The Internet of Things (IoT) is an emerging paradigm focusing on the inter-connection of things or devices to each other and to the users. This technology is anticipated to become an integral milestone in the development of smart homes and smart cities. For any technology to be successful and achieve widespread use, it needs to gain the trust of users by providing adequate security and privacy assurance. Despite the growing interest of the research community in IoT, and the emergence of several surveys and papers addressing its architecture and its elements, we are still lacking a thorough analysis of the security and privacy properties that are required for a system where the constituent devices vary in their capabilities. In this paper we provide a threat model based on use-cases of IoT, which can be used to determine where efforts should be invested in order to secure these systems. We conclude by recommending measures that will help in providing security and assuring privacy when using IoT.
In the last few years the world has experienced rapid advancement in technology, the likes of which has had a significant impact on our daily lives. The rise of technologies - smartphones, tablets, laptops and PCs - has engendered an increase in interconnectedness through time and across the spatial dimension. Contemporary technology has moved beyond fostering only connections between humans, and now facilitates both the linkage of people to things and indeed, things to one another, to achieve a common goal; this being termed The Internet of Things (IoT). IoT is believed to be the next milestone in the technological evolution of the world, it having an expansion rate 270 percent higher than mobile devices in less than six years . Based on this prediction, many governments and large corporations have earmarked substantial funding for research on IoT.
IoT is going to have a substantial role in shaping the future of smart cities. From the private user’s perspective it manifests itself in the application of domestic tools at work; for example, systems such as the smart thermostat, smart car, and smart community. Moreover, with regard to the corporate environment, IoT will enable automation of work, the provision of smarter environments for employees, and the management of power consumption with the aim of reducing expenses . IoT is able to achieve the aforementioned through utilisation of other technologies ,  - for instance, sensors, Radio Frequency IDentifiers (RFIDs), actuators, and smart meters. These devices are linked together to create a new emergent behaviour where each thing contributes to achieving the desired functionality. A particularly salient example of such an application is a thermostat system that senses the temperature and adjusts itself by learning the behaviour patterns of its users .
The value of IoT could not possibly be overestimated, however it is obligatory that a thorough consideration be given to all aspects of security and privacy. Indeed, tackling such facts, whilst a challenge, is all the more imperative. As IoT, being the amalgam of a great many individual technologies, many of which may well have flaws with respect to security and privacy, could conceivably be instrumentalised in a sinister and far more threatening manner if there is a failure to afford sufficient attention to the subject matter of this paper.
The complex nature of security in IoT revolves around the fact that, while in itself connecting several technologies together is a great challenge, the system attempts to securely connect devices that are limited in computation, power, and storage. Some of the devices used by IoT can accommodate only very basic security mechanisms, the likes of which are incapable of maintaining the integrity and confidentiality of the users’ data. Moreover, these devices - for instance, sensors, and RFIDs - lack a simple user interface, like an ON/OFF button or status indicator, thus presenting a visual psychological limitation for people when it comes to trusting these devices.
Nowadays, privacy concerns have become a hurdle; slowing the advancement of many technologies. Furthermore, it has been shown that trust in a technology diminishes when the latter slanders or exposes the individual , , , and, recently, many technologies have failed to provide adequate security and privacy mechanisms, thereby causing pain and suffering to those afflicted . In order to gain the trust of the public in the Internet of Things, we need to ensure the same failures with respect to privacy and security do not come to pass with this system, by ensuring the appropriate mechanisms to guarantee such things exist from the onset.
In this paper, we discuss the Internet of Things from a use-cases perspective. The following section provides a general overview of the work done in the field; section 3 details several interesting scenarios which are relevant to today’s world; section 4 discusses a threat model; section 5 provides a security analysis to the IoT devices based on these use-cases respectively; section 6 lists security and privacy properties desirable in IoT systems; whilst finally, in section 7 we give a glimpse of the future work we plan to do in this field. In particular, our main contributions are:
• Defining several use-cases for the Internet of Things.
• Establishing threat modelling as a method for analysing the use-cases defined.
• Formulating a set of desirable security and privacy properties for IoT.
II. RELATED WORK
Due to the rising interest in the Internet of Things, there have been numerous publications on security and privacy in this context. There are currently a myriad of descriptions of IoT visions, applications, and enabling technologies , , ,  that briefly address some security and privacy aspects. Atzori et al.  has discussed the importance of security in IoT context and focused on the security aspects of the elements. In this survey it was pointed out that due to the limitation of the devices composing the IoT, and the properties of the current communication protocols, it is very challenging to employ complex security mechanisms. Some devices might not be able to have access control for different users, support sufficient authentication schemes, or even use secure communication channels between devices. However, it is important to keep in mind that the required security measures are application dependent. For instance, in Near Field Communication (NFC), physical proximity is vital for establishing the connection, which makes this technology useful for various applications. Therefore, due to this property, some applications using NFC might not require a complex security scheme such as encrypted channel. For example, in some instances the users might not care about other people seeing the exchanged data in their presence. For instance, in a domestic use for IoT, in order to prevent children from watching TV without adult supervision, the user might not need complex communication protocols and it would suffice to only use access control mechanisms to access the device, or symmetric encryption rather than asymmetric for communication.
Due to its heterogeneous nature, the Internet of Things poses many security and privacy challenges. Different research groups have adopted diverse directions for addressing these issues. Roman et al.  presented several technologies in IoT context, discussed current technologies and their feasibility for some IoT devices, and provided a set of security requirements for IoT devices. In a subsequent study, the same group  compared the centralised and distributed architecture of IoT and their implication on security aspects. Moreover, Kozlov et al.  discussed security and privacy threats in IoT architecture, using a systematic approach to analyse the threats at different levels of the architecture.