Edge Computing and IoT Data Breaches: Security, Privacy, Trust, and Regulation

Lack of Security Impacts Trust in Relationships

Edge computing security challenges the existing trust that end-users have when using device-level services [13]. Better securing IoT devices increases the trust relationship between the user the manufacturer, and the service provider. However, many IOT-based surveillance cameras and alarm systems, for instance, carry default passwords like “0000” and, in other cases, do not have any security mechanism whatsoever, leaving them open for anyone who wishes to gain access to them [14]. When users of these devices find out about the lack of security onboard, particularly while the whole aim was to secure physical premises that contained expensive tools and assets, there is an instant loss of trust in technology and the designers and developers of the technology [15]. Sharan et al. [13] identify that the main weakness in such established relationships is a failure to understand that both security and privacy impact trust between the user and the service provider.

Characteristics of Edge Computing Overcoming or Posing New Security Challenges

The hierarchical network topology of edge computing is considered to be a “double-edged sword” [16]. On the one hand, it provides security protection by the distribution of data between the nodes, and, on the other hand, it also presents security vulnerabilities at the different layers of communication between the end device, the edge, and the cloud infrastructure. Consider, for example, a critical health application on an edge device that monitors a heart pacemaker in a patient, and then each night, the data is uploaded from the edge device to the cloud from the patient’s home [17], with varying topologies and configurations given breakthroughs in wireless technologies. Other security challenges in edge computing relate to attacks performed between different interconnected devices, such as man-in-the-middle (MITM) attacks, eavesdropping, and tampering attacks [18]. Sendhil and Amuthan [18] describe how hackers are applying known types of attacks to edge services. Similarly, denial of service (DoS), tampering, eavesdropping, and waterhole attacks targeting lightweight IoT devices pose challenges that traditional cloud security methods could not entirely deter [19].

Edge computing security challenges the existing trust that end-users have when using device-level services.

Additional studies demonstrate that security challenges in edge computing include authentication constraints, due to the distributed network design and multiple stakeholders engaged in flows of communication [7]. For example, in cloud services, the centralized entity is responsible for authenticating users and devices. Distributed edge services are different in that they operate under a multidomain environment, and it is difficult to authenticate with centralized upstream services. According to Bangare and Patil [20], IoT is one of the most complex technology ecosystems, operating with diverse stakeholders. This complexity brings challenges with addressing the protocols associated with service delivery, service level agreements (SLAs), and cybersecurity frameworks. Similarly, [21] states that reduced performance metrics could breach the SLA between stakeholders while providing minimum service portability options to the user. Hassija et al. [22] discuss the issues related to device-to-device connectivity and the requirement for dynamic SLA security features. Special attention needs to be provided to SLAs which enforce agreements across multiple platforms as they allow IoT users the features required to safeguard them against attacks.

Addressing Security At The Network Edge

Data Privacy at the Edge

Data privacy is a topic of major concern due to the pervasive nature of IoT devices. Satyanarayanan [10] refers to the established concept of Cloudlets in their paper, which extends cloud fundamentals at a more granular level, toward edge nodes and the reduction of overcentralization. Edge computing extends privacy concerns with increasing functionality like location awareness and lightweight IoT devices which possess limited data protection methods [16]. Hagan et al. [29] note that cloud privacy and security breaches have become important challenges in centralized data processing and storage services, and while edge services are bringing these closer to the network boundary, breaches can still happen. All stakeholders need to be aware that the privacy of the end-user can be jeopardized without their immediate knowledge [30]. End-users are often one of the last stakeholders to learn that their data has been stolen, quite often only when a significant privacy breach has occurred and the breach is publicly announced due to mandatory data breach notification (MDBN) legislative requirements [19]. A distributed information technology architecture at the edge should generally have the advantage of minimizing privacy breaches “at scale.” However, if an edge node is targeted by hackers, many edge devices can be affected all at once (refer to Figure 1). Whereas a cloud computing data breach might have compromised hundreds of millions of individual records in a single attack (e.g., due to an unsecured S3 bucket), in the future edge devices will be vulnerable to peer-to-peer network architectures, given the potential for malware to penetrate and spread in systems.

Access Control and Data Protection

The primary use case for IoT integration is to share data between the huge number of devices that transmit sensor data. Thus, researchers are preoccupied with privacy implications relating to edge device access control. When edge devices are compromised and an individual’s privacy has been breached, the device is said to have been the “target,” although personal data is what the hacker can claim as an outcome. While we have yet to observe breaches of this kind “at scale” when compared to some of the major cloud computing hacks of the last decade, this is the next frontier as we move from 5G to 6G networks. These privacy breaches may fall into one or more of the following categories: 1) access offenses; 2) the impairment of data; 3) the misuse of devices; and 4) the interception of data [31, ch. 2–6].

IoT by its very nature makes the end-user vulnerable to “tech abuse” in particular contexts (e.g., the use of technology in the context of domestic violence [32]). Consider how a malicious actor may aim to penetrate the personal privacy of an end-user via an IoT device. There have been many reported examples of “smart abuse” by victims, and these will continue to increase [33] having asymmetric effects on individuals and their wellbeing. Imagine the possibility of an attack on edge devices on the home network that allowed the hacker to access the front door lock, smartTV, doorbell, home lighting, security cameras, speakers, and so on, remotely. The invasion of privacy would be so great that it would cause significant mental anguish in the victim of the attack.

According to Aleisa et al. [34], access control is integrated between the usability of the edge service and the flow of data between the devices and the user authentication process. Likewise, Shimahara and Nishi [35] investigated access control between integrated edge services and concluded that services should be determined by the level of access required by the users. The study also stated that access control needs to fulfill the requirements of data protection regulations [e.g., General Data Protection Regulation (GDPR)]. Li et al. [25] discuss IoT devices that share sensitive information such as healthcare and medical information that must adhere to health-related privacy regulations. The authors noted that service providers need to abide by encryption- and decryption-based rules during access control.

Edge computing extends privacy concerns with increasing functionality like location awareness and lightweight IoT devices which possess limited data protection methods.

Disclosed PII

IoT devices continue to generate, store, and process enormous amounts of personally identifiable information (PII), usernames and passwords, financial information, location data, and health-related information [23]. Disclosed PII, financial, and location data are extensively surveyed in the literature with respect to cloud computing data breaches (e.g., [19]). We [19] investigated the 2011 Sony PlayStation Network (PSN), 2014 eBay, and 2014 Yahoo! cloud data breaches. The outcome of the study was that data breaches would continue to increase, requiring the security industry to further enhance data security methods. In an edge computing scenario, the threat landscape is further exacerbated by the IoT device generating additional data that would have otherwise been limited in a cloud computing scenario [23]

Biometrics

A recent study by Cheng et al. [36] focuses on privacy protection in biometric systems, specifically facial recognition. The authors state that biometric authentication has been applied to e-commerce, banking, government, and military systems. Major concerns now reside with deepfakes and other morphing attacks [37]. While facial and fingerprint biometrics are now integrated into portable hard drives, smartphones, and other edge devices, duping attacks will become commonplace [38]. The introduction of AI into the hacker’s toolkit will mean that proving one’s own identity at the edge will become harder, likely necessitating two-factor authentication [59].

Location-Based Services

Location-based services (LBSs) have enjoyed popularity from online consumer purchases to business tracking inventory [39]. Edge computing brings LBS closer to the consumer using smartphones, smartwatches, and, in ever-increasing cases, implantable devices. Sendhil and Amuthan [18] state that IoT devices are susceptible to location privacy leakage with the attacker knowing the user’s geographical location. There are also covert ways in which proximal geolocation can be determined, possibly placing users at risk, if they are unaware someone/something knows their whereabouts. This is especially troublesome in cases of stalking or the context of restraining orders. An edge device’s location can also be spoofed, rendering a device somewhere other than where it actually is physically [40]. This latter scenario can create all sorts of problems for service providers, despite maintaining an individual’s location privacy.

Increased Data Protection Through Stakeholder Accountability

Studies identify that stakeholder accountability can be achieved through data protection regulation when implementing edge and IoT services. For instance, Urquhart et al. [47] state that the lack of user interfaces inhibits accountability and direct feedback for users to understand the information that is collected, stored, and processed at the device level. Furthermore, the researchers state that sensor and lightweight devices function with minimum user interfaces and often rely on lights or sounds alone. They further outlined the data flow between services which underpin accountability from the GDPR perspective [47]. Complementarily, Li et al. [25] promote stakeholder accountability through better security and existing data protection regulations. From a systems design perspective they applied Ethereum and the U.S. Health Insurance Portability and Accountability Act (HIPPA) to analyze software-defined infrastructure (ChainSDI) services.

Another form of stakeholder accountability comes in the form of software system maintenance and firmware patches [48]. There is a fine balance that must be achieved between better data protection and usability of a given device [47]. At a more granular level, Singh et al. [41, p. 57] note that “technology producers are not currently legally obliged to explain how the technology works.” This immediately prevents users from having full transparency and provides manufacturers and service providers the right to offer limited visibility in what might be called black-box technology, regarding the inner workings of a product or service. Thus, any firmware patch updates are always at the discretion of the service provider. While all stakeholders want to be viewed as doing the right thing by users, accountability is not always practiced in tangible ways.

Promoting Self-Regulation Between Edge Computing Stakeholders

Pokrovskaia et al. [49] introduced self-regulation as a form of data protection to allow users of the system to auto-organize their relationships. They also presented blockchain as a technology platform to organize working relationships between edge stakeholders. Bhadauria and Chennamaneni [50] examined self-regulation and concluded that service providers offering better security incentives were perceived to value data protection. Duarte and de Lima Prestes [51] investigated self-regulation through a certification framework. The authors applied a collaborative research design across technical and nontechnical stakeholders with key components. The stakeholders and components established a security baseline of technical and nontechnical requirements and the solution demonstrated a collaborative multistakeholder environment where cooperation was key.

Studies identify that stakeholder accountability can be achieved through data protection regulation when implementing edge and IoT services.

Abiding by Existing Data Protection Regulations

The sharing of data between heterogeneous IoT systems is a common function of data interoperability [52]. Varadi et al. [52] envisage an architecture enabling users, services, and devices to share common protocols and standards. Furthermore, the goal of the EU GDPR is to ensure that data protection is achieved by privacy by design. Garg et al. [53] review the GDPR and the U.S. Federal Trade Commission (FTC) regulation as related to cloud and edge services and conclude that the U.S. does have some sector regulations. However, the FTC definition of personal data varies across states and the balance of privacy protection falls on the stakeholders providing the services. Overall, these two studies point to the need for a unified approach data protection regulation, such as the GDPR.