The Internet of Things (IoT) makes our lives much easier, more valuable, and less stressful due to the development of many applications around us including smart cities, smart cars, and smart grids, offering endless services and solutions. Protecting IoT data of such applications at rest either on the objects or in the cloud is an indispensable requirement for achieving a symmetry in the handling and protection of the IoT, as we do with data created by persons and applications. This is because unauthorised access to such data may lead to harmful consequences such as linkage attacks, loss of privacy, and data manipulation. Such undesired implications may jeopardise the existence of IoT applications if protection measures are not taken, and they stem from two main factors. One is that IoT objects have limited capabilities in terms of memory capacity, battery life, and computational power that hamper the direct implementation of conventional Internet security solutions without some modifications (e.g., traditional symmetric algorithms). Another factor is the absence of widely accepted IoT security and privacy guidelines for IoT data at rest and their appropriate countermeasures, which would help IoT stakeholders (e.g., developers, manufacturers) to develop secure IoT systems and therefore enhance IoT security and privacy by design. Toward this end, we first briefly describe the main IoT security goals and identify IoT stakeholders. Moreover, we briefly discuss the most well-known data protection frameworks (e.g., General Data Protection Regulation (GDPR), Health Insurance Portability (HIPAA)). Second, we highlight potential attacks and threats against data at rest and show their violated security goals (e.g., confidentiality and integrity). Third, we review a list of protection measures by which our proposed guidelines can be accomplished. Fourth, we propose a framework of security and privacy guidelines for IoT data at rest that can be utilised to enhance IoT security and privacy by design and establish a symmetry with the protection of user-created data. Our framework also presents the link between the suggested guidelines, mitigation techniques, and attacks. Moreover, we state those IoT stakeholders (e.g., manufacturers, developers) who will benefit most from these guidelines. Finally, we suggest several open issues requiring further investigation in the future, and we also discuss the limitations of our suggested framework.

The Internet of Things (IoT) comprises many technologies, among them is Radio Frequency Identification (RFID), which can be used to track single or multiple objects. This technology has been widely used in healthcare, supply chain, logistics, and asset tracking. However, such applications require a high level of security and privacy and are unfortunately vulnerable to various attacks and threats that need to be addressed in order for RFID-based IoT applications to reach their full potential. To this end, we propose a set of security and privacy guidelines for RFID, supported by modelling guidelines, mitigations, and the attack vectors cohesively. We compare to the state of the art and point out their shortcomings on known guidelines and reason to address these in our model. The overall methodology is as follows: (i) identify the security and privacy guideline features, (ii) highlight the security goals for RFID-based IoT applications, (iii) analyze the features in relation to RFID industrial standards, and relate them to security goals, (iv) summarize attacks and threats against RFID applications and correlate them with violated security goals, (v) derive a set of security and privacy guidelines for RFID applications in accordance with security and privacy by design frameworks. We also describe our derived guidelines in connection with the involved stakeholders, and (vi) outline the existing mitigation strategies to implement our proposed guidelines. Finally, we describe the main limitations of our work that should be investigated in the future and identify the multiple challenges that concern current security strategies.

The fast evolution and prevalence of driverless technologies has facilitated the testing and deployment of automated city shuttles (ACSs) as a means of public transportation in smart cities. For their efficient functioning, ACSs require a real-time data compilation and exchange of information with their internal components and external environment. However, that nexus of data exchange comes with privacy concerns and data protection challenges. In particular, the technical realization of stringent data protection laws on data collection and processing are key issues to be tackled within the ACSs ecosystem. Our work provides an in-depth analysis of the GDPR requirements that should be considered by the ACSs’ stakeholders during the collection, storage, use, and transmission of data to and from the vehicles. First, an analysis is performed on the data processing principles, the rights of data subjects, and the subsequent obligations for the data controllers where we highlight the mixed roles that can be assigned to the ACSs stakeholders. Secondly, the compatibility of privacy laws with security technologies focusing on the gap between the legal definitions and the technological implementation of privacy-preserving techniques are discussed. In face of the GDPR pitfalls, our work recommends a further strengthening of the data protection law. The interdisciplinary approach will ensure that the overlapping stakeholder roles and the blurring implementation of data privacy-preserving techniques within the ACSs landscape are efficiently addressed.

Trust Modelling and Management (TMM) techniques are frequently applied in ad-hoc DistributedWireless Networks (DWNs) to stimulate and improve cooperation between network nodes.TMM facilitate DWNs in building a trust network that assures reliability of communication channels, offers an additional layer of security, and enables group decision making processes. Likewise, TMM became in the past decades an attractive solution for solving problems in cooperative ad hoc DWN. The proposed solutions focus on modelling trust in a social-centric approach to maintain a system where nodes trust each other, and detect untrustworthy (malicious) neighbours. The work at hand considers a time span of three years, from 2020 to 2022, where the scientific research in the domain of TMM and DWN is analysed. Our survey aggregates over 130 research papers and investigates the quality of experimental assessment done by each work. Additionally, we establish an indication on the level of experimental analysis done by each study from a TMM security perspective. Lastly, the survey offers a trust ontology, a general overview of a trust models, together with a concise description of trust threats to facilitate the reader’s understanding of TMM.