I. Introduction
The Internet of Things (IoT) represents a paradigm shift in computing and communication by extending Internet connectivity beyond conventional computing devices to everyday physical objects. These interconnected objects are equipped with embedded sensors, actuators, communication modules, and processing capabilities that enable them to collect, exchange, and analyze data with minimal human intervention. The rapid advancement of wireless communication technologies, cloud computing, artificial intelligence, and edge computing has accelerated the deployment of IoT systems across numerous sectors.
The overarching vision of IoT is to create an intelligent, interconnected environment where devices collaborate autonomously to improve operational efficiency, optimize resource utilization, and enhance the quality of human life. However, the heterogeneous nature of IoT devices, coupled with their limited computational resources and large-scale deployment, introduces significant architectural and security challenges. Consequently, understanding the structural framework of IoT and addressing its security vulnerabilities have become critical areas of contemporary research.
Figure.1. Definition of IoT
II. IoT Architecture
The Internet of Things (IoT) comprises an expanding ecosystem of smart, interconnected devices and sensors that operate seamlessly and often remain unobtrusive to users. These devices communicate with one another and with associated services in a ubiquitous manner, enabling data exchange anytime and anywhere, predominantly through wireless and autonomous communication technologies. As IoT systems continue to grow in scale and complexity, their services become increasingly decentralized, necessitating a well-defined architectural framework. IoT architecture provides a structured model that specifies the physical components of the network, their functional organization and interactions, communication protocols, operational principles, and data management mechanisms, thereby ensuring efficient, scalable, and secure system operation (see Fig. 2).
Figure 2: Architecture of IoT
Perception Layer
The Perception Layer, which corresponds to the physical layer of the Open Systems Interconnection (OSI) model, serves as the foundation of the Internet of Things (IoT) architecture. It comprises various sensing and identification technologies, including Radio Frequency Identification (RFID), Zigbee, Quick Response (QR) codes, infrared sensors, and other intelligent sensing devices. The primary function of this layer is to identify physical objects, collect environmental data, and monitor real-time conditions. Typical data acquired include location, temperature, humidity, vibration, wind speed, air quality, pH level, and other environmental parameters. The collected data are subsequently transmitted to the Network Layer for secure communication and further processing.
Network Layer
The Network Layer is responsible for ensuring reliable, secure, and efficient communication between the Perception Layer and higher architectural layers. It facilitates the transmission of data generated by sensing devices to centralized or distributed processing systems through various communication technologies, including Wi-Fi, Bluetooth, Zigbee, RFID, infrared, 3G, 4G, 5G, WiMAX, UMTS, satellite communication, and other wireless networking protocols. In addition to data transmission, this layer provides routing, connectivity, and communication security to preserve data confidentiality and integrity during transmission.
Middleware Layer
The Middleware Layer functions as the intermediary between the communication infrastructure and application services. It integrates heterogeneous IoT devices and provides essential services such as data storage, service management, resource allocation, and interoperability among diverse platforms. Furthermore, this layer performs data aggregation, processing, filtering, and computational analysis to generate meaningful information from raw sensor data. Based on predefined algorithms and intelligent decision-making mechanisms, the middleware can automatically initiate appropriate actions or services without human intervention.
Application Layer
The Application Layer delivers user-oriented services by utilizing the processed information generated by the Middleware Layer. It supports a broad spectrum of domain-specific applications tailored to meet the requirements of different sectors. Common IoT applications include smart healthcare, smart homes, intelligent transportation systems, industrial automation, smart agriculture, smart cities, environmental monitoring, wearable technologies, and smart logistics. This layer provides interfaces through which end users and organizations interact with IoT-enabled services.
Business Layer
The Business Layer represents the highest level of the IoT architecture and is responsible for the overall management of IoT applications, business processes, and organizational objectives. It analyzes data received from lower layers to generate business intelligence, performance reports, dashboards, predictive analytics, and decision-support models. By transforming processed data into actionable insights, the Business Layer assists managers and stakeholders in formulating effective business strategies, optimizing operational efficiency, improving service delivery, and supporting informed decision-making.
III. IoT Architecture in a Smart World
The Internet of Things (IoT) has become a key enabler in the realization of a smart world, where intelligent devices communicate seamlessly to improve the efficiency of human activities and societal infrastructure. Smart devices [4], particularly wearable technologies, can be attached to the human body to monitor health conditions, track physical fitness, and support the diagnosis and management of various diseases. However, IoT applications extend far beyond personal healthcare and smart homes. IoT-enabled devices are increasingly deployed in restaurants, banks, hospitals, manufacturing industries, transportation systems, and commercial enterprises. Furthermore, the integration of IoT technologies has facilitated the development of smart cities, where urban services such as traffic management, smart metering, environmental monitoring, and resource management are intelligently coordinated. Collectively, these advancements contribute to the vision of a smart world, in which automation and artificial intelligence reduce human effort, improve operational efficiency, and enable timely decision-making while minimizing the consumption of time and resources.
Perception Layer: Within the smart-world architecture, the Perception Layer is responsible for sensing and collecting data from diverse physical environments. Information such as climatic conditions, economic indicators, migration patterns, environmental parameters, and other contextual data from different regions or countries is acquired using sensing technologies, including RFID, infrared sensors, and other intelligent sensing devices. This layer serves as the primary interface between the physical environment and the digital IoT ecosystem.
Network Layer: The Network Layer provides secure and reliable communication for transmitting the data collected by the Perception Layer to the Middleware Layer for further processing. Using various wired and wireless communication technologies, this layer ensures efficient data routing, continuous connectivity, and secure information exchange across geographically distributed IoT networks.
Middleware Layer: The Middleware Layer functions as the processing and service management component of the IoT architecture. It stores, integrates, and analyzes the information received from the Network Layer using computational techniques and intelligent algorithms. By transforming raw sensor data into meaningful information, the middleware supports automated decision-making and facilitates interoperability among heterogeneous IoT devices and platforms.
Application Layer: The Application Layer delivers domain-specific services by utilizing the processed information generated by the Middleware Layer. It supports a wide range of smart-world applications, including smart healthcare, intelligent transportation, smart homes, industrial automation, environmental monitoring, precision agriculture, and smart city management. Through these applications, users and organizations can efficiently monitor, control, and optimize complex systems in real time.
Business Layer: The Business Layer is responsible for the overall management and strategic analysis of IoT services and applications. It transforms processed information into business intelligence through the generation of graphs, analytical reports, business models, dashboards, and workflow analyses. These analytical outputs support informed decision-making by governments, organizations, and policymakers. For example, in disaster management scenarios such as droughts, the Business Layer can assist in determining the most efficient strategies for allocating relief funds, distributing food supplies, and selecting optimal transportation routes to ensure rapid and effective humanitarian response.
In a smart-world environment, IoT enables seamless connectivity not only within cities but also across countries, allowing the exchange of information for global monitoring, collaboration, and intelligent decision-making. The architecture of IoT in a smart world can be effectively described using a five-layer architectural model.
IV. Security Challenges in the Internet of Things
The Internet of Things (IoT) is characterized by a vast and heterogeneous ecosystem of interconnected devices, making it susceptible to numerous vulnerabilities and security threats. Since IoT is fundamentally built upon Internet technologies, many of the security challenges associated with traditional Internet-based systems are inherited by IoT environments. The IoT architecture is commonly composed of three principal layers: the Perception Layer, the Transportation Layer, and the Application Layer, each of which presents distinct security concerns.
A. Security Challenges in the Main Layers of IoT
a) Perception Layer
The primary responsibility of the Perception Layer is to sense, identify, and collect data from the physical environment through devices such as temperature sensors, pressure sensors, RFID tags, barcode readers, and other sensing technologies. Owing to the predominantly wireless nature of communication at this layer, transmitted signals are vulnerable to interception by malicious entities. Moreover, IoT sensor nodes are typically deployed in open and often unattended environments, exposing them to physical attacks in which adversaries may tamper with or compromise the hardware components of IoT devices [5]. Data acquisition in the Perception Layer relies on a large number of sensing terminals that continuously collect real-time information for subsequent processing and presentation to end users. Consequently, these terminals are susceptible to several security threats, including confidential data leakage, unauthorized modification, malware infection, cloning, and other forms of compromise.
Another significant security concern arises from the dynamic topology of IoT networks, as sensor nodes are frequently relocated or deployed in changing environments. The Perception Layer primarily consists of resource-constrained devices such as sensors and RFID tags [6], whose limited storage capacity, computational capability, and energy resources make them particularly vulnerable to various attacks [5]. For instance, an attacker may introduce a malicious node into the network to inject false or malicious data, thereby compromising data integrity and system reliability. Such attacks may also lead to Denial-of-Service (DoS) conditions by deliberately increasing node activity, preventing energy-saving sleep modes, and rapidly depleting the limited battery resources of sensor nodes [5].
These security challenges can be mitigated through the implementation of appropriate security mechanisms, including encryption, authentication, confidentiality, and access control. These countermeasures are discussed in greater detail in the Security Measures section.
b) Transportation Layer
The Transportation Layer, also referred to as the Network Layer, is responsible for transmitting the information collected by the Perception Layer to designated information processing systems through communication infrastructures such as the Internet, mobile communication networks [15], and other reliable wired or wireless networks. Since this layer primarily comprises communication networks, computing devices, and transmission technologies, it is exposed to a wide range of security threats, including network content attacks, unauthorized access, hacker intrusion, and illegal authorization. Furthermore, the highly interconnected and open nature of IoT systems introduces significant challenges related to identity authentication and secure communication [7].
As a fundamental component of the IoT architecture, the Transportation Layer manages the transmission of enormous volumes of data generated by sensing devices. The continuous collection of information by numerous sensor nodes inevitably results in substantial amounts of redundant and repetitive data. Excessive data transmission may consequently lead to network congestion, thereby increasing the likelihood of Denial-of-Service (DoS) attacks. To alleviate this problem, filtering mechanisms should be incorporated between the Transportation Layer and the Application Layer to eliminate redundant information and ensure efficient network performance [8].
The major security threats associated with the Transportation Layer include the following:
1. Sybil Attack: A Sybil attack occurs when an attacker enables a compromised node to assume multiple false identities within the network. This manipulation can significantly disrupt network operations by providing incorrect information regarding node redundancy, ultimately compromising a substantial portion of the IoT system.
2. Sinkhole Attack: In a Sinkhole attack, an adversary manipulates a compromised node to appear more attractive than legitimate neighboring nodes. Consequently, surrounding nodes forward their data through the malicious node, allowing the attacker to intercept or discard transmitted packets while misleading the network into believing that the information has been successfully delivered. This attack also increases network energy consumption and may subsequently result in Denial-of-Service conditions.
3. Sleep Deprivation Attack: Wireless Sensor Network (WSN) nodes typically operate on battery power and rely on scheduled sleep cycles to conserve energy and extend operational lifetime. In a Sleep Deprivation attack, malicious entities intentionally prevent sensor nodes from entering sleep mode, forcing them to remain continuously active. This excessive energy consumption rapidly depletes battery resources, causing premature node failure and degradation of network performance.
4. Denial-of-Service (DoS) Attack: A Denial-of-Service attack is carried out by overwhelming the network with excessive volumes of illegitimate traffic, thereby exhausting the computational and communication resources of the targeted system. As a result, legitimate users are denied access to network services, leading to service disruption and reduced system availability.
5. Malicious Code Injection: In this attack, an adversary compromises one or more IoT nodes and injects malicious software into the network. Such malicious code can disrupt normal system operations, damage critical network components, or, in severe cases, provide the attacker with complete control over the IoT infrastructure.
6. Man-in-the-Middle (MITM) Attack: A Man-in-the-Middle attack represents a sophisticated form of eavesdropping in which an unauthorized entity intercepts communication between two legitimate parties. The attacker can monitor, alter, or manipulate exchanged information while remaining undetected. In many instances, the attacker may impersonate one of the communicating entities to obtain confidential information or manipulate communication without the knowledge of either party.
c) Application Layer
The Application Layer is responsible for analyzing the information received from the Transportation Layer and processing it to deliver intelligent services to end users. This layer represents the primary objective of IoT implementation, as it enables the realization of smart environments through data-driven applications and automated decision-making. Furthermore, the Application Layer ensures the authenticity, integrity, and confidentiality of processed information [5]. It provides users with valuable real-time information that supports monitoring, control, and informed decision-making across various IoT application domains.
The major security challenges associated with the Application Layer are discussed below:
1. Malicious Code Injection: An attacker may exploit vulnerabilities at the end-user interface or application level using various hacking techniques to inject malicious code into the system. Such attacks enable unauthorized access to sensitive information, allowing the attacker to compromise user data and system resources [11].
2. Denial-of-Service (DoS) Attack: Modern Denial-of-Service (DoS) attacks have become increasingly sophisticated and are often employed as a diversionary tactic to overwhelm application resources while concealing other malicious activities. By distracting security mechanisms, attackers can exploit vulnerabilities to compromise the privacy of user data, particularly when sensitive information is transmitted without adequate encryption [11].
3. Spear-Phishing Attack: Spear-phishing is a targeted email spoofing attack in which a specific individual, often a high-ranking executive or privileged user, is deceived into opening a fraudulent email or malicious attachment. Through this approach, the attacker obtains the victim’s credentials and subsequently exploits the compromised account to gain access to additional confidential information [11].
4. Sniffing Attack: In a sniffing attack, an adversary introduces a packet-sniffing application or monitoring tool into the communication environment to capture and analyze network traffic. By intercepting transmitted information, the attacker can obtain sensitive network data, potentially leading to unauthorized access, data compromise, and disruption of normal system operations [11].
V. IoT Security Measures
To address the numerous security challenges associated with the Internet of Things (IoT), several security mechanisms have been proposed to ensure the confidentiality, integrity, authenticity, and availability of IoT systems. The following measures constitute some of the most widely adopted approaches for securing IoT environments.
1. Encryption
Encryption is one of the fundamental security mechanisms employed to protect IoT data against unauthorized modification and disclosure while ensuring confidentiality and data integrity. Encryption can generally be implemented using two approaches: node-to-node (hop-to-hop) encryption and end-to-end encryption. Node-to-node encryption is performed within the Network Layer, where data are encrypted and decrypted at each intermediate node before being forwarded to the next destination. This approach provides secure communication between neighboring nodes during data transmission. Conversely, end-to-end encryption is implemented at the Application Layer, where data are encrypted by the sender and remain encrypted until they are decrypted exclusively by the intended receiver. Consequently, intercepted information remains unintelligible to unauthorized entities, thereby protecting sensitive information from malicious attackers.
2. Confidentiality
Maintaining data confidentiality is essential in IoT systems to ensure that sensitive information is accessible only to authorized entities. These entities may include human users, IoT devices, or external systems interacting with the IoT environment. Appropriate confidentiality mechanisms should prevent unauthorized neighboring nodes from accessing data collected by sensors within a particular device. Likewise, confidential information stored on technologies such as RFID electronic tags should remain inaccessible to unauthorized readers, thereby minimizing the risk of information leakage.
3. Authentication
Authentication verifies that data exchanged within an IoT environment originate from legitimate and trusted devices. Information received by an IoT reader should therefore be validated to determine whether it has been transmitted by an authenticated electronic tag or an authorized device. Authentication is essential across every layer of the IoT architecture. For example, sensor nodes in the Perception Layer must authenticate themselves before participating in network communication to reduce the risk of Denial-of-Service (DoS) attacks. Similarly, authentication mechanisms implemented throughout higher architectural layers ensure secure communication among IoT entities. Existing authentication technologies, including Wi-Fi authentication protocols, provide secure user access to IoT data and services [5]. In addition, OpenID serves as a standardized authentication framework that enables users to authenticate through trusted identity providers and return with verifiable authentication assertions.
4. Authorization
Authorization governs the level of access that authenticated devices and users are permitted within an IoT network. Together with authentication, authorization establishes trusted relationships among IoT devices, enabling them to exchange only the information required for their assigned functions. OAuth is a widely adopted standardized authorization framework that provides secure delegated access to protected resources. One of its key features is the use of access tokens, which allow authorized users or devices to make subsequent requests without repeatedly authenticating. Unlike OpenID, which focuses solely on user authentication, OAuth extends functionality by granting controlled access to additional resources offered by third-party services.
One limitation associated with OAuth and OpenID Connect is that both frameworks have traditionally been designed for Hypertext Transfer Protocol (HTTP)-based communications. However, many IoT interactions, particularly machine-to-machine communications, require lightweight protocols that are more efficient than HTTP. Consequently, specialized IoT communication protocols such as MQ Telemetry Transport (MQTT) and the Constrained Application Protocol (CoAP) have emerged as more suitable alternatives for resource-constrained IoT environments.
5. Certification and Access Control
Certification provides a mechanism for verifying the identities of communicating entities before information exchange occurs. Through the implementation of Public Key Infrastructure (PKI), strong mutual authentication can be achieved using two-way public key certificates, thereby enhancing the authenticity and confidentiality of IoT systems [3]. Access control complements certification by restricting access to system resources, ensuring that only authorized users, devices, or applications can access protected information and services [3]. Effective access control relies on accurate entity identification and authentication, making certification technologies fundamental components of secure IoT infrastructures.
VI. Conclusion and Future Directions
The Internet of Things represents a transformative technological paradigm that is expected to play a central role in realizing the vision of a fully interconnected smart world, where devices, systems, and services communicate seamlessly through a common network infrastructure. Despite its enormous potential, security remains one of the most significant challenges confronting IoT deployment due to the increasing volume of interconnected devices and the sensitive nature of the data they generate and exchange. Consequently, ensuring robust device identity management and reliable authentication mechanisms constitutes a fundamental requirement for securing IoT infrastructures.
Addressing these security concerns requires the development of stronger encryption techniques, robust authentication mechanisms based on advanced cryptographic principles, and lightweight security protocols specifically designed for resource-constrained IoT devices. This paper has examined the major security challenges associated with each layer of the IoT architecture and discussed the corresponding security measures required to mitigate these threats. A comprehensive understanding of these challenges provides a foundation for designing more secure and resilient IoT systems. Furthermore, future IoT security research should focus on the development of intelligent security frameworks incorporating managed threat detection, anomaly detection, predictive analytics, and adaptive defense mechanisms. These emerging areas present significant research opportunities toward achieving secure, scalable, and trustworthy IoT ecosystems.