Framework to perform taint analysis and security assessment of IoT devices in smart cities

Akashdeep Bhardwaj; Ankit Vishnoi; Salil Bharany; Abdelzahir Abdelmaboud; Ashraf Osman Ibrahim; Mohamed Mamoun; Wamda Nagmeldin

doi:10.7717/peerj-cs.1771

Framework to perform taint analysis and security assessment of IoT devices in smart cities

PeerJ Comput Sci. 2023 Dec 21:9:e1771. doi: 10.7717/peerj-cs.1771. eCollection 2023.

Authors

Akashdeep Bhardwaj¹, Ankit Vishnoi², Salil Bharany³, Abdelzahir Abdelmaboud⁴, Ashraf Osman Ibrahim⁵, Mohamed Mamoun⁶, Wamda Nagmeldin⁷

Affiliations

¹ School of Computer Science, University of Petroleum and Energy Studies, Dehradun, India.
² Computer Science and Engineering Department, Symbiosis Institute of Technology (SIT), Symbiosis International (Deemed) University (SIU), Pune, India.
³ Department of Computer Science and Engineering, Lovely Professional University, Phagwara, Punjab, India.
⁴ Department of Information Systems, King Khalid University, Muhayel Aseer, Saudi Arabia.
⁵ Universiti Malaysia Sabah, Sabah, Malaysia.
⁶ Alzaiem Alazhari University, Khartoum North, Sudan.
⁷ Prince Sattam bin Abdulaziz University, Al-Kharj, Saudi Arabia.

Abstract

The Internet of Things has a bootloader and applications responsible for initializing the device's hardware and loading the operating system or firmware. Ensuring the security of the bootloader is crucial to protect against malicious firmware or software being loaded onto the device. One way to increase the security of the bootloader is to use digital signature verification to ensure that only authorized firmware can be loaded onto the device. Additionally, implementing secure boot processes, such as a chain of trust, can prevent unauthorized access to the device's firmware and protect against tampering during the boot process. This research is based on the firmware bootloader and application dataflow taint analysis and security assessment of IoT devices as the most critical step in ensuring the security and integrity of these devices. This process helps identify vulnerabilities and potential attack vectors that attackers could exploit and provides a foundation for developing effective remediation strategies.

Keywords: Application layer; Bootloader; Dataflow; Firmware; IoT; Security assessments; Taint analysis.

Grants and funding

This work was supported by the Deanship of Scientific Research at King Khalid University through the large Groups Research Project under grant number (RGP.2/175/44). The funders had no role in study design, data collection and analysis, decision to publish, or preparation of the manuscript.