The objective of this course is to first familiarize the students with the security concepts relevant to deploying and developing applications involving Internet of Things then to give them opportunities to hone their skills in putting the concepts that they have learned into practice.

Students, on completion of this course, would be able to

• Identify security properties relevant to IoT-based systems of interest,
• Identify and analyze threats and relevant prevention and mitigation approaches for IoT-based systems of interest,
• Perform simple penetration testing tasks for IoT-based systems of interest,
• Design, develop, and deploy an IoT-based system that provides a standard set of security guarantees,
• Apply the concepts from typical cybersecurity frameworks, such as that of NIST, to the design and development of IoT-based systems.

Cloud computing

 I. Introduction to IoT Security

1. Common system architectures in practice

2. Azure IoT system architecture

          3. Components in Azure IoT security infrastructure

II. Goal-oriented security modelling

1. Asset identification

2. IoT threat modeling

3. Adversary’s goal

4. Adversary’s power

 III. Authentication

1. Cryptographic tools: hash functions, challenge-response protocols, key exchange protocols

2. Identity and access management

3. Multi-factor authentication

 IV. Authorization

1. Cryptographic tools: block ciphers, key-derivation functions

2. Session ID and tokens

3. Access control lists and role-based access control

 V. Accounting

1. Logging

2. Resource utilization and capacity planning

3. Trend analysis

 VI. Perimeter security

1. Network segmentation and access control

2. Network security appliances

3. Network logging

 VII. Data security

1. Cryptographic tools: symmetric encryption, message authentication codes, authenticated encryption, public-key encryption, digital signatures

2. Disk encryption

3. Database encryption

4. Key management

 VIII. NIST cybersecurity framework

1. Identification

2. Protection

3. Detection

4. Response

5. Recovery

• Yuri Diogenes, Tom Shinder, and Debra Shinder. (August 2016), Microsoft Azure Security Infrastructure, Microsoft Press, ISBN: 9781509304028.
• Yatish Patil. (August 2017), Azure IoT Development Cookbook: Develop and Manage Robust IoT Solutions, Packt Publishing, ISBN: 9781787283008.
• Niels Ferguson, Bruce Schneier, and Tadayoshi Kohno. (October 2015), Cryptography Engineering: Design Principles and Practical Applications, John Wiley & Sons, Inc., ISBN: 9780470474242.

Ross Anderson. (2020), Security Engineering: A Guide to Building Dependable Distributed Systems, John Wiley & Sons, Inc., ISBN: 9780470068526.

Lectures: 45 hours

Assignments and projects: 45 hours

Presentations: 3 hours

Self study: 87 hours

The Microsoft Azure cloud computing and IoT platform will be used as an environment in which the concepts are made concrete and the practical skills are acquired.

The final grade will be computed according to the following components: midterm examination 25%, final examination 30%, assignments/presentation 10%, and project 35%. Open-book examination is used.

In the evaluation, an “A” will be awarded if the student demonstrates an excellent level of understanding of the principles and demonstrates an excellent level of relevant skills and analytical ability. “B” will be awarded if the student demonstrates an average level of understanding of the principles and demonstrates an average level of relevant skills and analytical ability. “C” will be given if the student demonstrates a below average level of understanding of the principles and demonstrates a below average level of relevant skills and analytical ability. “D” will be given to indicate an acceptable but poor level of understanding, skills, and analytical ability.