city services are currently provided in three fields: traffic, safety, and power [2]. Fig. 1 shows the leading smart city model around the globe. The United Nations Population Fund indicates that more than half of the world’s population now resides in a city. By 2050, this is expected to increase to about 68% [3]. In China, more than 200 smart city developments are in progress [4]. However, smart city domains create numerous security and privacy challenges due to various weaknesses in each layer of a smart city’s network architecture. For example, in 2015, approximately 230,000 Ukrainian residents experienced an extended period of power interruption when intruders hacked into the electricity grid [5]. The IoT plays a crucial role in predicting and managing natural disasters such as bushfires, earthquakes, hurricanes, and tsunamis. Various IoT sensors can help avoid and control damage to life and the environment from forest fires. The sensors can be installed around the edges of the forest and can continuously monitor the temperature and carbon content in the region. In cases of emergency, the IoT can aid an immediate response by preparing and distributing the environment report. The 2019–2020 bushfires in Australia burned 46 million acres and cost 2.9 billion USD [6]. According to United Nations Food and Agriculture, the world will be need 70% more food production in 2050 [7]. Smart agriculture will play a decisive factor in this growing market. For instance, in Chile, using remote sensors reduces 70% of the water requirement in blueberry production [8]. A possible security attack in an agricultural business could result in significant human and financial consequences. In June 2017, the ‘NotPetya’ malware attack in one agricultural-related organisation cost about half a billion U.S. dollars [9]. The enormous data shared in IoT-enabled environments can be exploited by malicious attackers, which creates a security challenge [10]. Hence, addressing and minimising these security and privacy risks by promoting efficient security solutions is crucial for the success of IoT domains.

Ensuring privacy in IoT end devices is challenging for several reasons. First, the CPU in IoT devices is minimal and cannot compute complex algorithms [11], [12], [13], [14], [15], [16], [17], [18]. Second, the power consumption of the security algorithm should be low since most IoT devices are battery-powered [12], [14], [15], [16], [18], [19], [20], [21], [22]. Third, simple sensors are connected to cover a large physical network [18], [20]. Finally, implementing the security algorithm needs to be cost-effective by deploying as few devices as possible [1], [13], [23], [24], [25]. Conventional cybersecurity cryptography such as AES (Advanced Encryption Standard), RSA (Rivest–Shamir–Adleman), DES (Data Encryption Standard), Blowfish, and RC6 cannot be used immediately in these smart domains because of the heterogeneity, scalability, and dynamic features of the IoT. Most of these algorithms consume more energy while operating. For example, AES uses 2.9 kB of flash and 1.2 kB of RAM [21]. Researchers have compared several WSN sensor motes and found that resource-constrained devices have as low as 2 kilobytes (kB) and 1 kB of Random Access Memory (RAM) and Electrically Erasable Programmable Read-Only Memory (EEPROM), respectively [21]. Such sensors cannot use the resource-consuming conventional security approaches [26], [27]. Hence, secure communication is one of the most significant concerns in Low Power and Lossy Systems. This undoubtedly defines the necessity to develop Lightweight Cryptographic (LWC) algorithms for IoT security.

With growing interest in the IoT, the fundamental research question is: What lightweight cryptography has been developed to address the many IoT security issues?

This question must be addressed if researchers are to develop and execute secure and efficient IoT networks. A literature review on lightweight cryptography algorithms was deemed essential to ensure IoT communication security. Hence, this paper focuses on the following main research questions:

• What lightweight cryptography has been developed to address the IoT security issues?

• How can lightweight cryptography secure an IoT structure?

• What consequences do the findings have on the future of IoT research?

This paper addresses the most current state state-of-the-art research in lightweight cryptography for the years 2019 and 2020. It also presents a comparative analysis of most current lightweight algorithms, such as LCC, LWHC, Modified PRESENT and SAT_Jo. The paper also evaluates the most recent protocols using a set of matrices like block size, key length, gate area, technology value, number of encryptions or decryptions, latency, and throughput. This comprehensive evaluation demonstrates the requirements of lightweight cryptography ciphers. This paper is organised into seven sections. Section 1 introduces the IoT and the need for the development of LWC in IoT systems. The IoT architecture and threats are presented in Section 2. Section 3 discusses IoT architecture and devices used according to the structure. Section 4 describes security mechanisms in IoT systems. The most recent lightweight cryptography developments in the IoT are discussed in Section 5. Section 6 presents a critical analysis of lightweight ciphers, identifies the research gaps and suggests further research. Finally, the conclusion is presented in Section 7.