Limitations of the application of IOT security standards to smart Home systems
How to cite
Abstract
The article proposes a quantitative methodology for assessing the feasibility of the requirements of international IoT security standards (IEC 62443-3-3, IEC 62443-4-2, ETSI EN 303 645, Matter 1.4, NIST IR 8259 A/B) in relation to resource-limited smart home systems. The methodology is based on two metrics – the relative increase in the cost of the device and the share of memory consumed – with thresholds of 5/20% and 30/80%, respectively. A matrix of 60 technical controls and three classes of devices (sensor L0, camera L1, gateway L2) was formed; initially, 35% of the requirements proved to be impossible for L0. Based on gap analysis, a set of light measures has been developed (DTLS 1.3 IoT profile, Flash Encryption, ring buffer logs, OTA hash chain, etc.) that do not require a hardware upgrade. The recalculation showed a reduction in the proportion of impossible requirements to 5% for L0 and 0% for L1, while maintaining functional equivalence to basic controls.
Keywords
References
Актуальные киберугрозы: III квартал 2024 г. М.: Positive technologies, 2024. 28 с.
ГОСТ Р 71168-2023. Сети LPWAN. LoRaWAN RU. М.: Стандартинформ, 2023. 34 с.
ГОСТ Р 71199-2023. Система «умный дом». Термины и определения. М.: Стандартинформ, 2023. 16 с.
Brooks L., Chen F. LogSafe: A compact tamper-resistant logger for smart sensors // Sensors. 2023. Vol. 23(12). рр. 1-15.
Causevic A., Ajanovic Z., Muehlberg J. Lightweight TLS handshake optimisation for constrained MCU devices // IEEE Access. 2022. Vol. 10. рр. 77123-77134.
ENISA. Baseline Security Recommendations for IoT. Athens: ENISA, 2017. 63 p.
ETSI EN 303 645 V3.1.3:2024. Cyber Security for Consumer Internet of Things. Sophia-Antipolis: ETSI, 2024. 82 p.
ETSI TS 103 929 V1.1.1:2023. Assessment of EN 303 645 conformity. Sophia-Antipolis: ETSI, 2023. 32 p.
IEC 62443-3-3:2020. Industrial communication networks – Network and system security. Part 3-3: System security requirements and security levels. Geneva: IEC, 2020. 112 p.
IEC 62443-4-2:2019. Industrial communication networks – Network and system security. Part 4-2: Technical requirements for IACS components. Geneva: IEC, 2019. 130 p.
IETF draft-uta-tls13-iot-profile-14. TLS 1.3 Profiles for Internet of things devices // datatracker.ietf.org. 2025. https://datatracker.ietf.org/doc/draft-uta-tls13-iot-profile-14/
ISO/IEC 30141:2016. Internet of Things (IoT) – reference architecture. Geneva: ISO, 2016. 114 p.
Kurniawan T., Raza S. Designing accountable iot systems to overcome storage limitation // Future generation computer systems. 2023. vol. 143. рр. 238-251.
Mahmood A. Postquantum cryptography for IoT: A survey of LWC vs PQC // IEEE Internet of things journal. 2024. Vol. 11. P. 1-24.
Matter Specification v 1.4. Connectivity Standards Alliance. Davis, 2024. 868 p.
Microchip Technology. ATECC608B price list // microchip.com. 2025.
Semtech. OTA over LoRa® Field Trial Report // blog.semtech.com. 2024.
Silicon Labs. EFR32 MGM220 Series 2 Module Datasheet // silabs.com. 2024.
Metrics
License
This work is licensed under a Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License.