Securing the Sustainable Future of Manufacturing: Analysis of IoT Retrofit Challenges and Solutions

1. Introduction

The natural and virtual worlds are increasing and closely rising to build the Internet of Things (IoT). In truth, the IoT inspired factories and governments to begin an evolutionary journey to Industry 4.0, the fourth industrial revolution [1]. IoT equipment is powered by low-cost chips provided by semiconductor manufacturers such as Renessa, STMicroelectronics, NXP, Silicon Labs, etc. As the manufacturing system is growing, it isn't easy to fulfil all the requirements of the manufacturing control system. The success of manufacturing depends on the power-efficient, cost-effective analysis, collection, and secure exchange of quality data. To improve productivity, manufacturing by embedded IoT devices is becoming popular. However, attempts to retrofit IoT devices in the existing system make it hard to ensure the security system of embedded devices due to the ignorance of cyber threats. IoT manufacturing systems developed IoT without security to produce more IoT devices; as a result, it introduces vulnerabilities to other manufacturing systems due to inadequate protection and policies.

In the last ten years, both challenges and solutions in IoT security have significantly matured. Previous works traditionally focused on securing IoT systems using a perimeter-based security approach, which provided protection to devices from isolated threats. However, with the increased technological advancement and the application of IoT into complex manufacturing systems, a more layered and integrated approach toward security has become highly necessary. Present-day research emphasizes data encryption, multi-factor authentication, and advanced monitoring systems that can take care of threats as they come along and is pointing toward more proactive and adaptive security solutions. By reviewing the evolution of these methodologies, this paper aims to deliver an in-depth insight into the ways in which IoT retrofitting security has changed over time to meet the expanding needs of Industry 4.0. Through all network connections, attackers can launch attacks on manufacturing companies at the device [2], communication, and the cloud level.

The consequence of having a simple and economical IoT device is that for the last five to ten years, hundreds of millions of IoT devices have been sitting on the internet, unpatched and vulnerable, which hackers and criminals have begun to attack. There are no effective, low-cost solutions known to protect vulnerable devices. In the past few years, researchers have investigated alternative safety architectures for low-end networked applications [3]. To gain useful information, the attacker attempts to catch traffic at various points of the transmission, such as the hardware information in analyzing the network traffic [4]. IoT consists of physical objects, sensors, software, and other technology, which helps to connect and exchange data with other devices over the Internet [51]. For example, wearable health monitors, smart security systems, Smart fire alarms, etc. IoT security demands many levels of abstraction and several dimensions. The levels of abstraction range from the physical layers of sensors, computing and communication, and computers to the semantic layer in which all information collected is interpreted and processed [5]. When these sensors are linked, the data obtained by the sensor must be exchanged or sent to the cloud-based data centre for further processing [6]. Message Queue Telemetry Transport is one of the common application layer protocols in the IoT world simply called MQTT. It provides a good basic security feature. However, this method of authentication can face many problems; it may be easier for passive attackers to connect [7,50].

This paper aims to discuss the security requirement of IoT retrofitted devices in the manufacturing environment to acquire and integrate process data into the cloud platform. This security requirement helps secure the manufacturing environment’s data against cyber threats during communication with IoT devices and the cloud. Furthermore, it will provide a custom solution designed to meet the memory and performance of Low-end IoT devices. This paper reviews IoT security requirements and solutions, current retrofitting IoT infrastructure in the manufacturing sector and IoT framework architectures with this goal in mind. To achieve this goal, the following contributions have been mentioned:

• Representing a comprehensive review of security requirements of IoT device approaches in the manufacturing environment.
• We are providing a comparison of the domain, architecture, requirements, and solution of chosen papers.
• Illustrating the architecture of IoT frameworks in the context of IoT security and IoT retrofitting.
• Proposing secure IoT Retrofitting System Architecture for Manufacturing Environment.

2. Background

The background is going to represent a short explanation of relevant studies we assessed in security & retrofitting of IoT devices in the manufacturing environment; the evaluation factors are introduced in the reviewed studies.

2.1. IoT Security

In today's research community, the Internet of Things (IoT) is the most discussed paradigm. The Internet of Things (IoT) is rapidly expanding into a variety of applications, including building and home automation, smart transportation systems, wearable devices for healthcare, industrial process control and manufacturing. Several studies have reported that IoT networks face a variety of security issues, including authentication, authorization, information leakage, privacy, verification, tampering, jamming, and eavesdropping. IoT device integration with various technologies and devices creates interoperability with the components in IoT architecture: device layer, communication layer, and application layer. As a result, security measures should be implemented in combination with an analysis of threats and vulnerabilities at each layer [8].

Recent advancements in IIoT security have been analyzed, highlighting how the integration of 5G, AI, and cloud technologies has transformed security protocols in smart manufacturing environments. This analysis underscores the necessity for enhanced security measures to address the sophisticated challenges faced today [48].

2.1.1. IoT Retrofitting

The concept of Industry 4.0 was born in Germany in 2011 as part of a modernization strategy. Since then, numerous studies have been conducted in the quest for increased productivity and increased competitiveness in the global market. Industry faces a huge challenge to migrate into Industry 4.0. With the help of the IoT retrofitting concept, which is the reuse of old equipment and the integration of IoT technologies, migration becomes less costly and more insightful [9].

2.1.2. Security in IoT Architecture

In determining security for a retrofitted IoT device or applications, IoT architecture plays an important role. Because the security of the retrofitting process depends on the joint and various properties like IoT architecture and communication between them[10]. Most developers consider two types of IoT architecture; three-layered and the other is five-layered. The well-known IoT structure is divided into three layers; device layer, communication layer, and application layer. Each layer has its security requirements. The most generic way is to focus security on the communication layer (Figure 1). However, there is an enormous scope for the development of IoT security, such as hardware security, communication, and application security as seen in Figure 1.

In synthesizing the reviewed literature, Table 1 compares different IoT security protocols and retrofitting strategies based on criteria such as implementation costs, effectiveness of security, scalability, and ease of integration. This comparison highlights the trade-offs faced by manufacturers in choosing IoT solutions to retrofit, thereby emphasizing the need for a protocol selection process that closely aligns with specific operational needs.

2.1.3. Integration of Emerging Technologies for IoT Security in Industry 4.0

Some of the recent developments in 5G, AI, and blockchain have critically improved the security of IoT systems in Industry 4.0 environments. For instance, 5G technology enables low latency and high-bandwidth communication that is essential in IoT systems requiring real-time data transfer in manufacturing settings. The utilization of 5G has not only improved connectivity but has also allowed for secure network slicing, thereby reducing the risk of unauthorized access.

IoT monitoring increasingly relies on AI-driven threat detection. Machine learning algorithms can identify and take action on anomalies in real-time, blunting potential cyber threats before they impact operations. For example, AI-enabled predictive maintenance enables constant monitoring of device health, which reduces operational downtime and heads off potential vulnerabilities that could be leveraged in an attack.

The security of IoT is further enhanced with blockchain technology by offering a decentralized approach toward integrity and validation of data and transactions. Researchers have shown how blockchain can be applied to IoT retrofitting for enhanced transparency, immutability of data, and secure communication. In manufacturing, blockchain-based solutions ensure that data across retrofitted IoT devices remain secure and auditable, which is crucial to be able to maintain confidence in automated industrial environments.

2.2. Related Works

The Internet of Things (IoT) opens up ways to exchange and communicate data on the Internet for wearable devices, home appliances, and applications. Innovative home Internet of Things (IoT) gadgets such as cameras, plugs, and doorbells are increasingly being utilized to improve the quality of daily living. Although customers appreciate the functionality that smart home devices offer, these devices' security and privacy aspects have been poorly built from the beginning. In this case, the consumer can face safety, privacy, and security issues at their own home. More sophisticated cyber-security architecture is needed in homes. The impacts of IoT failures can be severe, so IoT studies and research on security issues are of extreme importance. IoT protection is mainly aimed at maintaining privacy, and confidentiality, ensuring the security of IoT users, infrastructures, data, and devices, and ensuring the availability of IoT ecosystem services.

The authors in [1] proposed a mitigation framework that discovers several previously unreported vulnerabilities in some devices like video doorbells, pet feeders, home cameras, and switches. The authors find that some devices use insecure DNS communications, which can be subjected to an MITM attack. A proper encryption method is needed against MITM attacks. IoT attacks can occur in terms of their layer, such as the perception layer, gateway layer, and cloud layer. Navod Neranjan Thilakarathne [12] has tried to summarize IoT security issues in words of primary information security concepts confidentiality, integrity, and availability with regards to its architecture in his article. To improve IoT security, we can take some action, for example, using security credentials, Hashing techniques, encryption mechanisms, and digital signatures.

Study [3] describes eight common attacks targeting IoT devices on the physical layer itself. They suggest potential mitigation strategies as well. Some of their methods are using the chain of trust, a lightweight cryptographic encryption technique, two-factor authentication, etc.

A study of [4] has discussed a detailed survey of IoT security solutions. Their paper has discussed issues related to the sensing layer, network layer, middleware layer, gateways, and application layer. They have drawn the solution with blockchain-based solutions, fog computing, machine learning, and edge computing solutions. Another research [5] also suggested using blockchain, fog computing, machine learning, and edge computing techniques as a solution for securing IoT applications. IoT contains lots of information, and consumers primarily manufacturing need to store it in the cloud for further analysis. There are specific security issues that the manufacturing can face during the transfer of data to the cloud.

Authors of [6] suggest that data transfer from the industrial unit to the cloud needs to be fully secured. Several IoT frameworks have been launched to make IoT maintenance. The selected set of IoT platforms includes AWS IoT from Amazon, ARM Bed from ARM and other partners, Azure IoT Suite from Microsoft, Brillo/Weave from Google, Calvin from Ericsson, HomeKit from Apple, Kura from Eclipse, and SmartThings from Samsung, which helps to secure IoT data in the cloud [7].

The authors in [13] proposed an architecture to integrate the whole system with AWS IoT by classifying two, layer-device and an integration layer as Figure 3 shows. Hardware is retrofitted with various sensors to process data and transfer data through LoRa technology. OPC UA works as a middleware to provide platform-independent and service-oriented architecture. AWS Greengrass helps to interact with Raspberry Pi and AWS IoT core. Data can be analyzed in AWS IoT core for forecast learning and predictive analysis.

Also, the authors in [14] proposed a system where an energy sensor was installed with a 20-year-old CNC mill. This sensor sends data using ZigBee to Smart Link. This smart link sends data to the IoT gateway by using Modbus message protocols under TCP/IP. IoT gateway collects all data and sends it to two cloud infrastructures; one is MindSphere Cloud which uses MQTT, and another one is GRV Cloud which uses HTTP in Figure 3.

2.3 IoT Architecture of 5 Popular Frameworks

There are a range of available IoT clouds, such as Azure, AWS, Alibaba, IBM, and Google. Let’s get an overview of some IoT frameworks to see how they handle their security.

To optimize the best security in the IoT development framework, Microsoft divided IoT architecture into three layers. These layers are the device, field gateway, cloud gateway, and services as seen in Figure 4. Each layer makes data/information transition from one source to another. During the transition, data/information could be subjected to various attacks such as spoofing, tampering, repudiation, information disclosure, and denial of service of attack. Each layer has its data, authentication, and authorization requirements. The device layer authenticates the device using Transport Layer Security (TLS) or IPSec. Field gateway implements TLS RSA/PSK, IPSec, and RFC 4279 to establish itself as to cloud gateway. On the communication path field gateway and cloud, the gateway implements security on a protocol level (MQTT/AMQP/HTTP/CoAP). Microsoft uses Azure storage service encryption to encrypt data in storage automatically. It also uses Transparent Data Encryption to perform real-time encryption and decryption of the database, backups, and transaction log files.

AWS IoT provides three layers of services that help to connect IoT devices to other devices and the AWS cloud as seen in Figure 5. First, AWS IoT offers open-source client libraries and application SDKs for various embedded operating systems and microcontroller platforms for the device layer. If an IoT computer can be configured using one of the programming mentioned above languages (C, Node.js), it can bind to the AWS IoT cloud. Second, AWS IoT core connectivity service provides secure communication with IoT devices and AWS IoT in the communication layer. AWS uses X.509 certificates secure protocols to ensure the security of Device communication. Third, the AWS device gateway supports MQTT, HTTPS, and Web Sockets protocol to provide a secure mechanism for device and AWS IoT applications. In the application layer, data gets stored in AWS RDS DB and DynamoDB. During the transition, data is encrypted using TLS, and the rest of the data is encrypted using AWS-owned keys.

Alibaba offers a device layer, IoT edge layer (connection layer), and Application layer, which is Alibaba cloud IoT as illustrated in Figure 6. Alibaba Cloud IoT Platform has a multi-layered security strategy to ensure communication between devices and the cloud. For each device, the IoT Platform assigns a Device Name that is unique within the same product. The IoT Platform may be directly accessed by devices via a gateway linked to the IoT Platform as sub-devices. In the communication layer, Edge Gateway uses a lightweight encryption channel, LoRa key security, while transiting data to the Alibaba cloud platform. In the application layer, Alibaba Cloud uses PKI certificate management, trusted service management, trusted device authentication, and key management and distribution services to secure data.

IBM Watson IoT platform adopts a three-layered architecture, including the device layer, the edge layer, which is the communication layer, and the cloud layer, which is the application layer as illustrated in Figure 6. Wireless protocols like Bluetooth, Zigbee, Wifi, cellular, and RFID, as well as over-the-wire protocols like Ethernet, are used to transmit data from the device layer to the communication layer. IBM Watson IoT platform connects devices, networks, and gateways through a system that uses MQTT and HTTPS open standard-based communication. IoT gateway provides limited device management and registration capabilities. During communication from the IoT gateway to the cloud platform, it uses MQTT or HTTPS over TLS. Communication is secured by a security authorization token too. In the Application layer, cloud Data remains encrypted using AES 256-bit encryption.

Google IoT Core is a fully managed service that allows connecting, managing and ingesting data from millions of devices easily and securely. Google divides the IoT platform into three basic layers: device, gateway, and cloud as illustrated in Figure 8. In device, layer devices can connect to the internet either directly or indirectly. Using a gateway, devices that aren't directly connected to the internet can access cloud services in the communication layer. An IoT gateway system provides communication and translation between devices and the cloud. Data is stored in the cloud in the application layer, which is sent over through MQTT or HTTP protocol from the gateway. Google IoT core supports MQTT and HTTP protocol so that developers can use the existing device with minimal changes and connect all devices, gateways, and Google Cloud.

2.4. Popular Open-Source IoT Frameworks

In this section, we find out the popular open-source IoT framework by using a Google search engine. We use the keyword “popular open-source IoT framework” for searching purposes. We refer first two pages of Google excluding the ad page. The popular frameworks we find out are listed below in Table 2. There are a range of available IoT clouds, such as Azure, AWS, Alibaba, IBM, and Google. Let’s get an overview of some IoT frameworks to see how they handle their security.

Security Aspects of Top 5 Opensource IoT Framework

A brief explanation of the security aspects provided by the selected frameworks based on Table 2, is as follows;

• KAA IoT security: KAA provides user authentication, access authorization and server authentication using OAuth 2.0 and keylock.
• Zetta IoT security: While interacting, Zetta keeps track of security credentials and relevant information. Zetta supports MQTT, and CoAP protocol to ensure the security of the IoT environment.
• DeviceHive security: DeviceHive security is safe by design. The platform is built using modern security techniques. JSON Web Tokens are used to secure DeviceHive authentication (JWT). It supports MQTT protocol and custom firmware as well.
• Aurdino IoT platform security: Arduino is very aware of the dangers of hacking and is continuously working to improve security in both its hardware and software. Customization users may utilize the Arduino libraries, which include HTTP, MQTT, X.509, and JSON support, to connect to any web service they choose.
• OpenRemote Security: HTTP and MQTT are examples of standard protocols supported by the OpenRemote platform. OpenRemote protects all assets and keeps stored data fully secured in both cloud and on-premise platforms.

3. Methodology

This research is based on a literature review to comprehensively understand and summarize the current landscape of IoT security requirements and solutions. The literature review method, in general, consists of a statement and research on a specific issue [16]. Our literature review is divided into six stages to facilitate the completion of the proposed SLR study; (i) Planning; (ii) Research questions (iii) Search process (iv) Inclusion and exclusion criteria (v) Data collection (vi) Final selection. This type of research allows for discovering research trends, raising essential topics and genuine concerns, and identifying research opportunities in less-explored areas.

3.1. Planning

In the planning stage, the primary focus is to establish the research objectives, which are:

To understand the current state of IoT security requirements and solutions.

To propose a secure retrofit IoT system architecture that can be employed in a manufacturing environment.

In alignment with these objectives, specific research questions were formulated to guide the review process.

3.2. Research Questions

The research questions for the current literature review (LR) study are provided in this section. Four research questions (RQs) are given to discuss comparable difficulties and associated concepts, as this study leads us to develop a comprehensive answer to the manufacturing environment. A literature review (LR) discovers, selects, and critically evaluates research. This method will be used to address the following research questions.

RQ1: How are the architectures to integrate IoT?

RQ2: What are the security requirements and solutions in terms of securing IoT devices?

3.3. Search Process

This section discusses how each article for this study was identified. Some specified electronic databases were evaluated and consulted to extract relevant studies on the security of IoT devices, and IoT retrofitting approaches. We intend to represent the technique of selecting papers and the search process based on the SLR approaches, including keyword searching, research paper titles, and the quality of the publishers, as shown below. The following strings are obtained by searching the below phrases and their synonyms for the essential components [16].

(“IoT” OR “Internet of things”) AND “security” AND “requirements” AND (“manufacturing” OR “Industry”)

Searching academic databases, which are referenced in this work, is the most frequent approach to obtaining legitimate papers in every area. It is assumed that these articles have covered books. As a result, no books representing the topic have been searched. Table 3 lists the most essential databases for the study topic. The study needs to exclude IEEE publications from the ACM digital library to do a better analysis of the papers.

3.4. Inclusion and Exclusion Criteria

Following the initial selection of studies from the database search, the subsequent phase filters the retrieved studies and chooses the relevant ones for a more in-depth analysis. According to the SLR methodology outlined in [18], guidelines for choosing relevant research must be established. Mainly, a set of inclusion/exclusion criteria must be defined. Our inclusion/exclusion criteria are discussed in Table 4.

3.5. Data Collection

Table 5 illustrates the process of data collection. The initial stage of data collection involves extensive literature search and review. Initially, a systematic search was performed on various databases over three months from January to March 2023. This search utilized specific keywords and search strings to yield precise results related to the scope of our study.

Once the articles were identified, we applied pre-defined inclusion and exclusion criteria to select the most relevant and recent contributions in the domain of IoT security. Particularly, articles published before 2018 were excluded to maintain a focus on the latest advancements.

Following this, the remaining articles were scrutinized in more detail. Each article was reviewed for its relevance to our research questions and its overall quality. Specifically, the quality of each article was assessed using a predefined set of criteria to ensure the integrity of our review process.

Out of the initial pool of 134 articles, only 45 were chosen for the final review. These selected articles not only met the relevance and quality criteria but also contributed significantly to the IoT security domain.

3.6. Final Selection

After evaluating and analyzing the primary studies, to conduct a more comprehensive and accurate analysis we eventually selected fourteen articles as our final research according to the entire text and the quality of the review. These fourteen articles were also chosen based on inclusion/exclusion criteria. All of the articles and citations were managed using Mendeley software. Figure 9 shows how we finally selected our papers for review purposes.

4. Security Requirements and Solutions in IoT

In this section, we provide a detailed analysis of the publications selected for the final review. We discuss the common security requirements identified in IoT systems and the proposed solutions to address these requirements. Each selected publication is critically reviewed to understand its contribution to the field. These 16 chosen papers cover research from 2018 to 2024 as shown in Figure 11. This figure also shows there is some redundancy in terms of article coverage year. Furthermore, the type & domain of the research paper, implemented IoT architecture, security requirements and solutions are explained. Considering our efforts in reviewing papers, we found out researchers are implementing almost the same architecture to implement IoT communication and they face common security requirements but provided security solutions are different. The provided categorization scheme's overview, as well as their area, are presented in Table 6.

5. Retrofitted IoT System Architecture in Manufacturing Environment

This section details the structure of the IoT system architecture, explaining how the device, communication, and application layers interact with each other. By understanding the mechanics of the system, we can better identify potential security vulnerabilities. Retrofitting approaches in a manufacturing environment with IoT devices require a device layer, communication layer, and application layer as illustrated in Figure 10. The device part typically consists of a retrofitted device, a local wireless connection, and an IoT gateway.

These IoT gateways allow fast and easy access to the IoT device, and they are compatible with IoT clouds. For large data packages, cloud computing is a simple way to travel. It is a two-way exchange of data between a computer and a remote service over the Internet. A connection to the Internet Protocol (IP) network is created by an IoT computer and then hooked up to the cloud. To communicate and link with each other, the large quantities of data generated by IoT devices need extreme efficiency. IoT in the cloud offers the connectivity required to exchange information between devices and make sense of it at a faster pace. There are a range of available IoT clouds, such as Azure, AWS, Alibaba, IBM, and Google, which we have discussed in the previous section.

5.1. Device Layer

As mentioned in Section 2, the individual machine plays a different significant role in retrofitting. As many low-cost devices are available, we assume the IoT system in the manufacturing environment should be built with this low-cost IoT device. The device should be powerful and capable of interacting with other devices in terms of communication. The device layer identifies objects, gathers data, and collects data from surrounding environments.

IoT devices use a gateway to communicate with external networks. Table 7 presents the connections between IoT devices and gateways through local area networks such as Wi-Fi, ZigBee, Bluetooth, LoRAWAN, etc.

5.2. Communication Layer

The communication layer maintains connectivity, and message routing between the device layer and application layer. It receives information from the device layer and forwards it to the application layer using capabilities such as the Internet. The communication layer enables connectivity using the IoT gateway (which is mentioned in 6.1). The objective of allowing connectivity is to transmit data to the application layer using the Internet. The communication layer enables the developer to establish how IoT messages are sent and received by the device layer and how data is stored in the cloud.

To ensure that all information transmitted over the network is encrypted to outside parties, the developers can use a secure communication protocol such as MQTT, CoAP, AMQP, and DDS [41]. These protocols are used in interaction among IoT devices and cloud infrastructure and are presented in Table 8.

5.3. Application Layer

The application layer comprises of application and a server. Popular frameworks, they call it the IoT cloud (Figure 10). IoT cloud server (by Microsoft Azure, IBM Cloud, Amazon AWS, Google Cloud, etc.) is a powerful and cost-effective solution used by built-in applications and custom portals to connect, manage and track information. However, for applications developed without using any framework, the IoT cloud server can be an internal server of that organization.

One of the security measures has already been taken care of if IoT applications are created utilizing existing frameworks such as those listed above. Otherwise, developers need to consider security at the application, database, and server part, such as user access, data security, software security (using SSDLC such as OWASP, MS SDL, NIST 800-64), firewall configuration, etc.

6. Proposed Secure Retrofitted IoT System Architecture in Manufacturing Environment

In this section, the analyzed results from the literature review data are presented. Through evaluating a few studies, we identify that security in IoT is a critical issue in a manufacturing environment. To increase security, we intend to discuss security requirements for retrofitting IoT devices in manufacturing environments. By examining each layer of IoT architecture, this article includes both ease and protection. The paper aims to discuss the security requirement of IoT retrofitted devices in the manufacturing environment to acquire and integrate process data into the cloud platform. The security requirements and solutions we have discussed in this paper can impact IoT devices.

We assume that our IoT environment of manufacturing is located on the same floor or same room because Wi-Fi is efficient among all these networks. Wi-Fi traffic is sent between IoT devices and gateways. In a manufacturing environment, they have primarily IoT devices with low power consumption; as a result, MQTT is the most commonly used protocol between gateways and the cloud because it’s a lightweight protocol with a fast response time. In addition, it ensures low bandwidth data transfer as well. As illustrated in Figure 6, the retrofitted device produces a significant volume of data. For successful IoT-driven device implementation, storage capacity is necessary; Cloud computing is one of the architectures which will ease architectural computing and resource demands.

7. Sustainability in IoT-Enabled Manufacturing

7.1. Sustainable IoT Architecture

The integration of IoT in manufacturing not only enhances security and efficiency but also plays a pivotal role in sustainable manufacturing practices. Sustainable IoT architecture focuses on optimizing resource utilisation and minimising waste. By leveraging data collected from IoT sensors, manufacturing units can significantly reduce energy consumption and optimize supply chain management. This approach not only conserves resources but also reduces operational costs, making it a financially viable option for manufacturers. Furthermore, retrofitting existing equipment with IoT devices, as proposed in this paper, extends the lifecycle of machinery, thereby reducing electronic waste and promoting the sustainable use of resources.

7.2 Eco-Friendly Security Solutions

The proposed secure IoT system architecture emphasizes not only the security of IoT devices but also their environmental impact. The use of energy-efficient algorithms and protocols in securing IoT devices contributes to the overall reduction in energy consumption of the manufacturing unit. Moreover, the adoption of cloud-based solutions and edge computing in IoT infrastructure minimizes the need for extensive on-site data centres, which typically consume significant amounts of energy. Additionally, the use of Trusted Consortium Blockchain (TCB) technology has been proposed to ensure the integrity of big data in industrial IoT settings. The approach not only enhances security but also supports sustainable manufacturing practices by reducing energy consumption and optimizing data processing and verification processes [49]. By ensuring that the security solutions are eco-friendly, manufacturers can work towards a greener and more sustainable future, aligning with global environmental goals and standards.

8. Discussion

This extensive literature review has revealed some significant developments and challenges pertinent to IoT security in the context of retrofitting at manufacturing sites. One of the key points emerging from this study is the role of new technologies like 5G, artificial intelligence, and blockchain in meeting complex security requirements within Industry 4.0. Each of these technologies possesses its own strengths and potential weaknesses, further indicating that a tailored approach is needed when retrofitting IoT devices in manufacturing environments.

The study by Kim et al. [48] presents that 5G technology offers prominent scalability and increased security features, largely due to the feature of network slicing, which efficiently isolates the IoT devices from any unauthorized access. However, the high deployment cost associated with 5G technology can act as a bottleneck for any small or medium-sized enterprise. In not all manufacturing environments, the capital outlay required to implement infrastructure for 5G could thus be justified, and the deployment of 5G is likely to be more feasible in large-scale operations only where the requirement for low latency and high-bandwidth communications is paramount.

Specifically, the integration of AI-driven security, as noted by Hassija et al. [4], forms a remarkable development in view of real-time threat detection and anomaly surveillance. AI lets IoT systems detect and respond to security threats dynamically, allowing for enhanced overall system resilience. This is particularly valuable for predictive maintenance, whereby continuous monitoring can often mitigate vulnerabilities before they emerge. However, like 5G, AI-based systems can require a significant computational overlay and considerable expertise in implementation. Although the price is moderate, the level of integration required for AI would be demanding for legacy systems, where the processing is either not powerful enough or compatible with AI frameworks.

Juma et al. [49] investigated blockchain, one of the promising technologies that would ensure data integrity across IoT networks. Blockchain, being a decentralized system, serves to complement the needs of industrial IoT by preventing tampering with data and offering transaction transparency. The study shows that blockchain technology adds the most value when data permanence is required, as in quality and regulatory compliance in manufacturing [51]. Yet, considering the high costs involved in implementing blockchain and its relatively limited scalability on selected use cases, it would seem that the deployment of blockchain would be preferable in highly specific instances than blanket implementation in all IoT retrofitting applications.

On the other hand, lightweight protocols like MQTT and CoAP provide economically feasible solutions for secure IoT communication (Bhawiyuga et al. [33]; Nebbione & Calzarossa, [46]). It is particularly advantageous for resource-constrained devices because of the low-power, low-bandwidth characteristics of MQTT, thus easily embedding these protocols into existing devices with very minimal hardware changes. CoAP, on the other hand, being equally inexpensive is not as suitable for scaling applications due to constrained message size and reliance on UDP, which reduce reliability. These protocols provide medium security but can be quite easily integrated into systems, hence being practical choices for small-scale manufacturing units or projects on a constrained budget.

The research concludes that while technologies like 5G, AI, and blockchain indeed introduce better security and scalability features, they also come with higher implementation challenges and costs. On the other hand, lightweight protocol alternatives like MQTT and CoAP do seem economic, though at some cost regarding scalability and security. It points out the necessity for a hybrid approach in retrofitting IoT systems at manufacturing levels, therefore allowing manufacturers to select appropriate technologies given specific operational needs, budgetary constraints, and favored security levels. Future studies should, therefore, focus on the formulation of flexible, multi-tier security frameworks that will encapsulate the ideal features of these technologies to realize custom-tailored, cost-effective IoT retrofit options for diverse manufacturing conditions.

9. Conclusion and Future Work

In this research, the information has been gathered by the SLR method. After evaluating our selected articles, we found that several security issues are involved in integrating IoT products with existing systems. This paper presents security requirements for retrofitted IoT devices to operate in a manufacturing environment safely and to prevent security breaches. This discussion would help to reduce the security vulnerabilities of retrofitted IoT-based systems. The proposed IoT system architecture Figure 11 suggests a security-based architecture to incorporate a vast volume of data. Therefore, the proposed architecture can mitigate data breach risks significantly. In the future, the proposed secure IoT system architecture to strengthen security for secure communications can be implemented and hopefully can be easily integrated with the existing practice, as well as existing frameworks.