Systematic Literature Review on 5G-IoT Security Aspects

1. Introduction

One of the pillars of the new services offered by 5G technology is the massive Machine Type Communication (mMTC) [1], which is based on the Low-Power Wide Area Network (LP-WAN) communication standard, suitable for long-distance communication of small amounts of data with energy saving [2]. The mMTC will enable the connection of a large number of devices to the 5G infrastructure, reaching 1 million devices per square kilometer [2], which will favor the deployment of Internet of Things (IoT) services and applications.

IoT applications generally present heterogeneity regarding the different devices, often from different manufacturers and communication technologies. In addition, such applications can also be dynamic when considering the number and status of connected devices. These characteristics allow different combinations of scenarios, which, together with the limitations of computational resources inherent to devices, become attractive for attackers who seek and exploit vulnerabilities. Thus, IoT data can be targets for possible attacks, independently whether they are in devices, transit, or stored in remote servers, such as in the cloud, fog, and edge computing.

Cloud-centric models are more vulnerable to IoT security and privacy due to more user data in the cloud layer accessed by different entities [3]. Considering edge computing, the IoT gateway contains more data than an IoT end device, making it more vulnerable. Besides, a mobile device is at risk when used as a data collection or analysis tool because accessing insecure data sources can make the device vulnerable. An HP report found that 70% of devices have vulnerabilities, and that number reaches 100% when considering the scenario of smart homes [4].

Although many scientific papers and technical reports have addressed security issues, challenges, and recommendations in 5G and IoT environments [5], the lack of security standardization is still a concern [6,7,8,9,10]. Given the different security concerns regarding IoT devices connected in 5G infrastructures, it is important to know the vulnerabilities and threats in these scenarios, as well as possible solutions to mitigate them.

In this sense, considering the context of 5G-IoT, we performed a systematic literature review to investigate what are the known vulnerabilities, what are the possible threats/attacks, and what can be applied to mitigate them. A systematic literature review aims to identify, evaluate, and interpret all available research relevant to a topic of interest, helping to identify gaps in current research, suggest areas for further investigation, and position new research activities. The main advantage of the systematic literature review is the use of a well-defined methodology that, despite demanding considerably more effort, makes it less likely that the literature results are biased [11].

To perform an SLR, we first must define a protocol considering a specified problem/scenario, the research questions, the inclusion and exclusion criteria, the search string, scientific repositories, the data collection methodology, and the quality assessment method. Thus, following the systematic literature review protocol we defined, after the search and selection phase, we considered 142 papers published in journals and conferences. As a result, we start presenting general information regarding the quantitative analyses of the extracted data. Then, we present the list of vulnerabilities classified into five classes, the main threats to consider, and possible solutions to adopt. Finally, we present some general recommendations related to 5G-IoT security.

The main contributions of this article are:

• we elaborated the SLR protocol, which can be used to replicate or update this study in the future;
• we selected and reviewed 142 papers considering they explore security threats, vulnerabilities, or solutions for 5G-IoT environments;
• we analyzed and presented the information extracted from the selected papers, classifying threats, vulnerabilities, and solutions;
• we present the state-of-the-art related to security issues in 5G-IoT scenarios.

The remainder of this paper is organized as follows: we present the research protocol for the SLR in Section 2; in Section 3, we show the general results from the collected data, considering quantitative information; in Section 4, we describe the threat model applied to our study; in Section 5, we list all the vulnerabilities found in the selected papers; in Section 6, we present all the threats discussed in the selected papers; in Section 7, we describe what security solutions were considered in the relevant works; we present general recommendations in Section 8 and the related work in Section 9; we conclude this work in Section 10.

2. Research Protocol

To conduct our review, we applied the five steps described by [12], where each process steps has an outcome, as shown in Figure 1. All these steps and their outcomes are detailed in the following sections.

2.1. Research Questions

Research questions must incorporate the purpose of the review performed. The main goal of this review is to investigate threats, vulnerabilities, and possible solutions to mitigate them in Internet of Things applications and services with 5G communication infrastructure. Thus, we defined the following research questions:

• RQ1: What are the known vulnerabilities in the 5G-IoT context? Rationale: This question seeks to identify the vulnerabilities listed in the literature in the context of 5G-IoT applications.
• RQ2: What are the known threats in the 5G-IoT context? Rationale: We seek to classify the known threats in the 5G-IoT context and understand how they affect these environments.
• RQ3: What are the recommendations and proposed solutions to mitigate the vulnerabilities and threats listed in the literature? Rationale: This question aims to present the recommendations and proposed solutions to mitigate the known vulnerabilities and threats in IoT and 5G environments and the best practices to build secure applications in these contexts.

2.2. Search Strategy

We specified the following terms as keywords for the research: 5G, Internet of Things, and security. Then, we applied alternative terms and terms defined by the PICO approach (Population, Intervention, Context, and Outcome), as shown in Table 1.

For the term solution, we also considered the following words: architecture, framework, platform, and system.

2.3. Search String

With the keywords, alternative terms, and terms defined with the PICO approach, we defined the following search string using the boolean operators AND/OR to link the terms:

( “Internet of Everything” OR “Internet of Things” OR “IoE” OR “IoT” )

AND

( “Solution” OR “Architecture” OR “Framework” OR “Platform” OR “System” OR “Threat” OR “Vulnerability” )

AND

( “Confidentiality” OR “Integrity” OR “Privacy” OR “Protection” OR “Security” OR “Trustworthiness” )

AND

( “5G” )

2.4. Search Repositories

To search for relevant articles, we used the six scientific repositories listed in Table 2, which gather articles from different conferences and journals.

2.5. Selection Criteria

In order to avoid results that do not help to answer the research questions and improve the probability of selecting relevant articles to answer the research questions, we defined the following inclusion criteria:

• IC1: Papers that present vulnerabilities in 5G-IoT context;
• IC2: Papers that present threats in 5G-IoT context;
• IC3: Papers that present solutions to mitigate vulnerabilities and threats in 5G-IoT context;
• IC4: Papers that present recommendations to improve the security of applications in 5G-IoT contexts;
• IC5: When several papers show similar studies, only the most recent is included;
• IC6: If there are versions of the same paper, the most complete must be included.

Exclusion criteria are important, as they allow greater precision in eliminating studies not relevant to the context of the review. For this reason, during the individual analysis of the studies, we discarded all those that met at least one of the following exclusion criteria:

• EC1: Posters, short articles, and expanded abstracts (articles with less than three pages);
• EC2: Book chapters;
• EC3: Articles not written in English;
• EC4: Articles that do not focus on security;
• EC5: Duplicate results;
• EC6: Articles published before the year 2010 (beginning of work for 5G development).

We did not remove secondary studies because some of them propose specific solutions (e.g., [13]), in addition to summarizing and analyzing the state-of-the-art. The secondary studies are also relevant sources for identifying vulnerabilities and threats regarding 5G-IoT.

2.6. Selection Procedure

To carry out the selection of relevant articles, we used the selection criteria according to the following steps:

• Delete duplicate documents;
• Exclude documents published before the year 2010 or documents not written in English;
• Exclude documents not published in journals or conferences;
• Exclude dissertations and theses, expanded abstracts, summary articles, and posters;
• Exclude irrelevant documents, i.e., documents that do not help to answer the research questions.

To exclude irrelevant documents, we analyzed each article resulting from the search by two reviewers according to the following criteria:

• Each reviewer classifies the document as relevant, irrelevant, or undefined;
• Documents classified as relevant by two reviewers are kept;
• Documents classified as irrelevant by two reviewers are excluded;
• Documents classified as undefined by two reviewers are better analyzed through a quick reading of the complete document, and then they are reclassified as relevant or irrelevant;
• Documents classified as relevant or undefined by one reviewer and irrelevant by another are discussed between both until they reach a consensus on one of the previous classifications.

2.7. Quality Assessment

The paper quality assessment aims to provide more detailed criteria for the inclusion and exclusion of candidate papers and to investigate whether quality differences impact on different results in the studies [14]. To assess the quality of the selected documents, we established the following questions:

• Is the text well organized and clear (easy to understand)?
• Are motivation and goals well described?
• Is the methodology clear (easy to understand and replicate)?
• Is the document well-referenced, and does it present good related work?
• Does the document present threats, vulnerabilities, or solutions?
• Do the authors present a good discussion of the topics covered in the document?
• Are there any suggestions for future work?

For each article selected, reviewers answer each of the seven questions with possible answers: yes, moderated, or no. Each answer receives a score as described below:

• Yes 1;
• Moderate - 0.5;
• No - 0.

Thus, as there are seven questions, the maximum score for each article is seven, and the minimum is 0, indicating an article’s best and worst quality. Depending on the score, we classified the quality level as follows:

• High quality, if the score is 5.5 or higher;
• Medium quality, if the score is between 3.5 and 5.5;
• Low quality if the score is less than or equal to 3.5.

2.8. Data Extraction

The following list contains the data we extracted from the relevant articles:

• Title
• Authors
• Abstract
• Year
• Article type
• Name of Conference/Journal
• Country(s) where the research was performed
• Number of pages
• Number of citations
• Quality
• List of threats
• List of vulnerabilities
• List of solutions
• List of essential definitions/terms

3. General Results

Figure 2 presents an overview of the SLR results. We reviewed 3,012 papers by reading titles and abstracts in the first filtering step. By applying the selection criteria, we rejected 2,015 papers and accepted 159 papers. The remaining papers were automatically removed due to duplication. Afterward, by the full paper reading, we rejected 17 papers and conducted data extraction and quality assessment of 142 papers. As presented in Figure 3, 99 works were published in journals, and 43 were published in conferences.

Figure 4 presents a heatmap representing the distribution of publications by the authors’ country of the 142 accepted papers. We considered the country of all authors of the papers. For instance, a paper with four authors from China and one from India increased the total number of counts for both countries. Researchers from China and India more frequently authored papers, appearing 110 and 83 times, respectively. This information indicates the current high research interest of such countries in 5G-IoT security.

When we analyze the number of publications per year, we can see that the studies regarding the 5G-IoT context increased, as shown in Figure 5. It is important to note that the year 2022 may not include the totality of papers since the search in the digital repositories was carried out in May 2022.

Another relevant piece of information is the number of citations for selected papers. Figure 6 illustrates the number of citations for selected papers from Google Scholar in February 2023. Most papers were cited by at most 21 other documents, and only 10 of the 142 papers were cited more than 99 times.

Finally, Figure 7 presents the quality assessment score for selected papers. Our quality assessment score ranges from 0.0 to 7.0 points. Most papers achieved an assessment score of 6.0 points. Besides, Figure 8 presents the quality levels for the 142 papers. Therefore, most papers achieved a high-quality level. Only 14.08% of the selected papers presented low quality according to our classification (i.e., $score\le 3.5$). The 85.92% of medium or high-quality classifications evidence the relevance of the papers included in this revision.

4. Threat Model

Although there is no single universally accepted IoT architecture, the most basic and most widely accepted one considers three layers, as described in Figure 9. The three-layer approach was proposed in the early stages of the Internet of Things research and fulfills the basic idea of IoT [15]. In this paper, we use this architecture to analyze the threats in the 5G-IoT environment, and each of these layers has specific security challenges [16].

The perception layer, also known as the sensors layer, is where the sensors and connected devices are and is responsible for collecting various amounts of data. Due to its importance in the IoT environment, this layer is the main target of attackers that aim to replace the devices with their own, collect sensitive data from the system or the user, or even generate fake data to be sent to the server.

The network or transmission layer connects the sensor to other devices, gateways, and servers. It is responsible for transmitting all the data and acts as a bridge between the perception and application layers. This layer is sensitive to attacks that target the service availability, and data integrity and confidentiality.

The third layer, named application layer, delivers application-specific services to the user. These services may vary depending on the data collected by the sensors and the application goal. This layer introduces inside and outside threats, and its security is a key issue.

Considering the three-layer architecture, we defined the threat model shown in Figure 10, considering the possible attack surfaces in IoT applications with 5G infrastructure. The defined threat model considers six attack surfaces, as follows.

• Device: Each device can be targeted by attackers and, when compromised, allows communication with the 5G infrastructure or gateways, expanding the attack surface to other targets. The attacker can co-opt the device into a botnet frequently used for DDoS attacks. The captured device can also be used to listen to communication, extract sensitive information from the system, or even send fake data.
• Gateway: Gateways concentrate communication in IoT systems, enabling communication with devices and the 5G infrastructure. If an attacker takes control of the gateway, all the devices connected to it can be targeted to be co-opted. The gateway can also become unavailable due to a successful attack, and the devices connected to it will be unreachable. Finally, since gateways serve as an aggregation point in IoT systems, sensitive information can be leaked or even manipulated by the attacker.
• Communication Between Device and Gateway: Since IoT devices have computational constraints, the communication between devices and gateways can be targeted by eavesdroppers, who can steal sensitive data. Even when using encryption, the attacker can derive the original data by collecting enough encrypted data in transmission [17].
• Communication Between Gateway and Infrastructure: Attackers can exploit the communication channel between gateways and the 5G infrastructure.
• Communication Between Device and Infrastructure: Attackers can exploit the communication channel between the devices and the 5G infrastructure in the case of direct connection of the devices (e.g., using the 5G mMTC).
• Device-to-Device Communication: An important feature in 5G is the Device-to-Device (D2D) communication, which increases network coverage by enabling direct communication between devices without traversing the core network. This feature opens the door to propagating attacks in a multi-hop scenario, i.e., hop by hop to reach a vulnerable device. Using a compromised device, the attacker can access critical parts of the infrastructure [18].

5. Known Vulnerabilities

Considering all the vulnerabilities extracted from the selected papers, we can classify them into the following classes:

• process, when related to common processes such as authentication, attestation, or manipulation;
• code, when related to development processes, including code practices and used technologies;
• communication, when related to protocols and data transmission;
• operation, when related to the device’s use or configuration by the user;
• and device, when related to some characteristic of the devices.

From the 142 selected papers, only 47 presented vulnerabilities. We could classify some vulnerabilities in more than one class even though we classified them in only one. For example, we list the “lack of encryption” in the “device” class, but it could also apply to “communication” or “code” classes. Furthermore, many of the vulnerabilities are not directly related to IoT devices and applications but are listed in this section because they are mentioned in the selected articles. In Figure 11 and Figure 12, we show, respectively, the main vulnerability types with the number of mentions and number of vulnerabilities in each of the five classes.

To exemplify, the “access control” type refers to the existence of backdoors [10,19,20], easy physical access [21], and the lack of certificate validation [22] and access control [23]. The “outdated assets” relate to software [6,20], firmware [10], technologies, and services that are not updated [19,24,25], while “communication problems” consider infrastructure [26], network topology [27], protocols [19,24,25,28,29,30], and message exchange [22,23,31,32]. The “other” type includes device management [26], insecure deserialization [23], lack of integrity verification [7], SIM card modification [33], node interruption [26], device failure, and unauthorized access [10].

We list the mentioned vulnerabilities for each of the five classes in the following subsections.

5.1. Process

The list below contains all the vulnerabilities related to processes:

• diversity of authentication modes may generate high network traffic [34];
• lack of authentication facilitates access [34,35,36];
• lack of authentication and authorization in SDN [13];
• weak/broken or inadequate authentication (e.g., single-factor authentication method using a username and password) [8,23,26,37,38];
• broken access control [23];
• Evolved Packet System Authentication and Key Agreement (EPS-AKA) protocol is vulnerable to several well-known attacks, such as man-in-the-middle (MITM) and denial of service (DoS), and suffers from the disclosure of user identity on first access to the network [39];
• 5G-AKA allows for replay attacks since authentication and synchronization failure messages are sent to the device in plain text [40];
• other messages, such as RRC (Radio Resource Control) and NAS (Non-access stratum), are sent to the device in plain text, which can generate DoS and other attacks that compromise the confidentiality, as already happens with 4G [40];
• lack of attestation to know if a device is compromised [13];
• storage of keys in non-volatile memory (security chips, e.g., integrated circuits and smart cards) [7,29,41];
• lack of certificate validation or incorrect validation [22];
• lack of data integrity verification [7];
• information sharing with unsecured clouds [26,42];
• data manipulation/exposure [23,26];
• unprotected storage [7,19,36,43];
• insecure deserialization [23];
• management of large numbers of devices [26].

5.2. Code

The list below presents the vulnerabilities regarding code:

• outdated or insecure protocols [24,25];
• code vulnerabilities such as fragile programming processes, without good secure coding practices, and buffer overflow [25,26];
• vulnerable code allowing memory leak, code injection, and buffer overflow [6,7,23,44];
• memory buffer overflow can crash the system, allow control of program execution flow, or execute arbitrary code [22];
• XML external entity (XXE) injection [23];
• processing overload can facilitate replay attacks and RPL (routing protocol for low power and lossy networks) routing [26];
• non-standard protocol stacks, easily accessed physically or remotely [29];
• insecure encryption algorithms or outside the recommended standards (e.g., 3DES is vulnerable to collision attacks, RSA is vulnerable to side-channel attacks, and random probability approximation) [22,37,45];
• insecure pseudo-random generators [22];
• symmetric key algorithms are vulnerable to cryptographic attacks (e.g., known text, chosen text, and cryptanalysis) [46];
• asymmetric key algorithms are vulnerable to MitM and chosen text attacks [46];
• classic encryption algorithms, such as those based on the elliptic curve, are easily compromised when considering eventual advances in quantum computing [46];
• Diffie-Hellman (DH) algorithm is vulnerable to man-in-the-middle (MITM) attacks when exchanging public DH values between two devices [47];
• RSA algorithm (supports point-to-point communication and multicast routing in low power networks) is vulnerable to attacks such as forwarding, sinkhole, Sybil, Hello flooding, wormhole, black hole, and DoS [23];
• vulnerable web interfaces [48];
• single master key for software update [37];
• use of third-party libraries without proper security [43].

5.3. Communication

Below, we present the vulnerabilibies related to the communication mechanisms and processes:

• lack of security mechanisms (e.g., resistance to tampering) facilitates connection intrusion [10,27];
• vulnerabilities in infrastructure and edge devices [26];
• unreliable communication channel and medium access collisions [31];
• wireless communication can be exploited if not properly secured [29,49];
• wireless sensor networks allow for easier device duplication [44];
• massive access is susceptible to eavesdropping due to the broadcast nature of wireless channels [50];
• TLS and SSL are vulnerable to attacks such as resource exhaustion, flooding, replay, amplification attacks, BEAST (Browser Exploit Against SSL/TLS), CRIME (Compression Ratio Info-leak Made Easy), Heartbleed, and RC4 (Rivest Cipher 4) [23];
• insecure TLS/SSL version or configuration [22];
• cross-site scripting (XSS) [23];
• Access Stratum (AS) keys’ stream reuse and NAS null encryption [28];
• 5G NSA (non-standalone) inherits vulnerabilities from 4G (network core) [30];
• simple HTTP communication [32];
• unencrypted communications [19,48];
• insecure pairing procedures [19].

5.4. Operation

The list below exhibits the vulnerabilities related to the operations:

• standard or weak passwords/credentials [4,6,20,24,30,37,51];
• incorrect OS and software configuration [26];
• outdated services and devices [19,24];
• lack of firmware/software update [6,10,20,25];
• node interruption [26];
• deployment site exposure can facilitate attacks [29];
• translation between security protocols of different networks can be a weakness [49];
• misconfiguration of security or standard configuration [7,23,36];
• bad user practices [30];
• frequent topology change in the Internet of Vehicles (IoV) networks [27].

5.5. Device

Finally, we list the vulnerabilities related to the devices’ characteristics:

• vulnerable hosts can create multi-host and multi-stage vulnerabilities [24];
• weak physical security and insecure communication interfaces - given the resource restrictions - can lead to spoofing and sleep deprivation attacks [26];
• lack of sophisticated/robust security mechanisms due to limitations of computational resources [6,20,49,52];
• easy device access enables malicious code execution [44];
• lack of identity privacy protection [53,54];
• lighter security technologies due to resource constraints [29];
• lack of encryption [4,28,35];
• weak encryption [4];
• wearable devices have a high probability of losing confidential information in case of theft or loan [55];
• device identity can be spoofed due to the lack of identity privacy protection [56,57];
• device location can be changed [57];
• rogue or compromised edge nodes and log files can be monitored by attackers [58];
• private keys can be compromised due to node security flaw [59];
• SIM card contents and functions can be remotely modified by sending a text message through OTA (Over-The-Air) technology [33];
• easy access to devices that do not require human interaction [21];
• lack of digital identity on devices [32];
• poorly designed devices allow easy execution of commands that can cause failures, or unauthorized access [10];
• existence of backdoors [10,19,20].

6. Threats In 5G-IoT Environments

To better understand the main threats in the 5G-IoT environment, we classified them into five categories, described in the following subsections.

6.1. Attacks on Data

Since information is the most valuable commodity, a wide range of attacks aims to retrieve sensitive data exchanged among devices and servers. These types of attacks can affect the confidentiality and integrity of data. Passive attacks can stay undetected for a long time since the data are not modified and nothing suspicious would be noticed by the users or devices. On the other hand, if the attacker acts actively on the communication channel by modifying, re-sending, or creating fake messages, the data integrity will be affected, and the results generated from these data may not be reliable [60].

Man-in-the-middle attacks are the main threat in the network layer. In these attacks, the adversary intercepts the connection between two connected devices, without being detected, and actively acts to change and forge the data that is sent between them. The attacker can also read and redirect the data in the communication channel, extracting sensitive information and harming the privacy of users and data. Fake data added by the attacker may also compromise the aggregation results and lead to wrong or harmful decisions by the system [61].

The connection between devices can also be intercepted and data passively retrieved in eavesdropping or sniffing attacks. The adversary will sniff the network and obtain the packets for further analysis. This attack is a major security flaw, compromising privacy and confidentiality [61]. The attacker can use the collected data to perform a traffic analysis [47], track the user behavior or location [62], or disclose sensitive information [63]. After eavesdropping on the communication, the adversary can also modify the data and forward them to the target, performing a replay attack [64].

The perception layer is also targeted when performing attacks on data since an attacker can subvert data aggregation by injecting false data or suppressing legitimate data through node replication, clone or injection. In node replication attacks, the adversary adds nodes to the network that mimics other existing legitimate nodes, aiming to obtain valuable information from the system. Similarly, node clone attacks create clones from existing nodes and use them for malicious purposes [44,65,66].

Node injection attacks are used to control data flow, by dropping a malicious node between the connection of two legitimate nodes, with the attacker acquiring control of the processing of any data. Another attack related to the perception layer is node tampering when the attacker changes the whole hardware or gains access to the node and acts to manipulate sensitive data generated or received by it [66,67,68,69].

6.2. Access Attacks

In this type of attack, the adversary aims to gain unauthorized access to the IoT device, to the network, or to the service. Access attacks can affect all three layers of the IoT architecture [60].

If an attacker takes the smart card or the authentication device of a legitimate user, he or she may have the opportunity to impersonate the user’s identity to perform other attacks, by stealing this smart card. Another possibility is skimming attacks, which aim to copy the physical credentials of a legitimate user, such as an ID card or chip. The attacker needs to have physical access to the device to be cloned, to install the skimming device, or to steal the physical credentials [70].

In the network layer, session hijacking attacks allow the attacker to take control over a valid session between the user or device and the server, pretending to be an authentic user and potentially sending fake data or collecting sensitive information [71]. Relay attacks are used to resend a legitimate user’s authentication signal to gain network access without decrypting the message content. The attacker may succeed when no protection or additional checks are implemented [72].

The application layer is also susceptible to access attacks, such as stolen verifier attacks, where the attacker steal or modifies verification data, such as plain-text or hash passwords, biometric data, certificates, and others, which are stored in the server [73]. User or device credentials can also be retrieved by attackers through brute force attacks, guessing default passwords, or trying every possible encryption key, to gain access to the IoT network. This attack may affect also the perception layer since the attacker can target the sensors [47].

6.3. Masquerade Attacks

The attacker uses masquerade attacks to pretend to be someone else by using forged certificates or someone else’s credentials, taking advantage of weak or nonexistent authentication protocols, to gain unauthorized access to the system or data through legitimate access identification. For example, an adversary can steal the key used in the authentication during the handshake response [38]. These attacks affect the perception and network layers since the attackers use node identities to access network traffic [60].

Forgery attacks are carried out aiming to forge node identities and obtain system authorization. The attacker can also impersonate an authenticated user or device in the network. Forged nodes and impersonation attacks can be used to perform counterfeiting attacks, where the adversary intercepts network data for analysis and tampering, and can change and replicate the contents of many IoT devices [61,74].

Forged network addresses can also be used to perform spoofing attacks, compromising both wired and wireless networks. This attack can be used by an adversary to get authentication credentials that belong to other users, and the attacker can use these data to gain access to a device or restrict service by impersonating a legitimate user [7].

Another threat is when an attacker creates a large number of pseudonymous identities to gain a large influence and subverts the service’s reputation system. This attack, called Sybil, targets fault-tolerant schemes, such as distributed storage and multipath routing [71].

6.4. Routing Attacks

Routing attacks can control or even block the communication between nodes, affecting the network layer. The network’s performance is degraded by compromising its resources, topology, and traffic, and may force the network to reorganize itself many times. These attacks include selective forwarding, wormhole, sinkhole, and flooding.

Selective forwarding attacks prevent the propagation of messages by refusing to forward them and simply dropping the messages. To reduce the suspicion of the wrongdoing, the attacker can drop the packets of a few selected nodes, or a group of nodes, and forward the remaining traffic, causing a denial of service for that node or group. The attacker can also subvert a node and neglect to route some messages. When the malicious node drops all the packets, the attack is called black hole, and when only some packets are forwarded and others dropped, it is called grey hole [31]. The grey hole variation is more difficult to detect, since there are several reasons for packet dropping, including packet collision and unreliable communication channels, and a careful analysis is required to detect the attack.

Wormhole is a passive attack that creates a communication tunnel between the target nodes, by using high-power transmission, encapsulation or out-of-band channels, to pipe data and performs a traffic analysis. The malicious node is located in a strategic place in the network, providing the shortest route for exchanging messages between the other devices. This attack can be used to make the two communication parties believe they are close when they are not [31,75]. The attacker can also drop some of data or control packets to cause a denial of service.

The goal of a sinkhole attack is to attract the largest amount of traffic, being one of the most severe attacks that can be launched by a compromised node and can be used by the attacker to run selective forward, denial of service, and other related attacks. By using sinkhole, the attacker can prevent the server and other nodes to obtain correct data by misrounting legitimate packets and also by sending fabricated information. This attack can also be used to collect sensitive information from the network [76].

Finally, a flooding attack aims to flood the network with a large amount of packets, generating useless traffic or requests. This attack can slow down the server response or the network performance, and even cause a denial of service, preventing legitimate users from accessing services provided [77].

6.5. Availability Attacks

Availability attacks aim to degrade the service quality, making the service unavailable for legitimate users. This attack is especially dangerous to IoT devices since they have limited hardware resources and are optimized for low-power consumption and long-life operation [60]. These attacks target the network layer, with denial of service and desynchronization attacks, and the perception layer, with jamming and exhaustion attacks.

The main goal of denial-of-service attacks is to partially or completely avoid the access of legitimate users to one or more services or resources, by flooding the network traffic or sending a large amount of requests to the servers. Due to their computational constraints and weak security, IoT devices are often targeted to malware injection in order to build “botnets” and carry out distributed denial of service attacks, by using these devices in a coordinated manner to generate a large amount of traffic [20].

Desynchronization attacks aim to disconnect a valid tag from an identification system, by eavesdropping and replaying public messages. This attack does not reveal any tag’s information to the adversary and can be considered a kind of denial of service attack since the tag cannot authenticate itself to the other entities [8].

In the perception layer, jamming attacks are used to block and disturb legitimate communications. This attack forces IoT devices to repeat the transmission over and over again, and can also knock out sensor network communications. Jamming is an easy attack to apply, as all wireless communication technology is vulnerable to it [78,79].

Exhaustion attacks intentionally consume device resources, such as battery lifespan, memory, and processing power, to disable the device and the network as a whole. This attack can exhaust the resources of the device in a relatively short period of time and it is stealthy enough for an attack target, making it difficult to detect [69].

6.6. Summary

As the previous sections demonstrate, the vast majority of threats in 5G-IoT environments are concentrated in the perception and network layers. Although the application layer is extremely relevant for the IoT context, threats directed at this layer cover a broader context, beyond the scope of this work, but should also be considered for the security assessment of IoT systems.

Threats to IoT systems at the network layer can be minimized by using secure communication protocols and encryption algorithms. Similarly, solutions can also be applied to the perception layer. Such solutions are discussed in the next section.

7. Proposed Solutions

Figure 13 presents an overview of the proposed solutions for IoT security identified in the research papers. The proposals included architectures, methodologies/methods, testbed, models, algorithms, protocols, schemes, approaches/mechanisms, and frameworks. Most of the solutions are related to approaches/mechanisms. Of the 142 papers, 47 did not present the proposal of specific solutions for IoT security.

Each proposed solution focus on different threats (e.g., DDoS, eavesdropping, replay, MITM, and malware) or specific threats (e.g., APT). Figure 14 presents the relations between the purpose (i.e., detect/mitigate, planning, mitigate, or detect) of solutions identified in the research papers and threats. The bubble size relates to the number of papers focusing on the threats with specific purposes. The greater the size, the greater the number of research papers identified.

The solutions addressing different threats focused on design, implementation, security analysis, and security assurance frameworks [13,24,32,50,67,80,81,82,83,84]; systems for security assurance [47], intrusion detection [29] and security incident management [85]; approaches/mechanisms for security [7,25,28,40,41,43,45,48,86,87,88,89,90,91] and remote diagnostics [92]; schemes for security assurance [72,73,93,94,95]; protocols for security assurance [8,16,39,53,62,63,96,97,98,99,100,101]; algorithms for security assurance [102]; models/algorithms for security assurance [35,103], testbed for security experimentation [104]; methodology for development [66]; method for privacy and security [21,60,105]; design of core network [106], and architecture for security [23,42,59,107,108]. Some of the solutions rely on perception layer security, blockchain, embedded SIM, fuzzy logic, network slicing, deep learning, SDN/NFV, machine learning, federated learning, differentially private federated learning, chaotic digital watermarking, field programmable gate arrays, chaotic map zero-knowledge proof, and Boltzmann machine keys generation.

Regarding specific solutions, the authors focused on frameworks for security against Selective Forwarding (SF) and wormhole attacks [31], malware injection [109,110], DDoS attacks [111,112], and privacy threats [113]; systems for security against intrusion [27,114,115]; approaches/mechanisms for security against forgery, counterfeit, replay, and Sybil attacks [74], Advanced Persistent Threat (APT) [51], and DDoS and malware injection [58]; schemas for security against Stolen device and impersonation attacks [116], forgery [57], privacy threats [117,118], quantum attacks [54,56].

Besides, some solutions consider specific vertical applications smart health [31,32,45,64,66], Industrial IoT [29,35,82,91,105,106,119,120], smart cities [25,57,84,101], smart agriculture [108], public services [87], and smart transportation [27,121]. The remaining solutions do not address specific vertical applications, only focusing on IoT [3,8,13,24,39,43,50,51,58,63,74,83,85,86,99,109,112,116,117,122,123,124,125] or 5G-IoT [16,21,40,41,47,56,56,59,60,60,62,67,72,73,77,80,81,88,89,90,92,93,94,95,97,98,100,102,104,105,107,110,111,113,114,115,115,118,126,127,128,129,130,131,132]. Table 3 and Table 4 present a summary of the 95 proposed solutions identified in the selected papers.

8. Recommendations

Most of the reviewed papers addressing recommendations presented secondary studies (e.g., [69,134]). Examples of general recommendations are listed below:

• users should not use default passwords;
• users should keep software updated;
• developers should ensure secure communication;
• developers should simplify the installation and maintenance of devices;
• developers should ensure software integrity;
• developers should ensure that personal data protection; and
• developers should prevent interruptions.

Other recommendations include the usage of intrusion detection systems [6,20,36,135,136,137], threat detection systems [65], early warning systems [138], anomaly detection systems [61], code clone detection [44], post-quantum cryptography [69], lightweight cryptography [37,68,134,139,140], temporary identity [141], authentication [4,7,9,49,52,70,79,108,142], authorization [78], blockchain [30,38,76,143,144,145], perception layer security [10,146,147], covert timing channels [148], end-to-end security [149], key management [34], secure exchanging data [26], and frequent key update [150].

The following sections highlight the most frequent recommendations identified in the reviewed papers. Specifically, we highlight machine learning-based solutions, blockchain-based solutions, lightweight solutions (e.g., lightweight cryptography and protocols), and perception layer security.

8.1. Machine Learning

The usage of machine learning is a trend in the context of 5G-IoT security. Implementing intrusion detection systems based on deep learning can increase security, for instance, of vehicular networks in a distributed architecture [135]. Examples of specific usage scenarios include attack detection (e.g., DDoS [6]), anomaly detection, malware IoT detection, and botnet detection. These systems can rely on techniques such as deep neural networks, convolutional neural networks, Recurrent Neural Networks (RNN), long short term memory RNN, and gated recurrent unit RNN.

In addition to deep learning solutions, less complex supervised learning approaches are also relevant [20]. Thus, algorithms such as k-nearest neighbors, random forest, and decision trees, can be trained to implement detection, classification, and mitigation models to improve 5G-IoT security [61].

We highlight some of the proposed solutions identified in the previous section to exemplify possible implementation. Dib et al. [109] proposed a framework based on deep learning techniques for classifying IoT malware. The solution can identify new malware families in the context of 5G-IoT. Lawal et al. [112] presented a framework for DDoS attacks mitigation based on machine learning. The framework relies on fog computing to address processing and storage problems. Rey et al. [110] proposed a security framework based on federated learning to detect malware affecting IoT devices. Anand et al. [64] proposed a convolutional neural network for detecting malware attacks in 5G-IoT.

8.2. Blockchain

Another recommended solution to increase security and privacy in 5G-IoT is the usage of blockchain [145]. Blockchain-based solutions can be part of frameworks to secure IoT applications [144]. Blockchain enables the decentralization of security resources in 5G-IoT environments.

Assuring trust, confidentiality, and integrity is a relevant issue in the context of 5G-IoT. Therefore, blockchain can assist in tracking, organizing, and supporting communications. Besides, such technology can ensure transparency and improve confidence in IoT applications (and services) such as smart e-voting in the context of smart cities [87].

For instance, Miloslavskaya and Tolstoy [85] proposed a blockchain-based system for information security incident management. Srinivasu et al. [45] propose a blockchain-based approach to secure healthcare data communication in the context of 5G-IoT. Deebak and AL-Turjman [107] proposed a lightweight and robust blockchain-based distributed architecture for 5G-IoT.

8.3. Lightweight Solutions

Given the resource constraints of IoT devices, it is essential to provide lightweight solutions such as lightweight cryptographic algorithms. Cryptography is a popular and relevant solution in the context of IoT. Lightweight cryptographic algorithms relate to block ciphers and stream ciphers. S-AES, ICEBERG, and DES are examples of block ciphers; while GRAIN and Trivium are examples of stream ciphers [140]. There are also proposals of hybrid ciphers (e.g., Hummingbird).

Besides, authentication is recommended to increase the security of IoT devices. For instance, Ambareen et al. [72] presented an authentication scheme for in 5G-IoT in the context of D2D communications. Fan et al. [97] proposed an ultralight mutual authentication protocol for near field communication.

8.4. Perception Layer Security

Perception layer security can also support in ensuring the security (e.g., confidentiality) of resource-constrained IoT devices. For instance, 5G-IoT devices with full-duplex capability can be exploited to prevent jamming attacks [147]. Besides, perception layer security schemes are recommended to present eavesdropping by increasing the secrecy rate. Other examples of possible solutions include, but are not limited to perception layer authentication (e.g., preventing pilot contamination attacks) and frequency-hopping spread spectrum (e.g., preventing interference attacks). As a specific solution, Qi et al. [50] presented a secure massive access framework for the 5G-IoT, exploiting the inherent co-channel interference.

9. Related Work

A wide range of papers covers security and privacy issues in 5G networks. The security aspects in 3GPP 5G networks are presented by [151] and [152]. The authors stated that security requirements should be standardized and all vendors and operators must ensure they are enforceable and verifiable. Research issues in slice authentication mechanisms are discussed by [152]. The paper [151] also points out that IoT integration may raise more security concerns, particularly regarding privacy. Security risks in 5G-IoT environments are analyzed by [33], and security requirements are proposed for IoT control and management.

An overview of challenges in 5G-IoT systems is provided by [153], with security threats and approaches to mitigate them. The paper addresses the challenges in communications between devices and with the cloud, presenting protocols and techniques to improve it and provide scalability. The paper [154] points out that the concerns about security and privacy are the centerpiece in 5G-IoT environments, and a systematic security strategy is required in 5G-IoT environments.

10. Conclusions

We presented a trusted and general IoT architecture, proposing the application of TEEs to core components of a distributed architecture commonly employed for cloud/fog-based IoT applications. We used HCPN to formally model the architecture and verify security aspects, considering the communication between all the architecture components and the authentication, authorization, and encryption processes. We defined 14 security properties and performed model checking, enabling the generation of other project artifacts (e.g., test cases) to increase confidence in the trusted architecture’s correct usage. As all properties are satisfied through the model checking, we have evidence that the trusted architecture assures data confidentiality and integrity, preserving data’s security and privacy. We answered our defined RQs by presenting the generic, modular, executable, and parametric specification, supported by model checking and MBT with the MBT/CPN tool. As future work, we envision the modeling and model checking of the remote attestation protocol, also considering security aspects. Our model can be extended to include, for instance, time information based on experiments, allowing the verification regarding scalability and performance properties.