(SEM VII) THEORY EXAMINATION 2024-25 IOT SECURITY

SECTION A — Very Short Answers (2 Marks Each)

a. IoT vs Traditional IT Security Requirements

IoT: resource-constrained, heterogeneous, large scale

Traditional IT: centralized, high computing power, fewer devices

b. Significance of Access Control in IoT     Prevents unauthorized device/user access

Ensures data confidentiality and system integrity

c. Asymmetric Encryption in IoT

Advantages                                               Secure key distribution

Strong authentication

Limitations                                               High computational overhead

Not ideal for low-power devices

d. Role of Hash Functions in IoT                Ensures data integrity

Supports authentication and message verification

e. Identity Lifecycle in IoT vs Traditional IAM

IoT identities are dynamic, device-centric, and large-scale

Traditional IAM is user-centric and static

f. Secure Storage of Credentials                Hardware security modules (HSM)

Secure enclaves                                         Encrypted key storage

g. Regulatory Frameworks in IoT Privacy   Enforce data protection laws

Ensure user consent and accountability

h. Privacy in Resource-Constrained Devices Use lightweight cryptography

Edge processing                                         Minimal data collection

i. Cloud-Enabled IoT Security Challenges   Data leakage

Weak encryption                                        Shared infrastructure risks

j. Cloud Provider Security Controls            Identity management

Encryption services                                    Monitoring and compliance tools

 SECTION B — Analytical / Conceptual Answers (10 Marks)

a. Transport Encryption in IoT                    Uses TLS/DTLS

Protects data in transit                              Mitigates eavesdropping and MITM attacks

b. Cryptographic Controls in IoT Protocols

Authentication                                           Encryption

Integrity checks                                         Enhances secure communication

c. Identity Federation in IoT                       Enables cross-platform authentication

Improves scalability and interoperability

d. Privacy Schemes for Wearable Sensor Networks

Lightweight encryption                             Anonymization

Energy-efficient protocols

e. Blockchain for Cloud-Based IoT

Benefits                                                    Decentralization

Data immutability

Challenges                                                Scalability

High energy consumption

SECTION C — Privacy & Fault Tolerance (10 Marks)

a. IoT vs Traditional Privacy Concerns        IoT collects continuous, real-time personal data

Higher privacy risk in healthcare & smart homes

b. Fault Tolerance in IoT Security               Maintains system availability under attacks

Attack trees help identify vulnerabilities and countermeasures

 SECTION D — Cryptography in IoT (10 Marks)

a. Random Number Generation (RNG)      Critical for key generation

Uses hardware RNGs, entropy sources      Ensures unpredictability

b. Key Management in IoT                         Key generation, distribution, rotation

Lightweight key exchange protocols         Secure communication among nodes

SECTION E — Access Control & Identity (10 Marks)

a. RBAC vs ABAC in IoT

ABAC is better for dynamic IoT environments

b. IoT Identity & Privacy

Identity links devices to users

Privacy-enhancing technologies reduce tracking and profiling

SECTION F — Privacy Preservation (10 Marks)

a. Consumer IoT vs Industrial IoT Privacy

Consumer IoT: personal data, user privacy   Industrial IoT: operational secrecy, IP protection

b. Privacy-Preserving Data Dissemination

Data anonymization                                      Secure aggregation

Challenges: scalability, latency

 SECTION G — Cloud & IoT Security (10 Marks)

a. Multi-Tenancy in Cloud IoT

Shared infrastructure increases attack surface

Isolation via virtualization, access control

b. Cloud Models for IoT