Topic

There is a trend to move more and more information processing towards the edges of information systems, close to the data sources and sinks, and to the end-users [31]. In 2018, Gartner evaluated that 10% of “enterprise-generated data is created and processed outside a traditional centralized data center or cloud” [55], and predicted in 2021 that this number would increase to 50% in 2025 [63] (which it originally predicted at 75% in its 2018 report [55]) while the number of IoT devices will triple [63] or quadruple [23] between 2020 and 2030 reaching “more than 15 billion IoT devices [that] will connect to the enterprise infrastructure by 2029” [23] (IoT analytics even forecasts 27 billions connected IoT devices by 2025 [38]). There are varying reasons for this trend, among which: improving latency, relieving the network bandwidth from part of the huge amount of data generated, and bringing some autonomy to the end-users interacting at the periphery of the information system. This trend exists in the civil world, and in particular in industry with the specific concept of Industrial IoT (IIoT) [86] [81] [52] [80], but also in the military one with the concepts of the Internet of Battle Things (IoBT) [49] [78] [2] or Internet of Military Things (IoMT) [87] [18], which aim in part to increase local information exploitation [73] [57] [58]. To develop those concepts in the military domain, among other initiatives, the Internet of Battlefield Things Collaborative Research Alliance (IoBT-CRA) [70] [1] [89] was established in 2017 for a 10 years period.

In this call, devices handling those peripheral computations are called Smart Peripheral Devices (SPDs). Those SPDs are quiet different from, and have more variability, than devices found in the “core” of information systems (servers, desktops and laptops). They range: from somewhat expensive and powerful devices, such as smartphones or communication equipment of military vehicles [58]; to low cost low power devices, such as disposable wearable devices or disposable vessels [54] [25]; through Internet of Things (IoT) devices [88], and some lightweight Edge Computing devices [85]. While quite different, SPDs share some characteristics: they reside at the periphery of the system and are more susceptible to loss and theft; they have to comply with specific constraints limiting the resources they can use; they run on specific hardware usually not found in “core” devices; they use connection technologies not found in the core of the system to communicate with the core and between themselves; they handle some information processing directly, independently from the core of the system; they have to allow for “temporary” disconnections from the core, while still being able to function properly; and they are not continuously visible and monitored by the core of the information system.

Those specifics raise some concerns over their resilience to cybersecurity attacks [20] [21] [61] [8] [77] [9] [37] [50] [26] [53] [5] [79], and even the faithfulness of their supply chain [72]. As stated by Verizon for IoT [83], but applying to all SPD, “an [SPD] can be an attack vector (a weak point that can be exploited to mount an attack), a vehicle for attacks (like a part of a botnet used to carry out a distributed denial-of-service (DDoS) attack) or a target in its own right”. For example, the Mirai botnet [4] infected many IoT devices and has been used to attack many other systems. Mobiles are also an interesting target for attackers [74] [90] [14] [67]. Over a one year period, half of companies recently surveyed by Verizon suffered a compromise involving a mobile device [83]; for half of the companies concerned, applications were involved (in 2021, the percentage of organizations experiencing the installation of a malware on a remote device doubled [43]); and half of SMBs that suffered a mobile-related hack said that it had a major impact. Attackers do design applications and phishing campaigns specifically for mobiles [83], and if they do its because there is a benefit in doing so. As a consequence, more than 8 companies out of 10 have a specific budget for mobile security [83]. Last year C&ESAR addressed the concept of Zero Trust, among others. From the point of view of the security of the core of the information system, an SPD can be disconnected if the core has lost trust in it. However, the features carried by this SPD will also be lost. It is therefore important to be able to secure those SPDs.

However, cybersecurity technologies and methodologies applied to the core of information systems are not necessarily directly applicable to SPDs. Adapting standard Endpoint Detection and Response (EDR) solutions to the vast variety of SPD and integrating them to the core IT system SIEM is not a simple task. The specific technologies used for SPDs may contain weaknesses and vulnerabilities different from those of core system technologies [84] [76]. Ensuring the cybersecurity of SPDs may also require specific methodologies [51].

For example, SPDs use specific technologies in their processing stack (hardware and software). Among the various hardware used, they rely more commonly on ARM platforms and technologies. Those hardwares and deployment environment have specific characteristics impacting their cybersecurity [6] [75]. Among the various hardware support for securing SPDs [39], we can cite Secure Elements (SE) [11] or Tusted Execution Element (TEE). SPDs also use specific operating systems, such as Android and iOS for smartphones [91] [35]. And, for some of them, they allow end-users (hopefully the device administrator) to pull computing payloads from application stores populated by softwares coming from various, sometimes obscure, sources. The low confidence in the cybersecurity level of those application stores has pushed some institutions such as Google to launch initiatives to improve the state of affairs [36] or to launch projects aiming at standardizing the cybersecurity requirements for those applications [62] [42]. This state of affairs with regard to the low cybersecurity level of mobile applications pushes for much need improvements [16].

SPDs also use different technologies to connect to the core of the information system and to connect between themselves. One promising technology is the 5G one [46] [7] [44] [38] [40], and 6G in the future [24] [3]. However, this technology, as well as the others, have raised cybersecurity concerns among researchers [10], institutions [22] [28] [27] [60] [59] [32] [65] [69] and industry [66] [41]. For example, even the specification of Bluetooth contains vulnerabilities [19] [13] [12]. The deployment environment and ability of SPDs to create device-to-device connections result in networks, such as ad hoc or mesh ones, having different shapes and behaving differently than core information system networks, and having specific cybersecurity concerns.

To secure communications in those networks, SPDs can rely on cryptography. However, the low level of infrastructure support some of them receive and low computation power some of them have may require some specific cryptographic solutions, such as lightweight cryptography [34] or specific key agreement protocols [56].

Another challenge that comes with SPDs is their deployment “far away” from the core of the information system, and with an intermittent connection to it. This setting prevents the implementation of security policies centered around the core of the information system. SPDs require sepcific security policies that require specific means for deployment, management and enforcement. Those means need to be secured in their own right in order to prevent attackers from exploiting them to take control of the managed SPDs.

Finally, the peripheral deployment of SPDs, their proximity to information sources, and their common reliance on information collection imply concerns over privacy and data protection issues [33] [45] [48] [47]. As a consequence, policymakers have published specific and generic laws and regulations that apply to SPDs [64] [82] [68] [15] [17] [71] [29] [30].