{"title":"Blockchain-based Zero Trust Cybersecurity in the Internet of Things","authors":"Shancang Li, Surya Nepal, T. Tryfonas, Hongwei Li","doi":"10.1145/3594535","DOIUrl":null,"url":null,"abstract":"The Internet of Things (IoT) connects a massive number of smart devices to the Internet, in which all data, applications, devices, and users require connectivity, security, and trust. Traditional security approaches assume that all participants within the network perimeter are trustworthy. However, in IoT environment data, applications, devices, and users are gradually moving outside the traditional trusted defence perimeter and have become a source of security risks. Unlike traditional security approaches, which are initially designed for the optimum protection and only act if a process is malicious, the zero-trust security framework upholds the “verify and never trust” principle. Zero trust-based approaches assume that everything within the system is untrustworthy and needs to be verified to prevent threats. Meanwhile, the blockchain technology shows promises on cyber security and several blockchain security mechanisms have been developed, including access management, user authentication, and transaction security. Due to its prowess in enhancing cyber security, blockchain can provide zero trust security framework with highly accessible and transparent security mechanisms via a visible blockchain, in which all transactions are visible to restricted operators. Zero-trust models can be secured further by a blockchain due to its sheer immutable nature and blockchain technology is expected to recognise them, authenticate their trust, and allow them access. Blockchain-enabled zero trust security can detect suspicious online transaction, isolate connection, and restrict access to the user. This special issue received in total 37 high-quality submissions. Per journal policy, it was ensured that handling editors did not have any potential conflict of interest with authors of submitted papers. All submitted papers were reviewed by at least three independent potential referees. The papers were evaluated for their rigor and quality, and also for their relevance to the theme of our special issue. After evaluating the overall scores, seven papers were selected by the guest editors and approved by the Editor-in-Chief for inclusion in this special issue. We will now briefly introduce the accepted papers.","PeriodicalId":50911,"journal":{"name":"ACM Transactions on Internet Technology","volume":" ","pages":"1 - 3"},"PeriodicalIF":3.9000,"publicationDate":"2023-08-21","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":"0","resultStr":null,"platform":"Semanticscholar","paperid":null,"PeriodicalName":"ACM Transactions on Internet Technology","FirstCategoryId":"94","ListUrlMain":"https://doi.org/10.1145/3594535","RegionNum":3,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":null,"EPubDate":"","PubModel":"","JCR":"Q2","JCRName":"COMPUTER SCIENCE, INFORMATION SYSTEMS","Score":null,"Total":0}
引用次数: 0
Abstract
The Internet of Things (IoT) connects a massive number of smart devices to the Internet, in which all data, applications, devices, and users require connectivity, security, and trust. Traditional security approaches assume that all participants within the network perimeter are trustworthy. However, in IoT environment data, applications, devices, and users are gradually moving outside the traditional trusted defence perimeter and have become a source of security risks. Unlike traditional security approaches, which are initially designed for the optimum protection and only act if a process is malicious, the zero-trust security framework upholds the “verify and never trust” principle. Zero trust-based approaches assume that everything within the system is untrustworthy and needs to be verified to prevent threats. Meanwhile, the blockchain technology shows promises on cyber security and several blockchain security mechanisms have been developed, including access management, user authentication, and transaction security. Due to its prowess in enhancing cyber security, blockchain can provide zero trust security framework with highly accessible and transparent security mechanisms via a visible blockchain, in which all transactions are visible to restricted operators. Zero-trust models can be secured further by a blockchain due to its sheer immutable nature and blockchain technology is expected to recognise them, authenticate their trust, and allow them access. Blockchain-enabled zero trust security can detect suspicious online transaction, isolate connection, and restrict access to the user. This special issue received in total 37 high-quality submissions. Per journal policy, it was ensured that handling editors did not have any potential conflict of interest with authors of submitted papers. All submitted papers were reviewed by at least three independent potential referees. The papers were evaluated for their rigor and quality, and also for their relevance to the theme of our special issue. After evaluating the overall scores, seven papers were selected by the guest editors and approved by the Editor-in-Chief for inclusion in this special issue. We will now briefly introduce the accepted papers.
物联网(Internet of Things, IoT)将大量的智能设备连接到互联网上,所有的数据、应用、设备和用户都需要连接、安全、信任。传统的安全方法假设网络边界内的所有参与者都是值得信任的。然而,在物联网环境中,数据、应用程序、设备和用户逐渐超出了传统的可信防御范围,成为安全风险的来源。与传统的安全方法不同,传统的安全方法最初是为最佳保护而设计的,只有在进程是恶意的情况下才会采取行动,零信任安全框架坚持“验证且永不信任”原则。基于零信任的方法假设系统中的所有内容都是不可信的,需要进行验证以防止威胁。与此同时,区块链技术在网络安全方面表现出了良好的前景,包括访问管理、用户认证和交易安全等多种区块链安全机制已经开发出来。由于区块链在增强网络安全方面的卓越能力,它可以通过一个可见的区块链提供零信任安全框架,具有高度可访问和透明的安全机制,其中所有交易对受限制的运营商都是可见的。由于其绝对不可变的性质,零信任模型可以通过区块链进一步得到保护,区块链技术有望识别它们,验证它们的信任,并允许它们访问。区块链支持的零信任安全可以检测可疑的在线交易,隔离连接,并限制用户的访问。本期特刊共收到37份高质量的投稿。根据期刊政策,处理编辑不会与提交论文的作者有任何潜在的利益冲突。所有提交的论文都由至少三名独立的潜在审稿人审阅。这些论文因其严谨性和质量以及它们与我们特刊主题的相关性而受到评价。经过综合评分,由特邀编辑选出7篇论文,经总编辑批准,纳入本期特刊。现在我们将简要介绍被接受的论文。
期刊介绍:
ACM Transactions on Internet Technology (TOIT) brings together many computing disciplines including computer software engineering, computer programming languages, middleware, database management, security, knowledge discovery and data mining, networking and distributed systems, communications, performance and scalability etc. TOIT will cover the results and roles of the individual disciplines and the relationshipsamong them.