Edge Computing Wiki - User contributions [en-gb]

Chapter 6: Edge Security and Privacy

2025-04-16T20:12:34Z

Ali Siddiqi: /* Malware Injection */

==6. Edge Security and Privacy==

==6.1 Overview of Security Challenges in Edge Computing==
From previous chapters, Edge Computing has shown that it is here to stay and it will keep rapidly growing throughout the years. However, Edge Computing has its own security challenges that have to be addressed, because it is not a perfect system. Edge Computing has many security challenges that have to be dealt with in order to keep data safe. In this section, we will be talking about the different kinds of attacks that can happen on an Edge server or device, as how they are able to do this.

==='''DDoS'''===
''DDoS'' is a type of cyberattack in which an attacker aims to disrupt services provided by one or more servers based on distributed based on distributed resources such as a cluster of compromised Edge devices, which are also known as ''botnets''.

''DDoS attacks'' occur when an attacker persistently sends streams of packets to a victim from compromised electronic devices, which causes the hardware resources of the victim to be quickly exhausted by handling these malicious packets and can no longer process any legitimate request on time. There are two kinds of DDoS attacks: Flooding-based and Zero-day DDoS attacks.

[[File: DDoS-Botnet.png|300px]]

''Flooding-based'' DDoS attacks are a type of of DDoS attacks aiming to shut down normal service of a server based on large amount of flooded malformed or malicious network packets and are mainly classified as UDP flooding, ICMP flooding, SYN flooding, ping of death (PoD), HTTP flooding, and Slowloris.

[[File: UDPFLOODING.png|300px]]

''Zero-Day'' DDoS attacks are when an attacker must find an unknown vulnerability in a piece of code running on the target Edge server or device, which can cause memory corruption and finally result in a service shutdown. For example, newly built Edge servers could have ''code vulnerabilities'', such as a hanging pointers or stack overflows, and an attacker can abuse those vulnerabilities in order to cause the Edge servers or devices to overload due to memory issues and shut down.

[[File: ZeroDayDDoS.png|300px]]

==='''Side-Channel Attacks'''===

''Side-Channel Attacks'' happen when an attacker constantly obtains certain ''side-channel information'', like using public information that is not privately-sensitive for a user, from the target edge computing infrastructure and then feeds it into specific algorithms or machine learning models that outputs the desired sensitive information. There are three kinds of Side-Channel attacks: attacks exploiting communication channels, attacks exploiting power consumption, and attacks exploiting smartphone-based channels.

*''Attacks exploiting communication channels'' are when an attacker can use a malicious node, that doesn't have to be an edge server or device, in order to exploit communication channels and uses the node to continuously sniff the network traces and wishes to extract sensitive information out of them.

*''Attacks exploiting power consumption'' are when attackers use smart meters and oscilloscopes in order to measure the power consumption of a system since it carries information related to either the device that consumes the energy as different devices have different power.

*''Attacks exploiting smartphone-based channels'' are when attackers exploit vulnerabilities using /proc and smartphone embedded sensors due to how sensors can leak information and send malware to the user that they can install but disguised as something important and attack /proc.

[[File: sidechannelattack.png|300px]]

==='''Malware Injection'''===

''Malware Injection'' is when an attacker injects malicious code, or ''malware'', into edge devices or servers and is classified as either device-side or server-side injections.

''Device-side injection'' is when an attacker injects the malware directly into IoT devices since IoT devices are highly heterogeneous, so an attacker can physically inject or use third-party malicious libraries that are powerful and less likely to get detected.

''Server-side injections'' are separated into four types: SQL, XSS, CSRF and SSRF, and XML.

*''SQL injection'' is a code injection technique that attackers can use in order to destroy back-end databases by using the SQL query and escape sequences to trick the server into thinking the code is valid.

*''XSS injection'' is a client-side attack in which an attacker injects malicious code into data content, which can be accessed and executed automatically by the servers.

*''CSRF injection'' is an attack in which an end user is forced to execute unwanted actions through Web applications and ''SSRF injection'' is an attack in which Edge servers are abused to read or alter the internal resources.

*''XML injection'' is an attack which an attacker intercepts an XML message and edits with malicious code so that it is sent to the Edge servers using ''Simple Object Access Protocol'' (SOAP).

[[File: SQLinjectionattack.png|300px]]

==='''Authorization and Authentication Attacks'''===

When these attacks happen, an attacker can bypass authentication processes and gain unauthorized access by using four techniques: dictionary attacks, attacks exploiting vulnerabilities in authorization protocols, attacks exploiting vulnerabilities in authorization protocols, and overprivileged attacks.

*''Dictionary attack'' is when an attacker possesses a dictionary containing the most used credentials or passwords and inputs all possible entries in this dictionary in order to brute force a match.

*''Attacks exploiting vulnerabilities in authorization protocols'' are when attackers look for design flaws in how authentication protocols are being used, like finding vulnerabilities in WPA2 or WPA3 protocols which can give an attacker messages that have encrypted information. They can also use 4G or 5G vulnerabilities in order to find a person's location and inject fabricated paging messages to mess with them and gain more information.

*''Attacks exploiting vulnerabilities in authorization protocols'' are when attackers look for flaws in how authorization protocols are designed, such as an attacker using vulnerabilities in OAuth single sign-in which let them access victims personal information without authorization.

*''Overprivileged attacks'' are when attackers are able to develop malicious apps that can do things that they do not have permission to do without needing to authenticate, such as changing door pins and setting off fire alarms in a house.

[[File: dictionaryattack.png|300px]]

==='''How are attackers able to perform these attacks?'''===

Attackers are able to attack Edge devices or servers using different attack techniques, but it is more than just that. Attackers are able to abuse vulnerabilities and flaws in the Edge systems, specifically protocol-level design flaws, implementation-level flaws, code-level vulnerabilities, data correlations, and lacking in fine-grained access controls.

*''Protocol-level design flaws'' are caused by many protocols edge computing having adopted design flaws due to their designers mainly focus on utility and user experience rather than not providing security as well.

*''Implementation-level flaws'' are logic flaws that can cause security strength to decrease significantly after being proved that it was strictly secure on paper, because developers may misunderstand the foundations of the protocol and migrating a protocol from other platforms to the edge computing platform may cause adaptivity inconsistency.

*''Code-level vulnerabilities'' can be system bugs that cause memory failure or corruptness, like stack or heap overflow, and can be caused when a person is programming millions of lines of code but leaves something like a dangling pointer.

*''Data correlations'' is caused when there could be hidden correlations between sensitive and insensitive data that edge produces that might not be straightforward to notice, which an attack can abuse using side-channels.

*''Lacking in fine-grained access controls'' means that Edge computing systems cannot implement fine-grained access controls, because it cannot be adapted to edge computing due to the more complex and fine-grained permissions scenarios, making it easier to attack edge systems.

Overall, the Edge security challenges can be avoided if there was more attention to the potential vulnerabilities or flaws. In the next sections, the content that will be discussed is about data privacy on Edge systems, security protocols that Edge systems use to combat attacks on their systems, and real cases about actual security breaches that happened on the edge.

==6.2 Data Privacy and Compliance in Edge Applications==

===Privacy Issues in Fog Computing===

====Attack Vectors====
----
Below are some of the major attack vectors that plague existing edge and fog networks.
; Forgery
:Forgery is a security threat where the attacker copies someone else's identities and behavior by producing fake information. This is a serious issue that degrades existing network resources for everyone in the network.
;Tampering
: Attackers alter data that is to be sent to other websites. This is difficult to detect since users in an edge environment are mobile and we can't differentiate if the data has been tampered with or anomalous behavior is due to packet loss.
;Spam
:Attackers send fake information that overwhelms the processing power of the edge devices. Similar to DoS, on a smaller scale.
;Sybil
:Attackers fake identity to control the performance of edge network. Falsifying their identity allows them to create fake crowdsensing reports, which affects the reliability of the whole network.
;Jamming
:Attackers generate large amounts of packets to jam transmission channels and occupy important resources
;Eavesdropping
:Attackers listen to confidential data of genuine users from transmission channel by pretending to be a part of the network
; Man in the Middle (MITM)
: MITM is a type of cyberattack where the attacker not only eavesdrops on communication between two devices, but also modifies the payload for destructive payloads.
;Collusion
:Multiple groups band together to mislead fog nodes
;Impersonation
:Attacker acts as real server to trick users to steal all their data
;Virtual Machine Attack
:Attackers take control of hypervisor for the virtual machine's VM
;Side channel
: Attackers brute force passwords to steal information being shared between two parties. Due to the poor resource availability of edge devices, there is a constraint on the use of computationally expensive hashing algorithms.
; Session Hijacking
: Attackers intercept and steal user session to get access to confidential data

==== Privacy Issues in Fog Computing ====
# User privacy
## fog computing contains large number of IoT devices that are inter-connected via sensors
## generated senesitive data and transmit to fog nodse for processing. This sensitive data includes personal information which can be stolen
# Identity Privacy
## ID of users is extremely vulnerable of getting disclosed while having auth to nodes including name, phone , address
# Data Privacy
## data can be exposed to network attacker who is trying to steam user's personal data from the transmission medium or relay nodes
# Usage privacy
## Pattern in which accesses services of fog computing
## intruder knows when user is accessing the channel for data transmission and when he is not communicating
## intruder attacks on user's confidential information or the channel
# Location Privacy
## location privacy helps attackers know the trajectory of the user
# Network Privacy
## wireless connections always at risk
## maintenance of fog nodes is challenging since they are present at edge of internet
## privacy breach is not difficult to occur

=== Security and Privacy issues for edge computing===
# nodes of edge connected to large number of IoT
## these have limited resources
## heterogeneous internal components
## Key management for ensuring privacy of data is difficult

==== Issues ====
# Edge nodes are near to users which makes large amount of sensitive data, which might be stolen
# Edge computing possess low network resources so doesn't support expensive encryption algos
# Edge environment consists of dynamic env which is changing, which allows attackers multiple ways to join the network
Also difficult to create securiy rules for a changing network

==== Attacks ====
; Eavesdropping: Monitor channel to steal data
;# DoS
: take control of network by sending fake requests
;# DDoS
: interrupt normal services provided by different servers
;# Data Tampering
: Attacker can alter the data transmitted over comm channel
;False data injection
:Attacker injects false code in network which brings all data to the attacker
;Physical attack
:Physical protection of edge infra is weak, which allows attackers to compromise the physical locations of edge devices.
; Rogue gateway
:inject large amounts of traffic into edge network infra, similar to MITM

==== Privacy issues in edge computing =====
# weak security techniques for system protection
# unsafe communication between devices
# difficult recovery and data backup
# no specific pattern of update reception
# lack of proper network visibility
# lack of user's selective data collection

==== Countermeasures for Fog Computing ====
;Efficient encryption techniques
:Allows for resource constrained edge devices to encrypt communcations with complex algorithms
;Decoy technique
:Authenticate data of user present the computing network by replacing original information with fake information that is provided to attackers
When breached, the attackers find the decoy files
;Intrusion detection system
:Detect and protect from attacks including DoS, insider attackers, port scanning attacks, flooding attacks on virtual machine, MITM
;Blockchain security for fog computing
:Blockchain is a way to cryptographically ensure the validity of a system while simultaneously increasing it's security. Using blockchain for edge computing reduces single point failure, increases network security and helps with tracking node status effectively.

==6.3 Security Protocols and Frameworks for Edge Systems==

==6.4 Case Studies: Real-World Security Breaches==

To further illustrate the edge computer security concepts, we will give a couple of short case studies where edge
computing security plays a prevalent role, as well as some solutions:

===Securing Egyptian VMSs Smart City Infrastructure===
Over hundreds of thousands of these edge devices such as traffic sensors, surveillance cameras,
smart lighting systems, and environmental monitors are deployed in an urban Smart City. We
have on the `the city edge cloud' these instruments for real-time traffic flow management, public
safety alarm, environmental monitoring with life supports among the green plants – in the area
usually known as! This city suffered a massive blackout, when multiple traffic lights were compromised at the source which caused them to act irregularly: Not
issuing signals, leading to gridlocks.
====Challenges:====
How were the traffic controllers found to be vulnerable? Meaning they hack the password hole
punch so they can bypass the external username password and gain direct access to the temples
of our data. Moreover, on some cameras, the public IP of that camera is exposed, making remote
attack possible: it was obviously a disadvantage for them. The edge network stutters steps from
one organization to the next, making it hard however much one tries to apply security policy
uniformly, as whose department is solely responsible for a given thing?
====Solutions Introduced:====
;Net Separation
: The city designed its infrastructure with isolation zones; meaning traffic
systems are completely isolated from all other municipal services so if one zone is attacked all
other zones of that type remain intact.
;Password Overhaul
: Each unit was provided with a complete rehash to change its default
passwords and other weak credentials to hardened unique passwords. Remote administrative
access was only accepted with Multi-Factor Authentication.
;Embrace of a Zero Trust Model
: In this city, we employed a robust, Zero Trust model. A
central token service gives authorization to every device communication and does not assume
the inherent trust of devices.
;Firmware Handling
: The OTA management system required by installation ensures known
exploits like traffic light management are repaired when discovered. Firmware cannot be
updated at weaker sites as the assumption is it is regularly updated.
;AI-based IDS Deployment
: An AI-based IDS at a traffic control center learns about every
equipment normal behavior going on at this session (like how frequently commands are sent out
for lighting systems) generate alerts, activate promise lockdowns any time an abnormal behavior
appears Mechanisms for rapid dissemination throughout the city.
==== Outcome:====
As a result of the proactive settings, these attempts were quickly identified and contained, with a
limited impact on operations. For example, a virus event that targeted digital kiosks was
contained through micro-segmentation and AI detection mechanisms that quickly isolated and as
such quarantined the attack. It led to enhanced overall resilience of this intelligent city — its
citizens’ trust in IoT services is continually getting better.

=== IIOT (INDUSTRIAL IOT) IN MANUFACTURING===
The production floor of a manufacturing company has integrated an IIoT system that is edge-
based. Sensors associated with the machinery connect to edge gateways that track the health of
the equipment for predictive maintenance. One extreme incident involved the main assembly
robot producing inaccurate sensor readings that were altered, driving the robot to malfunction
and claim weeks of expensive downtime on production. This revealed the insertion of an
unauthorized device, a small single-board computer that was disguised as a sensor node and
which fed erroneous data back to the control system.
====CHALLENGES:====
Even though it was optimized for efficiency, the factory edge network didn't include a device
authentication protocol; attackers could access new sensors without the need for tight controls.
Ensuring up time and keeping operational was prioritized often at the expense of timely
application of security updates. Moreover, the presence of devices from many vendors further
complicated efforts to establish consistent security standards, and production engineers received
little training in cybersecurity best practices.
====SOLUTIONS IMPLEMENTED====
To solve these problems, stringent onboarding procedures were put in place: each sensor or
controller must now present a digital certificate signed by the organization before being allowed
onto the network. Any unknown device attempting to gain access is rejected and notification
alerts are immediately sent out to ensure the remedying of bogus sensors does not take place in
future.
Additionally, they created a blockchain ledger to monitor device identities and to log any
configuration changes over time. Every new addition or firmware update triggers a blockchain
transaction being recorded to guarantee the creation of an immutable audit trail that can be
reviewed by IT as well as OT (operational technology) teams increasing trust and accountability
between departments. They segmented their network by listener and gateway: your sensors only
talk to local gateway, and then your gateway only talks to central controls understanding that if
any one part is breached there are limitations to how much of your network is attacked. More
importantly, they rolled out an AI-powered detection system that monitored sensor readings for
abnormalities.
For known rogue sensors where outputs were statistically different from expected machine
behavior; it is likely that ML models would have picked up on this irregularity early enough to
allow for preemptive safety shutters before doing damage.In addition, maintenance processes
were revised to ensure that scheduled downtimes were regular intervals of time explicitly
dedicated towards security (for example, patching software vulnerabilities and routine
equipment calibration checks). Training of staff on basic cyber hygiene such as ensuring that a
USB drive or laptop was validated before connecting it into the organization edge networks have
reduced the threat of the organization network being infected by malware.
====OUTCOME====
Then after enhancements made at this facility had enabled quick identification of anomalies; The
next, an internal attempt by someone trying to connect using unauthorized monitoring tools was
quickly detected and blocked ensuring nothing could affect operations in our pursuit against
cyber-physical threats going forward. This includes how to properly secure our edges given their
unique properties tightly coupled with how data generation happens right at the host itself which
underlines an edge rather than left assume by further maintaining data access principles and
protocols as logs have significantly aided audits of compliance as well being fitted into our own
investigation processes during incidents reducing times taken before identifying potential
problems where an immutable changelog was adapted into the process itself. Key Takeaways –
Smart cities & IIOT factories share common challenges yet demonstrate needs for customized
solutions & technologies but also show similar trends including segmentation, authentication
continuous supervision Reacting quickly overcoming new challenges through advanced
technology tools - Artificial Intelligence& Blockchain technologies just to name a few.

==Citations==
Y. Xiao, Y. Jia, C. Liu, X. Cheng, J. Yu and W. Lv, "Edge Computing Security: State of the Art and Challenges," in Proceedings of the IEEE, vol. 107, no. 8, pp. 1608-1631, Aug. 2019, doi: 10.1109/JPROC.2019.2918437.
keywords: {Edge computing;Servers;Task analysis;Security;Cloud computing;Mobile handsets;Computer science;Smart phones;Internet of Things;Network security;Data security;edge computing;Internet of Things;network security},

Chapter 6: Edge Security and Privacy

2025-04-16T20:11:29Z

Ali Siddiqi: /* Malware Injection */

==6. Edge Security and Privacy==

==6.1 Overview of Security Challenges in Edge Computing==
From previous chapters, Edge Computing has shown that it is here to stay and it will keep rapidly growing throughout the years. However, Edge Computing has its own security challenges that have to be addressed, because it is not a perfect system. Edge Computing has many security challenges that have to be dealt with in order to keep data safe. In this section, we will be talking about the different kinds of attacks that can happen on an Edge server or device, as how they are able to do this.

==='''DDoS'''===
''DDoS'' is a type of cyberattack in which an attacker aims to disrupt services provided by one or more servers based on distributed based on distributed resources such as a cluster of compromised Edge devices, which are also known as ''botnets''.

''DDoS attacks'' occur when an attacker persistently sends streams of packets to a victim from compromised electronic devices, which causes the hardware resources of the victim to be quickly exhausted by handling these malicious packets and can no longer process any legitimate request on time. There are two kinds of DDoS attacks: Flooding-based and Zero-day DDoS attacks.

[[File: DDoS-Botnet.png|300px]]

''Flooding-based'' DDoS attacks are a type of of DDoS attacks aiming to shut down normal service of a server based on large amount of flooded malformed or malicious network packets and are mainly classified as UDP flooding, ICMP flooding, SYN flooding, ping of death (PoD), HTTP flooding, and Slowloris.

[[File: UDPFLOODING.png|300px]]

''Zero-Day'' DDoS attacks are when an attacker must find an unknown vulnerability in a piece of code running on the target Edge server or device, which can cause memory corruption and finally result in a service shutdown. For example, newly built Edge servers could have ''code vulnerabilities'', such as a hanging pointers or stack overflows, and an attacker can abuse those vulnerabilities in order to cause the Edge servers or devices to overload due to memory issues and shut down.

[[File: ZeroDayDDoS.png|300px]]

==='''Side-Channel Attacks'''===

''Side-Channel Attacks'' happen when an attacker constantly obtains certain ''side-channel information'', like using public information that is not privately-sensitive for a user, from the target edge computing infrastructure and then feeds it into specific algorithms or machine learning models that outputs the desired sensitive information. There are three kinds of Side-Channel attacks: attacks exploiting communication channels, attacks exploiting power consumption, and attacks exploiting smartphone-based channels.

*''Attacks exploiting communication channels'' are when an attacker can use a malicious node, that doesn't have to be an edge server or device, in order to exploit communication channels and uses the node to continuously sniff the network traces and wishes to extract sensitive information out of them.

*''Attacks exploiting power consumption'' are when attackers use smart meters and oscilloscopes in order to measure the power consumption of a system since it carries information related to either the device that consumes the energy as different devices have different power.

*''Attacks exploiting smartphone-based channels'' are when attackers exploit vulnerabilities using /proc and smartphone embedded sensors due to how sensors can leak information and send malware to the user that they can install but disguised as something important and attack /proc.

[[File: sidechannelattack.png|300px]]

==='''Malware Injection'''===

''Malware Injection'' is when an attacker injects malicious code, or ''malware'', into edge devices or servers and is classified as either device-side or server-side injections.

''Device-side injection'' is when an attacker injects the malware directly into IoT devices since IoT devices are highly heterogeneous, so an attacker can physically inject or use third-party malicious libraries that are powerful and less likely to get detected.

''Server-side injections'' are separated into four types: SQL, XSS, CSRF and SSRF, and XML.

*''SQL injection'' is a code injection technique that attackers can use in order to destroy back-end databases by using the SQL query and escape sequences to trick the server into thinking the code is valid.

*''XSS injection'' is a client-side attack in which an attacker injects malicious code into data content, which can be accessed and executed automatically by the servers.

*''CSRF injection'' is an attack in which an end user is forced to execute unwanted actions through Web applications.
*'SSRF injection'' is an attack in which Edge servers are abused to read or alter the internal resources.

*''XML injection'' is an attack which an attacker intercepts an XML message and edits with malicious code so that it is sent to the Edge servers using ''Simple Object Access Protocol'' (SOAP).

[[File: SQLinjectionattack.png|300px]]

==='''Authorization and Authentication Attacks'''===

When these attacks happen, an attacker can bypass authentication processes and gain unauthorized access by using four techniques: dictionary attacks, attacks exploiting vulnerabilities in authorization protocols, attacks exploiting vulnerabilities in authorization protocols, and overprivileged attacks.

*''Dictionary attack'' is when an attacker possesses a dictionary containing the most used credentials or passwords and inputs all possible entries in this dictionary in order to brute force a match.

*''Attacks exploiting vulnerabilities in authorization protocols'' are when attackers look for design flaws in how authentication protocols are being used, like finding vulnerabilities in WPA2 or WPA3 protocols which can give an attacker messages that have encrypted information. They can also use 4G or 5G vulnerabilities in order to find a person's location and inject fabricated paging messages to mess with them and gain more information.

*''Attacks exploiting vulnerabilities in authorization protocols'' are when attackers look for flaws in how authorization protocols are designed, such as an attacker using vulnerabilities in OAuth single sign-in which let them access victims personal information without authorization.

*''Overprivileged attacks'' are when attackers are able to develop malicious apps that can do things that they do not have permission to do without needing to authenticate, such as changing door pins and setting off fire alarms in a house.

[[File: dictionaryattack.png|300px]]

==='''How are attackers able to perform these attacks?'''===

Attackers are able to attack Edge devices or servers using different attack techniques, but it is more than just that. Attackers are able to abuse vulnerabilities and flaws in the Edge systems, specifically protocol-level design flaws, implementation-level flaws, code-level vulnerabilities, data correlations, and lacking in fine-grained access controls.

*''Protocol-level design flaws'' are caused by many protocols edge computing having adopted design flaws due to their designers mainly focus on utility and user experience rather than not providing security as well.

*''Implementation-level flaws'' are logic flaws that can cause security strength to decrease significantly after being proved that it was strictly secure on paper, because developers may misunderstand the foundations of the protocol and migrating a protocol from other platforms to the edge computing platform may cause adaptivity inconsistency.

*''Code-level vulnerabilities'' can be system bugs that cause memory failure or corruptness, like stack or heap overflow, and can be caused when a person is programming millions of lines of code but leaves something like a dangling pointer.

*''Data correlations'' is caused when there could be hidden correlations between sensitive and insensitive data that edge produces that might not be straightforward to notice, which an attack can abuse using side-channels.

*''Lacking in fine-grained access controls'' means that Edge computing systems cannot implement fine-grained access controls, because it cannot be adapted to edge computing due to the more complex and fine-grained permissions scenarios, making it easier to attack edge systems.

Overall, the Edge security challenges can be avoided if there was more attention to the potential vulnerabilities or flaws. In the next sections, the content that will be discussed is about data privacy on Edge systems, security protocols that Edge systems use to combat attacks on their systems, and real cases about actual security breaches that happened on the edge.

==6.2 Data Privacy and Compliance in Edge Applications==

===Privacy Issues in Fog Computing===

====Attack Vectors====
----
Below are some of the major attack vectors that plague existing edge and fog networks.
; Forgery
:Forgery is a security threat where the attacker copies someone else's identities and behavior by producing fake information. This is a serious issue that degrades existing network resources for everyone in the network.
;Tampering
: Attackers alter data that is to be sent to other websites. This is difficult to detect since users in an edge environment are mobile and we can't differentiate if the data has been tampered with or anomalous behavior is due to packet loss.
;Spam
:Attackers send fake information that overwhelms the processing power of the edge devices. Similar to DoS, on a smaller scale.
;Sybil
:Attackers fake identity to control the performance of edge network. Falsifying their identity allows them to create fake crowdsensing reports, which affects the reliability of the whole network.
;Jamming
:Attackers generate large amounts of packets to jam transmission channels and occupy important resources
;Eavesdropping
:Attackers listen to confidential data of genuine users from transmission channel by pretending to be a part of the network
; Man in the Middle (MITM)
: MITM is a type of cyberattack where the attacker not only eavesdrops on communication between two devices, but also modifies the payload for destructive payloads.
;Collusion
:Multiple groups band together to mislead fog nodes
;Impersonation
:Attacker acts as real server to trick users to steal all their data
;Virtual Machine Attack
:Attackers take control of hypervisor for the virtual machine's VM
;Side channel
: Attackers brute force passwords to steal information being shared between two parties. Due to the poor resource availability of edge devices, there is a constraint on the use of computationally expensive hashing algorithms.
; Session Hijacking
: Attackers intercept and steal user session to get access to confidential data

==== Privacy Issues in Fog Computing ====
# User privacy
## fog computing contains large number of IoT devices that are inter-connected via sensors
## generated senesitive data and transmit to fog nodse for processing. This sensitive data includes personal information which can be stolen
# Identity Privacy
## ID of users is extremely vulnerable of getting disclosed while having auth to nodes including name, phone , address
# Data Privacy
## data can be exposed to network attacker who is trying to steam user's personal data from the transmission medium or relay nodes
# Usage privacy
## Pattern in which accesses services of fog computing
## intruder knows when user is accessing the channel for data transmission and when he is not communicating
## intruder attacks on user's confidential information or the channel
# Location Privacy
## location privacy helps attackers know the trajectory of the user
# Network Privacy
## wireless connections always at risk
## maintenance of fog nodes is challenging since they are present at edge of internet
## privacy breach is not difficult to occur

=== Security and Privacy issues for edge computing===
# nodes of edge connected to large number of IoT
## these have limited resources
## heterogeneous internal components
## Key management for ensuring privacy of data is difficult

==== Issues ====
# Edge nodes are near to users which makes large amount of sensitive data, which might be stolen
# Edge computing possess low network resources so doesn't support expensive encryption algos
# Edge environment consists of dynamic env which is changing, which allows attackers multiple ways to join the network
Also difficult to create securiy rules for a changing network

==== Attacks ====
; Eavesdropping: Monitor channel to steal data
;# DoS
: take control of network by sending fake requests
;# DDoS
: interrupt normal services provided by different servers
;# Data Tampering
: Attacker can alter the data transmitted over comm channel
;False data injection
:Attacker injects false code in network which brings all data to the attacker
;Physical attack
:Physical protection of edge infra is weak, which allows attackers to compromise the physical locations of edge devices.
; Rogue gateway
:inject large amounts of traffic into edge network infra, similar to MITM

==== Privacy issues in edge computing =====
# weak security techniques for system protection
# unsafe communication between devices
# difficult recovery and data backup
# no specific pattern of update reception
# lack of proper network visibility
# lack of user's selective data collection

==== Countermeasures for Fog Computing ====
;Efficient encryption techniques
:Allows for resource constrained edge devices to encrypt communcations with complex algorithms
;Decoy technique
:Authenticate data of user present the computing network by replacing original information with fake information that is provided to attackers
When breached, the attackers find the decoy files
;Intrusion detection system
:Detect and protect from attacks including DoS, insider attackers, port scanning attacks, flooding attacks on virtual machine, MITM
;Blockchain security for fog computing
:Blockchain is a way to cryptographically ensure the validity of a system while simultaneously increasing it's security. Using blockchain for edge computing reduces single point failure, increases network security and helps with tracking node status effectively.

==6.3 Security Protocols and Frameworks for Edge Systems==

==6.4 Case Studies: Real-World Security Breaches==

To further illustrate the edge computer security concepts, we will give a couple of short case studies where edge
computing security plays a prevalent role, as well as some solutions:

===Securing Egyptian VMSs Smart City Infrastructure===
Over hundreds of thousands of these edge devices such as traffic sensors, surveillance cameras,
smart lighting systems, and environmental monitors are deployed in an urban Smart City. We
have on the `the city edge cloud' these instruments for real-time traffic flow management, public
safety alarm, environmental monitoring with life supports among the green plants – in the area
usually known as! This city suffered a massive blackout, when multiple traffic lights were compromised at the source which caused them to act irregularly: Not
issuing signals, leading to gridlocks.
====Challenges:====
How were the traffic controllers found to be vulnerable? Meaning they hack the password hole
punch so they can bypass the external username password and gain direct access to the temples
of our data. Moreover, on some cameras, the public IP of that camera is exposed, making remote
attack possible: it was obviously a disadvantage for them. The edge network stutters steps from
one organization to the next, making it hard however much one tries to apply security policy
uniformly, as whose department is solely responsible for a given thing?
====Solutions Introduced:====
;Net Separation
: The city designed its infrastructure with isolation zones; meaning traffic
systems are completely isolated from all other municipal services so if one zone is attacked all
other zones of that type remain intact.
;Password Overhaul
: Each unit was provided with a complete rehash to change its default
passwords and other weak credentials to hardened unique passwords. Remote administrative
access was only accepted with Multi-Factor Authentication.
;Embrace of a Zero Trust Model
: In this city, we employed a robust, Zero Trust model. A
central token service gives authorization to every device communication and does not assume
the inherent trust of devices.
;Firmware Handling
: The OTA management system required by installation ensures known
exploits like traffic light management are repaired when discovered. Firmware cannot be
updated at weaker sites as the assumption is it is regularly updated.
;AI-based IDS Deployment
: An AI-based IDS at a traffic control center learns about every
equipment normal behavior going on at this session (like how frequently commands are sent out
for lighting systems) generate alerts, activate promise lockdowns any time an abnormal behavior
appears Mechanisms for rapid dissemination throughout the city.
==== Outcome:====
As a result of the proactive settings, these attempts were quickly identified and contained, with a
limited impact on operations. For example, a virus event that targeted digital kiosks was
contained through micro-segmentation and AI detection mechanisms that quickly isolated and as
such quarantined the attack. It led to enhanced overall resilience of this intelligent city — its
citizens’ trust in IoT services is continually getting better.

=== IIOT (INDUSTRIAL IOT) IN MANUFACTURING===
The production floor of a manufacturing company has integrated an IIoT system that is edge-
based. Sensors associated with the machinery connect to edge gateways that track the health of
the equipment for predictive maintenance. One extreme incident involved the main assembly
robot producing inaccurate sensor readings that were altered, driving the robot to malfunction
and claim weeks of expensive downtime on production. This revealed the insertion of an
unauthorized device, a small single-board computer that was disguised as a sensor node and
which fed erroneous data back to the control system.
====CHALLENGES:====
Even though it was optimized for efficiency, the factory edge network didn't include a device
authentication protocol; attackers could access new sensors without the need for tight controls.
Ensuring up time and keeping operational was prioritized often at the expense of timely
application of security updates. Moreover, the presence of devices from many vendors further
complicated efforts to establish consistent security standards, and production engineers received
little training in cybersecurity best practices.
====SOLUTIONS IMPLEMENTED====
To solve these problems, stringent onboarding procedures were put in place: each sensor or
controller must now present a digital certificate signed by the organization before being allowed
onto the network. Any unknown device attempting to gain access is rejected and notification
alerts are immediately sent out to ensure the remedying of bogus sensors does not take place in
future.
Additionally, they created a blockchain ledger to monitor device identities and to log any
configuration changes over time. Every new addition or firmware update triggers a blockchain
transaction being recorded to guarantee the creation of an immutable audit trail that can be
reviewed by IT as well as OT (operational technology) teams increasing trust and accountability
between departments. They segmented their network by listener and gateway: your sensors only
talk to local gateway, and then your gateway only talks to central controls understanding that if
any one part is breached there are limitations to how much of your network is attacked. More
importantly, they rolled out an AI-powered detection system that monitored sensor readings for
abnormalities.
For known rogue sensors where outputs were statistically different from expected machine
behavior; it is likely that ML models would have picked up on this irregularity early enough to
allow for preemptive safety shutters before doing damage.In addition, maintenance processes
were revised to ensure that scheduled downtimes were regular intervals of time explicitly
dedicated towards security (for example, patching software vulnerabilities and routine
equipment calibration checks). Training of staff on basic cyber hygiene such as ensuring that a
USB drive or laptop was validated before connecting it into the organization edge networks have
reduced the threat of the organization network being infected by malware.
====OUTCOME====
Then after enhancements made at this facility had enabled quick identification of anomalies; The
next, an internal attempt by someone trying to connect using unauthorized monitoring tools was
quickly detected and blocked ensuring nothing could affect operations in our pursuit against
cyber-physical threats going forward. This includes how to properly secure our edges given their
unique properties tightly coupled with how data generation happens right at the host itself which
underlines an edge rather than left assume by further maintaining data access principles and
protocols as logs have significantly aided audits of compliance as well being fitted into our own
investigation processes during incidents reducing times taken before identifying potential
problems where an immutable changelog was adapted into the process itself. Key Takeaways –
Smart cities & IIOT factories share common challenges yet demonstrate needs for customized
solutions & technologies but also show similar trends including segmentation, authentication
continuous supervision Reacting quickly overcoming new challenges through advanced
technology tools - Artificial Intelligence& Blockchain technologies just to name a few.

==Citations==
Y. Xiao, Y. Jia, C. Liu, X. Cheng, J. Yu and W. Lv, "Edge Computing Security: State of the Art and Challenges," in Proceedings of the IEEE, vol. 107, no. 8, pp. 1608-1631, Aug. 2019, doi: 10.1109/JPROC.2019.2918437.
keywords: {Edge computing;Servers;Task analysis;Security;Cloud computing;Mobile handsets;Computer science;Smart phones;Internet of Things;Network security;Data security;edge computing;Internet of Things;network security},

Chapter 6: Edge Security and Privacy

2025-04-16T20:10:20Z

Ali Siddiqi: /* Malware Injection */

==6. Edge Security and Privacy==

==6.1 Overview of Security Challenges in Edge Computing==
From previous chapters, Edge Computing has shown that it is here to stay and it will keep rapidly growing throughout the years. However, Edge Computing has its own security challenges that have to be addressed, because it is not a perfect system. Edge Computing has many security challenges that have to be dealt with in order to keep data safe. In this section, we will be talking about the different kinds of attacks that can happen on an Edge server or device, as how they are able to do this.

==='''DDoS'''===
''DDoS'' is a type of cyberattack in which an attacker aims to disrupt services provided by one or more servers based on distributed based on distributed resources such as a cluster of compromised Edge devices, which are also known as ''botnets''.

''DDoS attacks'' occur when an attacker persistently sends streams of packets to a victim from compromised electronic devices, which causes the hardware resources of the victim to be quickly exhausted by handling these malicious packets and can no longer process any legitimate request on time. There are two kinds of DDoS attacks: Flooding-based and Zero-day DDoS attacks.

[[File: DDoS-Botnet.png|300px]]

''Flooding-based'' DDoS attacks are a type of of DDoS attacks aiming to shut down normal service of a server based on large amount of flooded malformed or malicious network packets and are mainly classified as UDP flooding, ICMP flooding, SYN flooding, ping of death (PoD), HTTP flooding, and Slowloris.

[[File: UDPFLOODING.png|300px]]

''Zero-Day'' DDoS attacks are when an attacker must find an unknown vulnerability in a piece of code running on the target Edge server or device, which can cause memory corruption and finally result in a service shutdown. For example, newly built Edge servers could have ''code vulnerabilities'', such as a hanging pointers or stack overflows, and an attacker can abuse those vulnerabilities in order to cause the Edge servers or devices to overload due to memory issues and shut down.

[[File: ZeroDayDDoS.png|300px]]

==='''Side-Channel Attacks'''===

''Side-Channel Attacks'' happen when an attacker constantly obtains certain ''side-channel information'', like using public information that is not privately-sensitive for a user, from the target edge computing infrastructure and then feeds it into specific algorithms or machine learning models that outputs the desired sensitive information. There are three kinds of Side-Channel attacks: attacks exploiting communication channels, attacks exploiting power consumption, and attacks exploiting smartphone-based channels.

*''Attacks exploiting communication channels'' are when an attacker can use a malicious node, that doesn't have to be an edge server or device, in order to exploit communication channels and uses the node to continuously sniff the network traces and wishes to extract sensitive information out of them.

*''Attacks exploiting power consumption'' are when attackers use smart meters and oscilloscopes in order to measure the power consumption of a system since it carries information related to either the device that consumes the energy as different devices have different power.

*''Attacks exploiting smartphone-based channels'' are when attackers exploit vulnerabilities using /proc and smartphone embedded sensors due to how sensors can leak information and send malware to the user that they can install but disguised as something important and attack /proc.

[[File: sidechannelattack.png|300px]]

==='''Malware Injection'''===

''Malware Injection'' is when an attacker injects malicious code, or ''malware'', into edge devices or servers and is classified as either server-side or device-side injections.

''Server-side injections'' are separated into four types: SQL, XSS, CSRF and SSRF, and XML.

*''SQL injection'' is a code injection technique that attackers can use in order to destroy back-end databases by using the SQL query and escape sequences to trick the server into thinking the code is valid.

*''XSS injection'' is a client-side attack in which an attacker injects malicious code into data content, which can be accessed and executed automatically by the servers.

*''CSRF injection'' is an attack in which an end user is forced to execute unwanted actions through Web applications.
*'SSRF injection'' is an attack in which Edge servers are abused to read or alter the internal resources.

*''XML injection'' is an attack which an attacker intercepts an XML message and edits with malicious code so that it is sent to the Edge servers using ''Simple Object Access Protocol'' (SOAP).

[[File: SQLinjectionattack.png|300px]]

''Device-side injection'' is when an attacker injects the malware directly into IoT devices since IoT devices are highly heterogeneous, so an attacker can physically inject or use third-party malicious libraries that are powerful and less likely to get detected.

==='''Authorization and Authentication Attacks'''===

When these attacks happen, an attacker can bypass authentication processes and gain unauthorized access by using four techniques: dictionary attacks, attacks exploiting vulnerabilities in authorization protocols, attacks exploiting vulnerabilities in authorization protocols, and overprivileged attacks.

*''Dictionary attack'' is when an attacker possesses a dictionary containing the most used credentials or passwords and inputs all possible entries in this dictionary in order to brute force a match.

*''Attacks exploiting vulnerabilities in authorization protocols'' are when attackers look for design flaws in how authentication protocols are being used, like finding vulnerabilities in WPA2 or WPA3 protocols which can give an attacker messages that have encrypted information. They can also use 4G or 5G vulnerabilities in order to find a person's location and inject fabricated paging messages to mess with them and gain more information.

*''Attacks exploiting vulnerabilities in authorization protocols'' are when attackers look for flaws in how authorization protocols are designed, such as an attacker using vulnerabilities in OAuth single sign-in which let them access victims personal information without authorization.

*''Overprivileged attacks'' are when attackers are able to develop malicious apps that can do things that they do not have permission to do without needing to authenticate, such as changing door pins and setting off fire alarms in a house.

[[File: dictionaryattack.png|300px]]

==='''How are attackers able to perform these attacks?'''===

Attackers are able to attack Edge devices or servers using different attack techniques, but it is more than just that. Attackers are able to abuse vulnerabilities and flaws in the Edge systems, specifically protocol-level design flaws, implementation-level flaws, code-level vulnerabilities, data correlations, and lacking in fine-grained access controls.

*''Protocol-level design flaws'' are caused by many protocols edge computing having adopted design flaws due to their designers mainly focus on utility and user experience rather than not providing security as well.

*''Implementation-level flaws'' are logic flaws that can cause security strength to decrease significantly after being proved that it was strictly secure on paper, because developers may misunderstand the foundations of the protocol and migrating a protocol from other platforms to the edge computing platform may cause adaptivity inconsistency.

*''Code-level vulnerabilities'' can be system bugs that cause memory failure or corruptness, like stack or heap overflow, and can be caused when a person is programming millions of lines of code but leaves something like a dangling pointer.

*''Data correlations'' is caused when there could be hidden correlations between sensitive and insensitive data that edge produces that might not be straightforward to notice, which an attack can abuse using side-channels.

*''Lacking in fine-grained access controls'' means that Edge computing systems cannot implement fine-grained access controls, because it cannot be adapted to edge computing due to the more complex and fine-grained permissions scenarios, making it easier to attack edge systems.

Overall, the Edge security challenges can be avoided if there was more attention to the potential vulnerabilities or flaws. In the next sections, the content that will be discussed is about data privacy on Edge systems, security protocols that Edge systems use to combat attacks on their systems, and real cases about actual security breaches that happened on the edge.

==6.2 Data Privacy and Compliance in Edge Applications==

===Privacy Issues in Fog Computing===

====Attack Vectors====
----
Below are some of the major attack vectors that plague existing edge and fog networks.
; Forgery
:Forgery is a security threat where the attacker copies someone else's identities and behavior by producing fake information. This is a serious issue that degrades existing network resources for everyone in the network.
;Tampering
: Attackers alter data that is to be sent to other websites. This is difficult to detect since users in an edge environment are mobile and we can't differentiate if the data has been tampered with or anomalous behavior is due to packet loss.
;Spam
:Attackers send fake information that overwhelms the processing power of the edge devices. Similar to DoS, on a smaller scale.
;Sybil
:Attackers fake identity to control the performance of edge network. Falsifying their identity allows them to create fake crowdsensing reports, which affects the reliability of the whole network.
;Jamming
:Attackers generate large amounts of packets to jam transmission channels and occupy important resources
;Eavesdropping
:Attackers listen to confidential data of genuine users from transmission channel by pretending to be a part of the network
; Man in the Middle (MITM)
: MITM is a type of cyberattack where the attacker not only eavesdrops on communication between two devices, but also modifies the payload for destructive payloads.
;Collusion
:Multiple groups band together to mislead fog nodes
;Impersonation
:Attacker acts as real server to trick users to steal all their data
;Virtual Machine Attack
:Attackers take control of hypervisor for the virtual machine's VM
;Side channel
: Attackers brute force passwords to steal information being shared between two parties. Due to the poor resource availability of edge devices, there is a constraint on the use of computationally expensive hashing algorithms.
; Session Hijacking
: Attackers intercept and steal user session to get access to confidential data

==== Privacy Issues in Fog Computing ====
# User privacy
## fog computing contains large number of IoT devices that are inter-connected via sensors
## generated senesitive data and transmit to fog nodse for processing. This sensitive data includes personal information which can be stolen
# Identity Privacy
## ID of users is extremely vulnerable of getting disclosed while having auth to nodes including name, phone , address
# Data Privacy
## data can be exposed to network attacker who is trying to steam user's personal data from the transmission medium or relay nodes
# Usage privacy
## Pattern in which accesses services of fog computing
## intruder knows when user is accessing the channel for data transmission and when he is not communicating
## intruder attacks on user's confidential information or the channel
# Location Privacy
## location privacy helps attackers know the trajectory of the user
# Network Privacy
## wireless connections always at risk
## maintenance of fog nodes is challenging since they are present at edge of internet
## privacy breach is not difficult to occur

=== Security and Privacy issues for edge computing===
# nodes of edge connected to large number of IoT
## these have limited resources
## heterogeneous internal components
## Key management for ensuring privacy of data is difficult

==== Issues ====
# Edge nodes are near to users which makes large amount of sensitive data, which might be stolen
# Edge computing possess low network resources so doesn't support expensive encryption algos
# Edge environment consists of dynamic env which is changing, which allows attackers multiple ways to join the network
Also difficult to create securiy rules for a changing network

==== Attacks ====
; Eavesdropping: Monitor channel to steal data
;# DoS
: take control of network by sending fake requests
;# DDoS
: interrupt normal services provided by different servers
;# Data Tampering
: Attacker can alter the data transmitted over comm channel
;False data injection
:Attacker injects false code in network which brings all data to the attacker
;Physical attack
:Physical protection of edge infra is weak, which allows attackers to compromise the physical locations of edge devices.
; Rogue gateway
:inject large amounts of traffic into edge network infra, similar to MITM

==== Privacy issues in edge computing =====
# weak security techniques for system protection
# unsafe communication between devices
# difficult recovery and data backup
# no specific pattern of update reception
# lack of proper network visibility
# lack of user's selective data collection

==== Countermeasures for Fog Computing ====
;Efficient encryption techniques
:Allows for resource constrained edge devices to encrypt communcations with complex algorithms
;Decoy technique
:Authenticate data of user present the computing network by replacing original information with fake information that is provided to attackers
When breached, the attackers find the decoy files
;Intrusion detection system
:Detect and protect from attacks including DoS, insider attackers, port scanning attacks, flooding attacks on virtual machine, MITM
;Blockchain security for fog computing
:Blockchain is a way to cryptographically ensure the validity of a system while simultaneously increasing it's security. Using blockchain for edge computing reduces single point failure, increases network security and helps with tracking node status effectively.

==6.3 Security Protocols and Frameworks for Edge Systems==

==6.4 Case Studies: Real-World Security Breaches==

To further illustrate the edge computer security concepts, we will give a couple of short case studies where edge
computing security plays a prevalent role, as well as some solutions:

===Securing Egyptian VMSs Smart City Infrastructure===
Over hundreds of thousands of these edge devices such as traffic sensors, surveillance cameras,
smart lighting systems, and environmental monitors are deployed in an urban Smart City. We
have on the `the city edge cloud' these instruments for real-time traffic flow management, public
safety alarm, environmental monitoring with life supports among the green plants – in the area
usually known as! This city suffered a massive blackout, when multiple traffic lights were compromised at the source which caused them to act irregularly: Not
issuing signals, leading to gridlocks.
====Challenges:====
How were the traffic controllers found to be vulnerable? Meaning they hack the password hole
punch so they can bypass the external username password and gain direct access to the temples
of our data. Moreover, on some cameras, the public IP of that camera is exposed, making remote
attack possible: it was obviously a disadvantage for them. The edge network stutters steps from
one organization to the next, making it hard however much one tries to apply security policy
uniformly, as whose department is solely responsible for a given thing?
====Solutions Introduced:====
;Net Separation
: The city designed its infrastructure with isolation zones; meaning traffic
systems are completely isolated from all other municipal services so if one zone is attacked all
other zones of that type remain intact.
;Password Overhaul
: Each unit was provided with a complete rehash to change its default
passwords and other weak credentials to hardened unique passwords. Remote administrative
access was only accepted with Multi-Factor Authentication.
;Embrace of a Zero Trust Model
: In this city, we employed a robust, Zero Trust model. A
central token service gives authorization to every device communication and does not assume
the inherent trust of devices.
;Firmware Handling
: The OTA management system required by installation ensures known
exploits like traffic light management are repaired when discovered. Firmware cannot be
updated at weaker sites as the assumption is it is regularly updated.
;AI-based IDS Deployment
: An AI-based IDS at a traffic control center learns about every
equipment normal behavior going on at this session (like how frequently commands are sent out
for lighting systems) generate alerts, activate promise lockdowns any time an abnormal behavior
appears Mechanisms for rapid dissemination throughout the city.
==== Outcome:====
As a result of the proactive settings, these attempts were quickly identified and contained, with a
limited impact on operations. For example, a virus event that targeted digital kiosks was
contained through micro-segmentation and AI detection mechanisms that quickly isolated and as
such quarantined the attack. It led to enhanced overall resilience of this intelligent city — its
citizens’ trust in IoT services is continually getting better.

=== IIOT (INDUSTRIAL IOT) IN MANUFACTURING===
The production floor of a manufacturing company has integrated an IIoT system that is edge-
based. Sensors associated with the machinery connect to edge gateways that track the health of
the equipment for predictive maintenance. One extreme incident involved the main assembly
robot producing inaccurate sensor readings that were altered, driving the robot to malfunction
and claim weeks of expensive downtime on production. This revealed the insertion of an
unauthorized device, a small single-board computer that was disguised as a sensor node and
which fed erroneous data back to the control system.
====CHALLENGES:====
Even though it was optimized for efficiency, the factory edge network didn't include a device
authentication protocol; attackers could access new sensors without the need for tight controls.
Ensuring up time and keeping operational was prioritized often at the expense of timely
application of security updates. Moreover, the presence of devices from many vendors further
complicated efforts to establish consistent security standards, and production engineers received
little training in cybersecurity best practices.
====SOLUTIONS IMPLEMENTED====
To solve these problems, stringent onboarding procedures were put in place: each sensor or
controller must now present a digital certificate signed by the organization before being allowed
onto the network. Any unknown device attempting to gain access is rejected and notification
alerts are immediately sent out to ensure the remedying of bogus sensors does not take place in
future.
Additionally, they created a blockchain ledger to monitor device identities and to log any
configuration changes over time. Every new addition or firmware update triggers a blockchain
transaction being recorded to guarantee the creation of an immutable audit trail that can be
reviewed by IT as well as OT (operational technology) teams increasing trust and accountability
between departments. They segmented their network by listener and gateway: your sensors only
talk to local gateway, and then your gateway only talks to central controls understanding that if
any one part is breached there are limitations to how much of your network is attacked. More
importantly, they rolled out an AI-powered detection system that monitored sensor readings for
abnormalities.
For known rogue sensors where outputs were statistically different from expected machine
behavior; it is likely that ML models would have picked up on this irregularity early enough to
allow for preemptive safety shutters before doing damage.In addition, maintenance processes
were revised to ensure that scheduled downtimes were regular intervals of time explicitly
dedicated towards security (for example, patching software vulnerabilities and routine
equipment calibration checks). Training of staff on basic cyber hygiene such as ensuring that a
USB drive or laptop was validated before connecting it into the organization edge networks have
reduced the threat of the organization network being infected by malware.
====OUTCOME====
Then after enhancements made at this facility had enabled quick identification of anomalies; The
next, an internal attempt by someone trying to connect using unauthorized monitoring tools was
quickly detected and blocked ensuring nothing could affect operations in our pursuit against
cyber-physical threats going forward. This includes how to properly secure our edges given their
unique properties tightly coupled with how data generation happens right at the host itself which
underlines an edge rather than left assume by further maintaining data access principles and
protocols as logs have significantly aided audits of compliance as well being fitted into our own
investigation processes during incidents reducing times taken before identifying potential
problems where an immutable changelog was adapted into the process itself. Key Takeaways –
Smart cities & IIOT factories share common challenges yet demonstrate needs for customized
solutions & technologies but also show similar trends including segmentation, authentication
continuous supervision Reacting quickly overcoming new challenges through advanced
technology tools - Artificial Intelligence& Blockchain technologies just to name a few.

==Citations==
Y. Xiao, Y. Jia, C. Liu, X. Cheng, J. Yu and W. Lv, "Edge Computing Security: State of the Art and Challenges," in Proceedings of the IEEE, vol. 107, no. 8, pp. 1608-1631, Aug. 2019, doi: 10.1109/JPROC.2019.2918437.
keywords: {Edge computing;Servers;Task analysis;Security;Cloud computing;Mobile handsets;Computer science;Smart phones;Internet of Things;Network security;Data security;edge computing;Internet of Things;network security},

Chapter 6: Edge Security and Privacy

2025-04-16T20:09:28Z

Ali Siddiqi:

==6. Edge Security and Privacy==

==6.1 Overview of Security Challenges in Edge Computing==
From previous chapters, Edge Computing has shown that it is here to stay and it will keep rapidly growing throughout the years. However, Edge Computing has its own security challenges that have to be addressed, because it is not a perfect system. Edge Computing has many security challenges that have to be dealt with in order to keep data safe. In this section, we will be talking about the different kinds of attacks that can happen on an Edge server or device, as how they are able to do this.

==='''DDoS'''===
''DDoS'' is a type of cyberattack in which an attacker aims to disrupt services provided by one or more servers based on distributed based on distributed resources such as a cluster of compromised Edge devices, which are also known as ''botnets''.

''DDoS attacks'' occur when an attacker persistently sends streams of packets to a victim from compromised electronic devices, which causes the hardware resources of the victim to be quickly exhausted by handling these malicious packets and can no longer process any legitimate request on time. There are two kinds of DDoS attacks: Flooding-based and Zero-day DDoS attacks.

[[File: DDoS-Botnet.png|300px]]

''Flooding-based'' DDoS attacks are a type of of DDoS attacks aiming to shut down normal service of a server based on large amount of flooded malformed or malicious network packets and are mainly classified as UDP flooding, ICMP flooding, SYN flooding, ping of death (PoD), HTTP flooding, and Slowloris.

[[File: UDPFLOODING.png|300px]]

''Zero-Day'' DDoS attacks are when an attacker must find an unknown vulnerability in a piece of code running on the target Edge server or device, which can cause memory corruption and finally result in a service shutdown. For example, newly built Edge servers could have ''code vulnerabilities'', such as a hanging pointers or stack overflows, and an attacker can abuse those vulnerabilities in order to cause the Edge servers or devices to overload due to memory issues and shut down.

[[File: ZeroDayDDoS.png|300px]]

==='''Side-Channel Attacks'''===

''Side-Channel Attacks'' happen when an attacker constantly obtains certain ''side-channel information'', like using public information that is not privately-sensitive for a user, from the target edge computing infrastructure and then feeds it into specific algorithms or machine learning models that outputs the desired sensitive information. There are three kinds of Side-Channel attacks: attacks exploiting communication channels, attacks exploiting power consumption, and attacks exploiting smartphone-based channels.

*''Attacks exploiting communication channels'' are when an attacker can use a malicious node, that doesn't have to be an edge server or device, in order to exploit communication channels and uses the node to continuously sniff the network traces and wishes to extract sensitive information out of them.

*''Attacks exploiting power consumption'' are when attackers use smart meters and oscilloscopes in order to measure the power consumption of a system since it carries information related to either the device that consumes the energy as different devices have different power.

*''Attacks exploiting smartphone-based channels'' are when attackers exploit vulnerabilities using /proc and smartphone embedded sensors due to how sensors can leak information and send malware to the user that they can install but disguised as something important and attack /proc.

[[File: sidechannelattack.png|300px]]

==='''Malware Injection'''===

''Malware Injection'' is when an attacker injects malicious code, or ''malware'', into edge devices or servers and is classified as either server-side or device-side injections.

''Server-side injections'' are separated into four types: SQL, XSS, CSRF and SSRF, and XML.

*''SQL injection'' is a code injection technique that attackers can use in order to destroy back-end databases by using the SQL query and escape sequences to trick the server into thinking the code is valid.

*''XSS injection'' is a client-side attack in which an attacker injects malicious code into data content, which can be accessed and executed automatically by the servers.

*''CSRF injection'' is an attack in which an end user is forced to execute unwanted actions through Web applications.
*'SSRF injection'' is an attack in which Edge servers are abused to read or alter the internal resources.

*''XML injection'' is an attack which an attacker intercepts an XML message and edits with malicious code so that it is sent to the Edge servers using ''Simple Object Access Protocol'' (SOAP).

''Device-side injection'' is when an attacker injects the malware directly into IoT devices since IoT devices are highly heterogeneous, so an attacker can physically inject or use third-party malicious libraries that are powerful and less likely to get detected.

[[File: SQLinjectionattack.png|300px]]

==='''Authorization and Authentication Attacks'''===

When these attacks happen, an attacker can bypass authentication processes and gain unauthorized access by using four techniques: dictionary attacks, attacks exploiting vulnerabilities in authorization protocols, attacks exploiting vulnerabilities in authorization protocols, and overprivileged attacks.

*''Dictionary attack'' is when an attacker possesses a dictionary containing the most used credentials or passwords and inputs all possible entries in this dictionary in order to brute force a match.

*''Attacks exploiting vulnerabilities in authorization protocols'' are when attackers look for design flaws in how authentication protocols are being used, like finding vulnerabilities in WPA2 or WPA3 protocols which can give an attacker messages that have encrypted information. They can also use 4G or 5G vulnerabilities in order to find a person's location and inject fabricated paging messages to mess with them and gain more information.

*''Attacks exploiting vulnerabilities in authorization protocols'' are when attackers look for flaws in how authorization protocols are designed, such as an attacker using vulnerabilities in OAuth single sign-in which let them access victims personal information without authorization.

*''Overprivileged attacks'' are when attackers are able to develop malicious apps that can do things that they do not have permission to do without needing to authenticate, such as changing door pins and setting off fire alarms in a house.

[[File: dictionaryattack.png|300px]]

==='''How are attackers able to perform these attacks?'''===

Attackers are able to attack Edge devices or servers using different attack techniques, but it is more than just that. Attackers are able to abuse vulnerabilities and flaws in the Edge systems, specifically protocol-level design flaws, implementation-level flaws, code-level vulnerabilities, data correlations, and lacking in fine-grained access controls.

*''Protocol-level design flaws'' are caused by many protocols edge computing having adopted design flaws due to their designers mainly focus on utility and user experience rather than not providing security as well.

*''Implementation-level flaws'' are logic flaws that can cause security strength to decrease significantly after being proved that it was strictly secure on paper, because developers may misunderstand the foundations of the protocol and migrating a protocol from other platforms to the edge computing platform may cause adaptivity inconsistency.

*''Code-level vulnerabilities'' can be system bugs that cause memory failure or corruptness, like stack or heap overflow, and can be caused when a person is programming millions of lines of code but leaves something like a dangling pointer.

*''Data correlations'' is caused when there could be hidden correlations between sensitive and insensitive data that edge produces that might not be straightforward to notice, which an attack can abuse using side-channels.

*''Lacking in fine-grained access controls'' means that Edge computing systems cannot implement fine-grained access controls, because it cannot be adapted to edge computing due to the more complex and fine-grained permissions scenarios, making it easier to attack edge systems.

Overall, the Edge security challenges can be avoided if there was more attention to the potential vulnerabilities or flaws. In the next sections, the content that will be discussed is about data privacy on Edge systems, security protocols that Edge systems use to combat attacks on their systems, and real cases about actual security breaches that happened on the edge.

==6.2 Data Privacy and Compliance in Edge Applications==

===Privacy Issues in Fog Computing===

====Attack Vectors====
----
Below are some of the major attack vectors that plague existing edge and fog networks.
; Forgery
:Forgery is a security threat where the attacker copies someone else's identities and behavior by producing fake information. This is a serious issue that degrades existing network resources for everyone in the network.
;Tampering
: Attackers alter data that is to be sent to other websites. This is difficult to detect since users in an edge environment are mobile and we can't differentiate if the data has been tampered with or anomalous behavior is due to packet loss.
;Spam
:Attackers send fake information that overwhelms the processing power of the edge devices. Similar to DoS, on a smaller scale.
;Sybil
:Attackers fake identity to control the performance of edge network. Falsifying their identity allows them to create fake crowdsensing reports, which affects the reliability of the whole network.
;Jamming
:Attackers generate large amounts of packets to jam transmission channels and occupy important resources
;Eavesdropping
:Attackers listen to confidential data of genuine users from transmission channel by pretending to be a part of the network
; Man in the Middle (MITM)
: MITM is a type of cyberattack where the attacker not only eavesdrops on communication between two devices, but also modifies the payload for destructive payloads.
;Collusion
:Multiple groups band together to mislead fog nodes
;Impersonation
:Attacker acts as real server to trick users to steal all their data
;Virtual Machine Attack
:Attackers take control of hypervisor for the virtual machine's VM
;Side channel
: Attackers brute force passwords to steal information being shared between two parties. Due to the poor resource availability of edge devices, there is a constraint on the use of computationally expensive hashing algorithms.
; Session Hijacking
: Attackers intercept and steal user session to get access to confidential data

==== Privacy Issues in Fog Computing ====
# User privacy
## fog computing contains large number of IoT devices that are inter-connected via sensors
## generated senesitive data and transmit to fog nodse for processing. This sensitive data includes personal information which can be stolen
# Identity Privacy
## ID of users is extremely vulnerable of getting disclosed while having auth to nodes including name, phone , address
# Data Privacy
## data can be exposed to network attacker who is trying to steam user's personal data from the transmission medium or relay nodes
# Usage privacy
## Pattern in which accesses services of fog computing
## intruder knows when user is accessing the channel for data transmission and when he is not communicating
## intruder attacks on user's confidential information or the channel
# Location Privacy
## location privacy helps attackers know the trajectory of the user
# Network Privacy
## wireless connections always at risk
## maintenance of fog nodes is challenging since they are present at edge of internet
## privacy breach is not difficult to occur

=== Security and Privacy issues for edge computing===
# nodes of edge connected to large number of IoT
## these have limited resources
## heterogeneous internal components
## Key management for ensuring privacy of data is difficult

==== Issues ====
# Edge nodes are near to users which makes large amount of sensitive data, which might be stolen
# Edge computing possess low network resources so doesn't support expensive encryption algos
# Edge environment consists of dynamic env which is changing, which allows attackers multiple ways to join the network
Also difficult to create securiy rules for a changing network

==== Attacks ====
; Eavesdropping: Monitor channel to steal data
;# DoS
: take control of network by sending fake requests
;# DDoS
: interrupt normal services provided by different servers
;# Data Tampering
: Attacker can alter the data transmitted over comm channel
;False data injection
:Attacker injects false code in network which brings all data to the attacker
;Physical attack
:Physical protection of edge infra is weak, which allows attackers to compromise the physical locations of edge devices.
; Rogue gateway
:inject large amounts of traffic into edge network infra, similar to MITM

==== Privacy issues in edge computing =====
# weak security techniques for system protection
# unsafe communication between devices
# difficult recovery and data backup
# no specific pattern of update reception
# lack of proper network visibility
# lack of user's selective data collection

==== Countermeasures for Fog Computing ====
;Efficient encryption techniques
:Allows for resource constrained edge devices to encrypt communcations with complex algorithms
;Decoy technique
:Authenticate data of user present the computing network by replacing original information with fake information that is provided to attackers
When breached, the attackers find the decoy files
;Intrusion detection system
:Detect and protect from attacks including DoS, insider attackers, port scanning attacks, flooding attacks on virtual machine, MITM
;Blockchain security for fog computing
:Blockchain is a way to cryptographically ensure the validity of a system while simultaneously increasing it's security. Using blockchain for edge computing reduces single point failure, increases network security and helps with tracking node status effectively.

==6.3 Security Protocols and Frameworks for Edge Systems==

==6.4 Case Studies: Real-World Security Breaches==

To further illustrate the edge computer security concepts, we will give a couple of short case studies where edge
computing security plays a prevalent role, as well as some solutions:

===Securing Egyptian VMSs Smart City Infrastructure===
Over hundreds of thousands of these edge devices such as traffic sensors, surveillance cameras,
smart lighting systems, and environmental monitors are deployed in an urban Smart City. We
have on the `the city edge cloud' these instruments for real-time traffic flow management, public
safety alarm, environmental monitoring with life supports among the green plants – in the area
usually known as! This city suffered a massive blackout, when multiple traffic lights were compromised at the source which caused them to act irregularly: Not
issuing signals, leading to gridlocks.
====Challenges:====
How were the traffic controllers found to be vulnerable? Meaning they hack the password hole
punch so they can bypass the external username password and gain direct access to the temples
of our data. Moreover, on some cameras, the public IP of that camera is exposed, making remote
attack possible: it was obviously a disadvantage for them. The edge network stutters steps from
one organization to the next, making it hard however much one tries to apply security policy
uniformly, as whose department is solely responsible for a given thing?
====Solutions Introduced:====
;Net Separation
: The city designed its infrastructure with isolation zones; meaning traffic
systems are completely isolated from all other municipal services so if one zone is attacked all
other zones of that type remain intact.
;Password Overhaul
: Each unit was provided with a complete rehash to change its default
passwords and other weak credentials to hardened unique passwords. Remote administrative
access was only accepted with Multi-Factor Authentication.
;Embrace of a Zero Trust Model
: In this city, we employed a robust, Zero Trust model. A
central token service gives authorization to every device communication and does not assume
the inherent trust of devices.
;Firmware Handling
: The OTA management system required by installation ensures known
exploits like traffic light management are repaired when discovered. Firmware cannot be
updated at weaker sites as the assumption is it is regularly updated.
;AI-based IDS Deployment
: An AI-based IDS at a traffic control center learns about every
equipment normal behavior going on at this session (like how frequently commands are sent out
for lighting systems) generate alerts, activate promise lockdowns any time an abnormal behavior
appears Mechanisms for rapid dissemination throughout the city.
==== Outcome:====
As a result of the proactive settings, these attempts were quickly identified and contained, with a
limited impact on operations. For example, a virus event that targeted digital kiosks was
contained through micro-segmentation and AI detection mechanisms that quickly isolated and as
such quarantined the attack. It led to enhanced overall resilience of this intelligent city — its
citizens’ trust in IoT services is continually getting better.

=== IIOT (INDUSTRIAL IOT) IN MANUFACTURING===
The production floor of a manufacturing company has integrated an IIoT system that is edge-
based. Sensors associated with the machinery connect to edge gateways that track the health of
the equipment for predictive maintenance. One extreme incident involved the main assembly
robot producing inaccurate sensor readings that were altered, driving the robot to malfunction
and claim weeks of expensive downtime on production. This revealed the insertion of an
unauthorized device, a small single-board computer that was disguised as a sensor node and
which fed erroneous data back to the control system.
====CHALLENGES:====
Even though it was optimized for efficiency, the factory edge network didn't include a device
authentication protocol; attackers could access new sensors without the need for tight controls.
Ensuring up time and keeping operational was prioritized often at the expense of timely
application of security updates. Moreover, the presence of devices from many vendors further
complicated efforts to establish consistent security standards, and production engineers received
little training in cybersecurity best practices.
====SOLUTIONS IMPLEMENTED====
To solve these problems, stringent onboarding procedures were put in place: each sensor or
controller must now present a digital certificate signed by the organization before being allowed
onto the network. Any unknown device attempting to gain access is rejected and notification
alerts are immediately sent out to ensure the remedying of bogus sensors does not take place in
future.
Additionally, they created a blockchain ledger to monitor device identities and to log any
configuration changes over time. Every new addition or firmware update triggers a blockchain
transaction being recorded to guarantee the creation of an immutable audit trail that can be
reviewed by IT as well as OT (operational technology) teams increasing trust and accountability
between departments. They segmented their network by listener and gateway: your sensors only
talk to local gateway, and then your gateway only talks to central controls understanding that if
any one part is breached there are limitations to how much of your network is attacked. More
importantly, they rolled out an AI-powered detection system that monitored sensor readings for
abnormalities.
For known rogue sensors where outputs were statistically different from expected machine
behavior; it is likely that ML models would have picked up on this irregularity early enough to
allow for preemptive safety shutters before doing damage.In addition, maintenance processes
were revised to ensure that scheduled downtimes were regular intervals of time explicitly
dedicated towards security (for example, patching software vulnerabilities and routine
equipment calibration checks). Training of staff on basic cyber hygiene such as ensuring that a
USB drive or laptop was validated before connecting it into the organization edge networks have
reduced the threat of the organization network being infected by malware.
====OUTCOME====
Then after enhancements made at this facility had enabled quick identification of anomalies; The
next, an internal attempt by someone trying to connect using unauthorized monitoring tools was
quickly detected and blocked ensuring nothing could affect operations in our pursuit against
cyber-physical threats going forward. This includes how to properly secure our edges given their
unique properties tightly coupled with how data generation happens right at the host itself which
underlines an edge rather than left assume by further maintaining data access principles and
protocols as logs have significantly aided audits of compliance as well being fitted into our own
investigation processes during incidents reducing times taken before identifying potential
problems where an immutable changelog was adapted into the process itself. Key Takeaways –
Smart cities & IIOT factories share common challenges yet demonstrate needs for customized
solutions & technologies but also show similar trends including segmentation, authentication
continuous supervision Reacting quickly overcoming new challenges through advanced
technology tools - Artificial Intelligence& Blockchain technologies just to name a few.

==Citations==
Y. Xiao, Y. Jia, C. Liu, X. Cheng, J. Yu and W. Lv, "Edge Computing Security: State of the Art and Challenges," in Proceedings of the IEEE, vol. 107, no. 8, pp. 1608-1631, Aug. 2019, doi: 10.1109/JPROC.2019.2918437.
keywords: {Edge computing;Servers;Task analysis;Security;Cloud computing;Mobile handsets;Computer science;Smart phones;Internet of Things;Network security;Data security;edge computing;Internet of Things;network security},

Chapter 6: Edge Security and Privacy

2025-04-16T20:08:27Z

Ali Siddiqi:

==6. Edge Security and Privacy==

==6.1 Overview of Security Challenges in Edge Computing==
From previous chapters, Edge Computing has shown that it is here to stay and it will keep rapidly growing throughout the years. However, Edge Computing has its own security challenges that have to be addressed, because it is not a perfect system. Edge Computing has many security challenges that have to be dealt with in order to keep data safe. In this section, we will be talking about the different kinds of attacks that can happen on an Edge server or device, as how they are able to do this.

==='''DDoS'''===
''DDoS'' is a type of cyberattack in which an attacker aims to disrupt services provided by one or more servers based on distributed based on distributed resources such as a cluster of compromised Edge devices, which are also known as ''botnets''.

''DDoS attacks'' occur when an attacker persistently sends streams of packets to a victim from compromised electronic devices, which causes the hardware resources of the victim to be quickly exhausted by handling these malicious packets and can no longer process any legitimate request on time. There are two kinds of DDoS attacks: Flooding-based and Zero-day DDoS attacks.

[[File: DDoS-Botnet.png|300px]]

*''Flooding-based'' DDoS attacks are a type of of DDoS attacks aiming to shut down normal service of a server based on large amount of flooded malformed or malicious network packets and are mainly classified as UDP flooding, ICMP flooding, SYN flooding, ping of death (PoD), HTTP flooding, and Slowloris.

[[File: UDPFLOODING.png|300px]]

*''Zero-Day'' DDoS attacks are when an attacker must find an unknown vulnerability in a piece of code running on the target Edge server or device, which can cause memory corruption and finally result in a service shutdown. For example, newly built Edge servers could have ''code vulnerabilities'', such as a hanging pointers or stack overflows, and an attacker can abuse those vulnerabilities in order to cause the Edge servers or devices to overload due to memory issues and shut down.

[[File: ZeroDayDDoS.png|300px]]

==='''Side-Channel Attacks'''===

''Side-Channel Attacks'' happen when an attacker constantly obtains certain ''side-channel information'', like using public information that is not privately-sensitive for a user, from the target edge computing infrastructure and then feeds it into specific algorithms or machine learning models that outputs the desired sensitive information. There are three kinds of Side-Channel attacks: attacks exploiting communication channels, attacks exploiting power consumption, and attacks exploiting smartphone-based channels.

*''Attacks exploiting communication channels'' are when an attacker can use a malicious node, that doesn't have to be an edge server or device, in order to exploit communication channels and uses the node to continuously sniff the network traces and wishes to extract sensitive information out of them.

*''Attacks exploiting power consumption'' are when attackers use smart meters and oscilloscopes in order to measure the power consumption of a system since it carries information related to either the device that consumes the energy as different devices have different power.

*''Attacks exploiting smartphone-based channels'' are when attackers exploit vulnerabilities using /proc and smartphone embedded sensors due to how sensors can leak information and send malware to the user that they can install but disguised as something important and attack /proc.

[[File: sidechannelattack.png|300px]]

==='''Malware Injection'''===

''Malware Injection'' is when an attacker injects malicious code, or ''malware'', into edge devices or servers and is classified as either server-side or device-side injections.

''Server-side injections'' are separated into four types: SQL, XSS, CSRF and SSRF, and XML.

*''SQL injection'' is a code injection technique that attackers can use in order to destroy back-end databases by using the SQL query and escape sequences to trick the server into thinking the code is valid.

*''XSS injection'' is a client-side attack in which an attacker injects malicious code into data content, which can be accessed and executed automatically by the servers.

*''CSRF injection'' is an attack in which an end user is forced to execute unwanted actions through Web applications.
*'SSRF injection'' is an attack in which Edge servers are abused to read or alter the internal resources.

*''XML injection'' is an attack which an attacker intercepts an XML message and edits with malicious code so that it is sent to the Edge servers using ''Simple Object Access Protocol'' (SOAP).

''Device-side injection'' is when an attacker injects the malware directly into IoT devices since IoT devices are highly heterogeneous, so an attacker can physically inject or use third-party malicious libraries that are powerful and less likely to get detected.

[[File: SQLinjectionattack.png|300px]]

==='''Authorization and Authentication Attacks'''===

When these attacks happen, an attacker can bypass authentication processes and gain unauthorized access by using four techniques: dictionary attacks, attacks exploiting vulnerabilities in authorization protocols, attacks exploiting vulnerabilities in authorization protocols, and overprivileged attacks.

*''Dictionary attack'' is when an attacker possesses a dictionary containing the most used credentials or passwords and inputs all possible entries in this dictionary in order to brute force a match.

*''Attacks exploiting vulnerabilities in authorization protocols'' are when attackers look for design flaws in how authentication protocols are being used, like finding vulnerabilities in WPA2 or WPA3 protocols which can give an attacker messages that have encrypted information. They can also use 4G or 5G vulnerabilities in order to find a person's location and inject fabricated paging messages to mess with them and gain more information.

*''Attacks exploiting vulnerabilities in authorization protocols'' are when attackers look for flaws in how authorization protocols are designed, such as an attacker using vulnerabilities in OAuth single sign-in which let them access victims personal information without authorization.

*''Overprivileged attacks'' are when attackers are able to develop malicious apps that can do things that they do not have permission to do without needing to authenticate, such as changing door pins and setting off fire alarms in a house.

[[File: dictionaryattack.png|300px]]

==='''How are attackers able to perform these attacks?'''===

Attackers are able to attack Edge devices or servers using different attack techniques, but it is more than just that. Attackers are able to abuse vulnerabilities and flaws in the Edge systems, specifically protocol-level design flaws, implementation-level flaws, code-level vulnerabilities, data correlations, and lacking in fine-grained access controls.

*''Protocol-level design flaws'' are caused by many protocols edge computing having adopted design flaws due to their designers mainly focus on utility and user experience rather than not providing security as well.

*''Implementation-level flaws'' are logic flaws that can cause security strength to decrease significantly after being proved that it was strictly secure on paper, because developers may misunderstand the foundations of the protocol and migrating a protocol from other platforms to the edge computing platform may cause adaptivity inconsistency.

*''Code-level vulnerabilities'' can be system bugs that cause memory failure or corruptness, like stack or heap overflow, and can be caused when a person is programming millions of lines of code but leaves something like a dangling pointer.

*''Data correlations'' is caused when there could be hidden correlations between sensitive and insensitive data that edge produces that might not be straightforward to notice, which an attack can abuse using side-channels.

*''Lacking in fine-grained access controls'' means that Edge computing systems cannot implement fine-grained access controls, because it cannot be adapted to edge computing due to the more complex and fine-grained permissions scenarios, making it easier to attack edge systems.

Overall, the Edge security challenges can be avoided if there was more attention to the potential vulnerabilities or flaws. In the next sections, the content that will be discussed is about data privacy on Edge systems, security protocols that Edge systems use to combat attacks on their systems, and real cases about actual security breaches that happened on the edge.

==6.2 Data Privacy and Compliance in Edge Applications==

===Privacy Issues in Fog Computing===

====Attack Vectors====
----
Below are some of the major attack vectors that plague existing edge and fog networks.
; Forgery
:Forgery is a security threat where the attacker copies someone else's identities and behavior by producing fake information. This is a serious issue that degrades existing network resources for everyone in the network.
;Tampering
: Attackers alter data that is to be sent to other websites. This is difficult to detect since users in an edge environment are mobile and we can't differentiate if the data has been tampered with or anomalous behavior is due to packet loss.
;Spam
:Attackers send fake information that overwhelms the processing power of the edge devices. Similar to DoS, on a smaller scale.
;Sybil
:Attackers fake identity to control the performance of edge network. Falsifying their identity allows them to create fake crowdsensing reports, which affects the reliability of the whole network.
;Jamming
:Attackers generate large amounts of packets to jam transmission channels and occupy important resources
;Eavesdropping
:Attackers listen to confidential data of genuine users from transmission channel by pretending to be a part of the network
; Man in the Middle (MITM)
: MITM is a type of cyberattack where the attacker not only eavesdrops on communication between two devices, but also modifies the payload for destructive payloads.
;Collusion
:Multiple groups band together to mislead fog nodes
;Impersonation
:Attacker acts as real server to trick users to steal all their data
;Virtual Machine Attack
:Attackers take control of hypervisor for the virtual machine's VM
;Side channel
: Attackers brute force passwords to steal information being shared between two parties. Due to the poor resource availability of edge devices, there is a constraint on the use of computationally expensive hashing algorithms.
; Session Hijacking
: Attackers intercept and steal user session to get access to confidential data

==== Privacy Issues in Fog Computing ====
# User privacy
## fog computing contains large number of IoT devices that are inter-connected via sensors
## generated senesitive data and transmit to fog nodse for processing. This sensitive data includes personal information which can be stolen
# Identity Privacy
## ID of users is extremely vulnerable of getting disclosed while having auth to nodes including name, phone , address
# Data Privacy
## data can be exposed to network attacker who is trying to steam user's personal data from the transmission medium or relay nodes
# Usage privacy
## Pattern in which accesses services of fog computing
## intruder knows when user is accessing the channel for data transmission and when he is not communicating
## intruder attacks on user's confidential information or the channel
# Location Privacy
## location privacy helps attackers know the trajectory of the user
# Network Privacy
## wireless connections always at risk
## maintenance of fog nodes is challenging since they are present at edge of internet
## privacy breach is not difficult to occur

=== Security and Privacy issues for edge computing===
# nodes of edge connected to large number of IoT
## these have limited resources
## heterogeneous internal components
## Key management for ensuring privacy of data is difficult

==== Issues ====
# Edge nodes are near to users which makes large amount of sensitive data, which might be stolen
# Edge computing possess low network resources so doesn't support expensive encryption algos
# Edge environment consists of dynamic env which is changing, which allows attackers multiple ways to join the network
Also difficult to create securiy rules for a changing network

==== Attacks ====
; Eavesdropping: Monitor channel to steal data
;# DoS
: take control of network by sending fake requests
;# DDoS
: interrupt normal services provided by different servers
;# Data Tampering
: Attacker can alter the data transmitted over comm channel
;False data injection
:Attacker injects false code in network which brings all data to the attacker
;Physical attack
:Physical protection of edge infra is weak, which allows attackers to compromise the physical locations of edge devices.
; Rogue gateway
:inject large amounts of traffic into edge network infra, similar to MITM

==== Privacy issues in edge computing =====
# weak security techniques for system protection
# unsafe communication between devices
# difficult recovery and data backup
# no specific pattern of update reception
# lack of proper network visibility
# lack of user's selective data collection

==== Countermeasures for Fog Computing ====
;Efficient encryption techniques
:Allows for resource constrained edge devices to encrypt communcations with complex algorithms
;Decoy technique
:Authenticate data of user present the computing network by replacing original information with fake information that is provided to attackers
When breached, the attackers find the decoy files
;Intrusion detection system
:Detect and protect from attacks including DoS, insider attackers, port scanning attacks, flooding attacks on virtual machine, MITM
;Blockchain security for fog computing
:Blockchain is a way to cryptographically ensure the validity of a system while simultaneously increasing it's security. Using blockchain for edge computing reduces single point failure, increases network security and helps with tracking node status effectively.

==6.3 Security Protocols and Frameworks for Edge Systems==

==6.4 Case Studies: Real-World Security Breaches==

To further illustrate the edge computer security concepts, we will give a couple of short case studies where edge
computing security plays a prevalent role, as well as some solutions:

===Securing Egyptian VMSs Smart City Infrastructure===
Over hundreds of thousands of these edge devices such as traffic sensors, surveillance cameras,
smart lighting systems, and environmental monitors are deployed in an urban Smart City. We
have on the `the city edge cloud' these instruments for real-time traffic flow management, public
safety alarm, environmental monitoring with life supports among the green plants – in the area
usually known as! This city suffered a massive blackout, when multiple traffic lights were compromised at the source which caused them to act irregularly: Not
issuing signals, leading to gridlocks.
====Challenges:====
How were the traffic controllers found to be vulnerable? Meaning they hack the password hole
punch so they can bypass the external username password and gain direct access to the temples
of our data. Moreover, on some cameras, the public IP of that camera is exposed, making remote
attack possible: it was obviously a disadvantage for them. The edge network stutters steps from
one organization to the next, making it hard however much one tries to apply security policy
uniformly, as whose department is solely responsible for a given thing?
====Solutions Introduced:====
;Net Separation
: The city designed its infrastructure with isolation zones; meaning traffic
systems are completely isolated from all other municipal services so if one zone is attacked all
other zones of that type remain intact.
;Password Overhaul
: Each unit was provided with a complete rehash to change its default
passwords and other weak credentials to hardened unique passwords. Remote administrative
access was only accepted with Multi-Factor Authentication.
;Embrace of a Zero Trust Model
: In this city, we employed a robust, Zero Trust model. A
central token service gives authorization to every device communication and does not assume
the inherent trust of devices.
;Firmware Handling
: The OTA management system required by installation ensures known
exploits like traffic light management are repaired when discovered. Firmware cannot be
updated at weaker sites as the assumption is it is regularly updated.
;AI-based IDS Deployment
: An AI-based IDS at a traffic control center learns about every
equipment normal behavior going on at this session (like how frequently commands are sent out
for lighting systems) generate alerts, activate promise lockdowns any time an abnormal behavior
appears Mechanisms for rapid dissemination throughout the city.
==== Outcome:====
As a result of the proactive settings, these attempts were quickly identified and contained, with a
limited impact on operations. For example, a virus event that targeted digital kiosks was
contained through micro-segmentation and AI detection mechanisms that quickly isolated and as
such quarantined the attack. It led to enhanced overall resilience of this intelligent city — its
citizens’ trust in IoT services is continually getting better.

=== IIOT (INDUSTRIAL IOT) IN MANUFACTURING===
The production floor of a manufacturing company has integrated an IIoT system that is edge-
based. Sensors associated with the machinery connect to edge gateways that track the health of
the equipment for predictive maintenance. One extreme incident involved the main assembly
robot producing inaccurate sensor readings that were altered, driving the robot to malfunction
and claim weeks of expensive downtime on production. This revealed the insertion of an
unauthorized device, a small single-board computer that was disguised as a sensor node and
which fed erroneous data back to the control system.
====CHALLENGES:====
Even though it was optimized for efficiency, the factory edge network didn't include a device
authentication protocol; attackers could access new sensors without the need for tight controls.
Ensuring up time and keeping operational was prioritized often at the expense of timely
application of security updates. Moreover, the presence of devices from many vendors further
complicated efforts to establish consistent security standards, and production engineers received
little training in cybersecurity best practices.
====SOLUTIONS IMPLEMENTED====
To solve these problems, stringent onboarding procedures were put in place: each sensor or
controller must now present a digital certificate signed by the organization before being allowed
onto the network. Any unknown device attempting to gain access is rejected and notification
alerts are immediately sent out to ensure the remedying of bogus sensors does not take place in
future.
Additionally, they created a blockchain ledger to monitor device identities and to log any
configuration changes over time. Every new addition or firmware update triggers a blockchain
transaction being recorded to guarantee the creation of an immutable audit trail that can be
reviewed by IT as well as OT (operational technology) teams increasing trust and accountability
between departments. They segmented their network by listener and gateway: your sensors only
talk to local gateway, and then your gateway only talks to central controls understanding that if
any one part is breached there are limitations to how much of your network is attacked. More
importantly, they rolled out an AI-powered detection system that monitored sensor readings for
abnormalities.
For known rogue sensors where outputs were statistically different from expected machine
behavior; it is likely that ML models would have picked up on this irregularity early enough to
allow for preemptive safety shutters before doing damage.In addition, maintenance processes
were revised to ensure that scheduled downtimes were regular intervals of time explicitly
dedicated towards security (for example, patching software vulnerabilities and routine
equipment calibration checks). Training of staff on basic cyber hygiene such as ensuring that a
USB drive or laptop was validated before connecting it into the organization edge networks have
reduced the threat of the organization network being infected by malware.
====OUTCOME====
Then after enhancements made at this facility had enabled quick identification of anomalies; The
next, an internal attempt by someone trying to connect using unauthorized monitoring tools was
quickly detected and blocked ensuring nothing could affect operations in our pursuit against
cyber-physical threats going forward. This includes how to properly secure our edges given their
unique properties tightly coupled with how data generation happens right at the host itself which
underlines an edge rather than left assume by further maintaining data access principles and
protocols as logs have significantly aided audits of compliance as well being fitted into our own
investigation processes during incidents reducing times taken before identifying potential
problems where an immutable changelog was adapted into the process itself. Key Takeaways –
Smart cities & IIOT factories share common challenges yet demonstrate needs for customized
solutions & technologies but also show similar trends including segmentation, authentication
continuous supervision Reacting quickly overcoming new challenges through advanced
technology tools - Artificial Intelligence& Blockchain technologies just to name a few.

==Citations==
Y. Xiao, Y. Jia, C. Liu, X. Cheng, J. Yu and W. Lv, "Edge Computing Security: State of the Art and Challenges," in Proceedings of the IEEE, vol. 107, no. 8, pp. 1608-1631, Aug. 2019, doi: 10.1109/JPROC.2019.2918437.
keywords: {Edge computing;Servers;Task analysis;Security;Cloud computing;Mobile handsets;Computer science;Smart phones;Internet of Things;Network security;Data security;edge computing;Internet of Things;network security},

Chapter 6: Edge Security and Privacy

2025-04-16T20:05:52Z

Ali Siddiqi: /* 6.1 Overview of Security Challenges in Edge Computing */

==6. Edge Security and Privacy==

==6.1 Overview of Security Challenges in Edge Computing==
From previous chapters, Edge Computing has shown that it is here to stay and it will keep rapidly growing throughout the years. However, Edge Computing has its own security challenges that have to be addressed, because it is not a perfect system. Edge Computing has many security challenges that have to be dealt with in order to keep data safe. In this section, we will be talking about the different kinds of attacks that can happen on an Edge server or device, as how they are able to do this.

==='''DDoS'''===
''DDoS'' is a type of cyberattack in which an attacker aims to disrupt services provided by one or more servers based on distributed based on distributed resources such as a cluster of compromised Edge devices, which are also known as ''botnets''.

''DDoS attacks'' occur when an attacker persistently sends streams of packets to a victim from compromised electronic devices, which causes the hardware resources of the victim to be quickly exhausted by handling these malicious packets and can no longer process any legitimate request on time. There are two kinds of DDoS attacks: Flooding-based and Zero-day DDoS attacks.

[[File: DDoS-Botnet.png|300px]]

*''Flooding-based'' DDoS attacks are a type of of DDoS attacks aiming to shut down normal service of a server based on large amount of flooded malformed or malicious network packets and are mainly classified as UDP flooding, ICMP flooding, SYN flooding, ping of death (PoD), HTTP flooding, and Slowloris.

[[File: UDPFLOODING.png|300px]]

*''Zero-Day'' DDoS attacks are when an attacker must find an unknown vulnerability in a piece of code running on the target Edge server or device, which can cause memory corruption and finally result in a service shutdown. For example, newly built Edge servers could have ''code vulnerabilities'', such as a hanging pointers or stack overflows, and an attacker can abuse those vulnerabilities in order to cause the Edge servers or devices to overload due to memory issues and shut down.

[[File: ZeroDayDDoS.png|300px]]

==='''Side-Channel Attacks'''===

''Side-Channel Attacks'' happen when an attacker constantly obtains certain ''side-channel information'', like using public information that is not privately-sensitive for a user, from the target edge computing infrastructure and then feeds it into specific algorithms or machine learning models that outputs the desired sensitive information. There are three kinds of Side-Channel attacks: attacks exploiting communication channels, attacks exploiting power consumption, and attacks exploiting smartphone-based channels.

*''Attacks exploiting communication channels'' are when an attacker can use a malicious node, that doesn't have to be an edge server or device, in order to exploit communication channels and uses the node to continuously sniff the network traces and wishes to extract sensitive information out of them.

*''Attacks exploiting power consumption'' are when attackers use smart meters and oscilloscopes in order to measure the power consumption of a system since it carries information related to either the device that consumes the energy as different devices have different power.

*''Attacks exploiting smartphone-based channels'' are when attackers exploit vulnerabilities using /proc and smartphone embedded sensors due to how sensors can leak information and send malware to the user that they can install but disguised as something important and attack /proc.

[[File: sidechannelattack.png|300px]]

==='''Malware Injection'''===

''Malware Injection'' is when an attacker injects malicious code, or ''malware'', into edge devices or servers and is classified as either server-side or device-side injections.

''Server-side injections'' are separated into four types: SQL, XSS, CSRF and SSRF, and XML.

*''SQL injection'' is a code injection technique that attackers can use in order to destroy back-end databases by using the SQL query and escape sequences to trick the server into thinking the code is valid.

*''XSS injection'' is a client-side attack in which an attacker injects malicious code into data content, which can be accessed and executed automatically by the servers.

*''CSRF injection'' is an attack in which an end user is forced to execute unwanted actions through Web applications.
*'SSRF injection'' is an attack in which Edge servers are abused to read or alter the internal resources.

*''XML injection'' is an attack which an attacker intercepts an XML message and edits with malicious code so that it is sent to the Edge servers using ''Simple Object Access Protocol'' (SOAP).

''Device-side injection'' is when an attacker injects the malware directly into IoT devices since IoT devices are highly heterogeneous, so an attacker can physically inject or use third-party malicious libraries that are powerful and less likely to get detected.

[[File: SQLinjectionattack.png|300px]]

==='''Authorization and Authentication Attacks'''===

When these attacks happen, an attacker can bypass authentication processes and gain unauthorized access by using four techniques: dictionary attacks, attacks exploiting vulnerabilities in authorization protocols, attacks exploiting vulnerabilities in authorization protocols, and overprivileged attacks.

*''Dictionary attack'' is when an attacker possesses a dictionary containing the most used credentials or passwords and inputs all possible entries in this dictionary in order to brute force a match.

*''Attacks exploiting vulnerabilities in authorization protocols'' are when attackers look for design flaws in how authentication protocols are being used, like finding vulnerabilities in WPA2 or WPA3 protocols which can give an attacker messages that have encrypted information. They can also use 4G or 5G vulnerabilities in order to find a person's location and inject fabricated paging messages to mess with them and gain more information.

*''Attacks exploiting vulnerabilities in authorization protocols'' are when attackers look for flaws in how authorization protocols are designed, such as an attacker using vulnerabilities in OAuth single sign-in which let them access victims personal information without authorization.

*''Overprivileged attacks'' are when attackers are able to develop malicious apps that can do things that they do not have permission to do without needing to authenticate, such as changing door pins and setting off fire alarms in a house.

[[File: dictionaryattack.png|300px]]

==='''How are attackers able to perform these attacks?'''===

Attackers are able to attack Edge devices or servers using different attack techniques, but it is more than just that. Attackers are able to abuse vulnerabilities and flaws in the Edge systems, specifically protocol-level design flaws, implementation-level flaws, code-level vulnerabilities, data correlations, and lacking in fine-grained access controls.

*''Protocol-level design flaws'' are caused by many protocols edge computing having adopted design flaws due to their designers mainly focus on utility and user experience rather than not providing security as well.

*''Implementation-level flaws'' are logic flaws that can cause security strength to decrease significantly after being proved that it was strictly secure on paper, because developers may misunderstand the foundations of the protocol and migrating a protocol from other platforms to the edge computing platform may cause adaptivity inconsistency.

*''Code-level vulnerabilities'' can be system bugs that cause memory failure or corruptness, like stack or heap overflow, and can be caused when a person is programming millions of lines of code but leaves something like a dangling pointer.

*''Data correlations'' is caused when there could be hidden correlations between sensitive and insensitive data that edge produces that might not be straightforward to notice, which an attack can abuse using side-channels.

*''Lacking in fine-grained access controls'' means that Edge computing systems cannot implement fine-grained access controls, because it cannot be adapted to edge computing due to the more complex and fine-grained permissions scenarios, making it easier to attack edge systems.

Overall, the Edge security challenges can be avoided if there was more attention to the potential vulnerabilities or flaws. In the next sections, the content that will be discussed is about data privacy on Edge systems, security protocols that Edge systems use to combat attacks on their systems, and real cases about actual security breaches that happened on the edge.

==6.2 Data Privacy and Compliance in Edge Applications==

===Privacy Issues in Fog Computing===

====Attack Vectors====
----
Below are some of the major attack vectors that plague existing edge and fog networks.
; Forgery
:Forgery is a security threat where the attacker copies someone else's identities and behavior by producing fake information. This is a serious issue that degrades existing network resources for everyone in the network.
;Tampering
: Attackers alter data that is to be sent to other websites. This is difficult to detect since users in an edge environment are mobile and we can't differentiate if the data has been tampered with or anomalous behavior is due to packet loss.
;Spam
:Attackers send fake information that overwhelms the processing power of the edge devices. Similar to DoS, on a smaller scale.
;Sybil
:Attackers fake identity to control the performance of edge network. Falsifying their identity allows them to create fake crowdsensing reports, which affects the reliability of the whole network.
;Jamming
:Attackers generate large amounts of packets to jam transmission channels and occupy important resources
;Eavesdropping
:Attackers listen to confidential data of genuine users from transmission channel by pretending to be a part of the network
; Man in the Middle (MITM)
: MITM is a type of cyberattack where the attacker not only eavesdrops on communication between two devices, but also modifies the payload for destructive payloads.
;Collusion
:Multiple groups band together to mislead fog nodes
;Impersonation
:Attacker acts as real server to trick users to steal all their data
;Virtual Machine Attack
:Attackers take control of hypervisor for the virtual machine's VM
;Side channel
: Attackers brute force passwords to steal information being shared between two parties. Due to the poor resource availability of edge devices, there is a constraint on the use of computationally expensive hashing algorithms.
; Session Hijacking
: Attackers intercept and steal user session to get access to confidential data

==== Privacy Issues in Fog Computing ====
# User privacy
## fog computing contains large number of IoT devices that are inter-connected via sensors
## generated senesitive data and transmit to fog nodse for processing. This sensitive data includes personal information which can be stolen
# Identity Privacy
## ID of users is extremely vulnerable of getting disclosed while having auth to nodes including name, phone , address
# Data Privacy
## data can be exposed to network attacker who is trying to steam user's personal data from the transmission medium or relay nodes
# Usage privacy
## Pattern in which accesses services of fog computing
## intruder knows when user is accessing the channel for data transmission and when he is not communicating
## intruder attacks on user's confidential information or the channel
# Location Privacy
## location privacy helps attackers know the trajectory of the user
# Network Privacy
## wireless connections always at risk
## maintenance of fog nodes is challenging since they are present at edge of internet
## privacy breach is not difficult to occur

=== Security and Privacy issues for edge computing===
# nodes of edge connected to large number of IoT
## these have limited resources
## heterogeneous internal components
## Key management for ensuring privacy of data is difficult

==== Issues ====
# Edge nodes are near to users which makes large amount of sensitive data, which might be stolen
# Edge computing possess low network resources so doesn't support expensive encryption algos
# Edge environment consists of dynamic env which is changing, which allows attackers multiple ways to join the network
Also difficult to create securiy rules for a changing network

==== Attacks ====
; Eavesdropping: Monitor channel to steal data
;# DoS
: take control of network by sending fake requests
;# DDoS
: interrupt normal services provided by different servers
;# Data Tampering
: Attacker can alter the data transmitted over comm channel
;False data injection
:Attacker injects false code in network which brings all data to the attacker
;Physical attack
:Physical protection of edge infra is weak, which allows attackers to compromise the physical locations of edge devices.
; Rogue gateway
:inject large amounts of traffic into edge network infra, similar to MITM

==== Privacy issues in edge computing =====
# weak security techniques for system protection
# unsafe communication between devices
# difficult recovery and data backup
# no specific pattern of update reception
# lack of proper network visibility
# lack of user's selective data collection

==== Countermeasures for Fog Computing ====
;Efficient encryption techniques
:Allows for resource constrained edge devices to encrypt communcations with complex algorithms
;Decoy technique
:Authenticate data of user present the computing network by replacing original information with fake information that is provided to attackers
When breached, the attackers find the decoy files
;Intrusion detection system
:Detect and protect from attacks including DoS, insider attackers, port scanning attacks, flooding attacks on virtual machine, MITM
;Blockchain security for fog computing
:Blockchain is a way to cryptographically ensure the validity of a system while simultaneously increasing it's security. Using blockchain for edge computing reduces single point failure, increases network security and helps with tracking node status effectively.

==6.3 Security Protocols and Frameworks for Edge Systems==

To further illustrate the edge computer security concepts, we will give a couple of short case studies where edge
computing security plays a prevalent role, as well as some solutions:

===Securing Egyptian VMSs Smart City Infrastructure===
Over hundreds of thousands of these edge devices such as traffic sensors, surveillance cameras,
smart lighting systems, and environmental monitors are deployed in an urban Smart City. We
have on the `the city edge cloud' these instruments for real-time traffic flow management, public
safety alarm, environmental monitoring with life supports among the green plants – in the area
usually known as! This city suffered a massive blackout, when multiple traffic lights were compromised at the source which caused them to act irregularly: Not
issuing signals, leading to gridlocks.
====Challenges:====
How were the traffic controllers found to be vulnerable? Meaning they hack the password hole
punch so they can bypass the external username password and gain direct access to the temples
of our data. Moreover, on some cameras, the public IP of that camera is exposed, making remote
attack possible: it was obviously a disadvantage for them. The edge network stutters steps from
one organization to the next, making it hard however much one tries to apply security policy
uniformly, as whose department is solely responsible for a given thing?
====Solutions Introduced:====
;Net Separation
: The city designed its infrastructure with isolation zones; meaning traffic
systems are completely isolated from all other municipal services so if one zone is attacked all
other zones of that type remain intact.
;Password Overhaul
: Each unit was provided with a complete rehash to change its default
passwords and other weak credentials to hardened unique passwords. Remote administrative
access was only accepted with Multi-Factor Authentication.
;Embrace of a Zero Trust Model
: In this city, we employed a robust, Zero Trust model. A
central token service gives authorization to every device communication and does not assume
the inherent trust of devices.
;Firmware Handling
: The OTA management system required by installation ensures known
exploits like traffic light management are repaired when discovered. Firmware cannot be
updated at weaker sites as the assumption is it is regularly updated.
;AI-based IDS Deployment
: An AI-based IDS at a traffic control center learns about every
equipment normal behavior going on at this session (like how frequently commands are sent out
for lighting systems) generate alerts, activate promise lockdowns any time an abnormal behavior
appears Mechanisms for rapid dissemination throughout the city.
==== Outcome:====
As a result of the proactive settings, these attempts were quickly identified and contained, with a
limited impact on operations. For example, a virus event that targeted digital kiosks was
contained through micro-segmentation and AI detection mechanisms that quickly isolated and as
such quarantined the attack. It led to enhanced overall resilience of this intelligent city — its
citizens’ trust in IoT services is continually getting better.

=== IIOT (INDUSTRIAL IOT) IN MANUFACTURING===
The production floor of a manufacturing company has integrated an IIoT system that is edge-
based. Sensors associated with the machinery connect to edge gateways that track the health of
the equipment for predictive maintenance. One extreme incident involved the main assembly
robot producing inaccurate sensor readings that were altered, driving the robot to malfunction
and claim weeks of expensive downtime on production. This revealed the insertion of an
unauthorized device, a small single-board computer that was disguised as a sensor node and
which fed erroneous data back to the control system.
====CHALLENGES:====
Even though it was optimized for efficiency, the factory edge network didn't include a device
authentication protocol; attackers could access new sensors without the need for tight controls.
Ensuring up time and keeping operational was prioritized often at the expense of timely
application of security updates. Moreover, the presence of devices from many vendors further
complicated efforts to establish consistent security standards, and production engineers received
little training in cybersecurity best practices.
====SOLUTIONS IMPLEMENTED====
To solve these problems, stringent onboarding procedures were put in place: each sensor or
controller must now present a digital certificate signed by the organization before being allowed
onto the network. Any unknown device attempting to gain access is rejected and notification
alerts are immediately sent out to ensure the remedying of bogus sensors does not take place in
future.
Additionally, they created a blockchain ledger to monitor device identities and to log any
configuration changes over time. Every new addition or firmware update triggers a blockchain
transaction being recorded to guarantee the creation of an immutable audit trail that can be
reviewed by IT as well as OT (operational technology) teams increasing trust and accountability
between departments. They segmented their network by listener and gateway: your sensors only
talk to local gateway, and then your gateway only talks to central controls understanding that if
any one part is breached there are limitations to how much of your network is attacked. More
importantly, they rolled out an AI-powered detection system that monitored sensor readings for
abnormalities.
For known rogue sensors where outputs were statistically different from expected machine
behavior; it is likely that ML models would have picked up on this irregularity early enough to
allow for preemptive safety shutters before doing damage.In addition, maintenance processes
were revised to ensure that scheduled downtimes were regular intervals of time explicitly
dedicated towards security (for example, patching software vulnerabilities and routine
equipment calibration checks). Training of staff on basic cyber hygiene such as ensuring that a
USB drive or laptop was validated before connecting it into the organization edge networks have
reduced the threat of the organization network being infected by malware.
====OUTCOME====
Then after enhancements made at this facility had enabled quick identification of anomalies; The
next, an internal attempt by someone trying to connect using unauthorized monitoring tools was
quickly detected and blocked ensuring nothing could affect operations in our pursuit against
cyber-physical threats going forward. This includes how to properly secure our edges given their
unique properties tightly coupled with how data generation happens right at the host itself which
underlines an edge rather than left assume by further maintaining data access principles and
protocols as logs have significantly aided audits of compliance as well being fitted into our own
investigation processes during incidents reducing times taken before identifying potential
problems where an immutable changelog was adapted into the process itself. Key Takeaways –
Smart cities & IIOT factories share common challenges yet demonstrate needs for customized
solutions & technologies but also show similar trends including segmentation, authentication
continuous supervision Reacting quickly overcoming new challenges through advanced
technology tools - Artificial Intelligence& Blockchain technologies just to name a few.

==Citations==
Y. Xiao, Y. Jia, C. Liu, X. Cheng, J. Yu and W. Lv, "Edge Computing Security: State of the Art and Challenges," in Proceedings of the IEEE, vol. 107, no. 8, pp. 1608-1631, Aug. 2019, doi: 10.1109/JPROC.2019.2918437.
keywords: {Edge computing;Servers;Task analysis;Security;Cloud computing;Mobile handsets;Computer science;Smart phones;Internet of Things;Network security;Data security;edge computing;Internet of Things;network security},

Chapter 6: Edge Security and Privacy

2025-04-16T20:05:12Z

Ali Siddiqi:

==6. Edge Security and Privacy==

==6.1 Overview of Security Challenges in Edge Computing==
From previous chapters, Edge Computing has shown that it is here to stay and it will keep rapidly growing throughout the years. However, Edge Computing has its own security challenges that have to be addressed, because it is not a perfect system. Edge Computing has many security challenges that have to be dealt with in order to keep data safe. In this section, we will be talking about the different kinds of attacks that can happen on an Edge server or device, as how they are able to do this.

==='''DDoS'''===
''DDoS'' is a type of cyberattack in which an attacker aims to disrupt services provided by one or more servers based on distributed based on distributed resources such as a cluster of compromised Edge devices, which are also known as ''botnets''.

''DDoS attacks'' occur when an attacker persistently sends streams of packets to a victim from compromised electronic devices, which causes the hardware resources of the victim to be quickly exhausted by handling these malicious packets and can no longer process any legitimate request on time. There are two kinds of DDoS attacks: Flooding-based and Zero-day DDoS attacks.

[[File: DDoS-Botnet.png|300px]]

*''Flooding-based'' DDoS attacks are a type of of DDoS attacks aiming to shut down normal service of a server based on large amount of flooded malformed or malicious network packets and are mainly classified as UDP flooding, ICMP flooding, SYN flooding, ping of death (PoD), HTTP flooding, and Slowloris.

[[File: UDPFLOODING.png|300px]]

*''Zero-Day'' DDoS attacks are when an attacker must find an unknown vulnerability in a piece of code running on the target Edge server or device, which can cause memory corruption and finally result in a service shutdown. For example, newly built Edge servers could have ''code vulnerabilities'', such as a hanging pointers or stack overflows, and an attacker can abuse those vulnerabilities in order to cause the Edge servers or devices to overload due to memory issues and shut down.

[[File: ZeroDayDDoS.png|300px]]

==='''Side-Channel Attacks'''===

''Side-Channel Attacks'' happen when an attacker constantly obtains certain ''side-channel information'', like using public information that is not privately-sensitive for a user, from the target edge computing infrastructure and then feeds it into specific algorithms or machine learning models that outputs the desired sensitive information. There are three kinds of Side-Channel attacks: attacks exploiting communication channels, attacks exploiting power consumption, and attacks exploiting smartphone-based channels.

*''Attacks exploiting communication channels'' are when an attacker can use a malicious node, that doesn't have to be an edge server or device, in order to exploit communication channels and uses the node to continuously sniff the network traces and wishes to extract sensitive information out of them.

*''Attacks exploiting power consumption'' are when attackers use smart meters and oscilloscopes in order to measure the power consumption of a system since it carries information related to either the device that consumes the energy as different devices have different power.

*''Attacks exploiting smartphone-based channels'' are when attackers exploit vulnerabilities using /proc and smartphone embedded sensors due to how sensors can leak information and send malware to the user that they can install but disguised as something important and attack /proc.

[[File: sidechannelattack.png|300px]]

==='''Malware Injection'''===

''Malware Injection'' is when an attacker injects malicious code, or ''malware'', into edge devices or servers and is classified as either server-side or device-side injections.

''Server-side injections'' are separated into four types: SQL, XSS, CSRF and SSRF, and XML.

*''SQL injection'' is a code injection technique that attackers can use in order to destroy back-end databases by using the SQL query and escape sequences to trick the server into thinking the code is valid.
*''XSS injection'' is a client-side attack in which an attacker injects malicious code into data content, which can be accessed and executed automatically by the servers.
*''CSRF injection'' is an attack in which an end user is forced to execute unwanted actions through Web applications.
*'SSRF injection'' is an attack in which Edge servers are abused to read or alter the internal resources.
*''XML injection'' is an attack which an attacker intercepts an XML message and edits with malicious code so that it is sent to the Edge servers using ''Simple Object Access Protocol'' (SOAP).

''Device-side injection'' is when an attacker injects the malware directly into IoT devices since IoT devices are highly heterogeneous, so an attacker can physically inject or use third-party malicious libraries that are powerful and less likely to get detected.

[[File: SQLinjectionattack.png|300px]]

==='''Authorization and Authentication Attacks'''===

When these attacks happen, an attacker can bypass authentication processes and gain unauthorized access by using four techniques: dictionary attacks, attacks exploiting vulnerabilities in authorization protocols, attacks exploiting vulnerabilities in authorization protocols, and overprivileged attacks.

*''Dictionary attack'' is when an attacker possesses a dictionary containing the most used credentials or passwords and inputs all possible entries in this dictionary in order to brute force a match.

*''Attacks exploiting vulnerabilities in authorization protocols'' are when attackers look for design flaws in how authentication protocols are being used, like finding vulnerabilities in WPA2 or WPA3 protocols which can give an attacker messages that have encrypted information. They can also use 4G or 5G vulnerabilities in order to find a person's location and inject fabricated paging messages to mess with them and gain more information.

*''Attacks exploiting vulnerabilities in authorization protocols'' are when attackers look for flaws in how authorization protocols are designed, such as an attacker using vulnerabilities in OAuth single sign-in which let them access victims personal information without authorization.

*''Overprivileged attacks'' are when attackers are able to develop malicious apps that can do things that they do not have permission to do without needing to authenticate, such as changing door pins and setting off fire alarms in a house.

[[File: dictionaryattack.png|300px]]

==='''How are attackers able to perform these attacks?'''===

Attackers are able to attack Edge devices or servers using different attack techniques, but it is more than just that. Attackers are able to abuse vulnerabilities and flaws in the Edge systems, specifically protocol-level design flaws, implementation-level flaws, code-level vulnerabilities, data correlations, and lacking in fine-grained access controls.

*''Protocol-level design flaws'' are caused by many protocols edge computing having adopted design flaws due to their designers mainly focus on utility and user experience rather than not providing security as well.

*''Implementation-level flaws'' are logic flaws that can cause security strength to decrease significantly after being proved that it was strictly secure on paper, because developers may misunderstand the foundations of the protocol and migrating a protocol from other platforms to the edge computing platform may cause adaptivity inconsistency.

*''Code-level vulnerabilities'' can be system bugs that cause memory failure or corruptness, like stack or heap overflow, and can be caused when a person is programming millions of lines of code but leaves something like a dangling pointer.

*''Data correlations'' is caused when there could be hidden correlations between sensitive and insensitive data that edge produces that might not be straightforward to notice, which an attack can abuse using side-channels.

*''Lacking in fine-grained access controls'' means that Edge computing systems cannot implement fine-grained access controls, because it cannot be adapted to edge computing due to the more complex and fine-grained permissions scenarios, making it easier to attack edge systems.

Overall, the Edge security challenges can be avoided if there was more attention to the potential vulnerabilities or flaws. In the next sections, the content that will be discussed is about data privacy on Edge systems, security protocols that Edge systems use to combat attacks on their systems, and real cases about actual security breaches that happened on the edge.

==6.2 Data Privacy and Compliance in Edge Applications==

===Privacy Issues in Fog Computing===

====Attack Vectors====
----
Below are some of the major attack vectors that plague existing edge and fog networks.
; Forgery
:Forgery is a security threat where the attacker copies someone else's identities and behavior by producing fake information. This is a serious issue that degrades existing network resources for everyone in the network.
;Tampering
: Attackers alter data that is to be sent to other websites. This is difficult to detect since users in an edge environment are mobile and we can't differentiate if the data has been tampered with or anomalous behavior is due to packet loss.
;Spam
:Attackers send fake information that overwhelms the processing power of the edge devices. Similar to DoS, on a smaller scale.
;Sybil
:Attackers fake identity to control the performance of edge network. Falsifying their identity allows them to create fake crowdsensing reports, which affects the reliability of the whole network.
;Jamming
:Attackers generate large amounts of packets to jam transmission channels and occupy important resources
;Eavesdropping
:Attackers listen to confidential data of genuine users from transmission channel by pretending to be a part of the network
; Man in the Middle (MITM)
: MITM is a type of cyberattack where the attacker not only eavesdrops on communication between two devices, but also modifies the payload for destructive payloads.
;Collusion
:Multiple groups band together to mislead fog nodes
;Impersonation
:Attacker acts as real server to trick users to steal all their data
;Virtual Machine Attack
:Attackers take control of hypervisor for the virtual machine's VM
;Side channel
: Attackers brute force passwords to steal information being shared between two parties. Due to the poor resource availability of edge devices, there is a constraint on the use of computationally expensive hashing algorithms.
; Session Hijacking
: Attackers intercept and steal user session to get access to confidential data

==== Privacy Issues in Fog Computing ====
# User privacy
## fog computing contains large number of IoT devices that are inter-connected via sensors
## generated senesitive data and transmit to fog nodse for processing. This sensitive data includes personal information which can be stolen
# Identity Privacy
## ID of users is extremely vulnerable of getting disclosed while having auth to nodes including name, phone , address
# Data Privacy
## data can be exposed to network attacker who is trying to steam user's personal data from the transmission medium or relay nodes
# Usage privacy
## Pattern in which accesses services of fog computing
## intruder knows when user is accessing the channel for data transmission and when he is not communicating
## intruder attacks on user's confidential information or the channel
# Location Privacy
## location privacy helps attackers know the trajectory of the user
# Network Privacy
## wireless connections always at risk
## maintenance of fog nodes is challenging since they are present at edge of internet
## privacy breach is not difficult to occur

=== Security and Privacy issues for edge computing===
# nodes of edge connected to large number of IoT
## these have limited resources
## heterogeneous internal components
## Key management for ensuring privacy of data is difficult

==== Issues ====
# Edge nodes are near to users which makes large amount of sensitive data, which might be stolen
# Edge computing possess low network resources so doesn't support expensive encryption algos
# Edge environment consists of dynamic env which is changing, which allows attackers multiple ways to join the network
Also difficult to create securiy rules for a changing network

==== Attacks ====
; Eavesdropping: Monitor channel to steal data
;# DoS
: take control of network by sending fake requests
;# DDoS
: interrupt normal services provided by different servers
;# Data Tampering
: Attacker can alter the data transmitted over comm channel
;False data injection
:Attacker injects false code in network which brings all data to the attacker
;Physical attack
:Physical protection of edge infra is weak, which allows attackers to compromise the physical locations of edge devices.
; Rogue gateway
:inject large amounts of traffic into edge network infra, similar to MITM

==== Privacy issues in edge computing =====
# weak security techniques for system protection
# unsafe communication between devices
# difficult recovery and data backup
# no specific pattern of update reception
# lack of proper network visibility
# lack of user's selective data collection

==== Countermeasures for Fog Computing ====
;Efficient encryption techniques
:Allows for resource constrained edge devices to encrypt communcations with complex algorithms
;Decoy technique
:Authenticate data of user present the computing network by replacing original information with fake information that is provided to attackers
When breached, the attackers find the decoy files
;Intrusion detection system
:Detect and protect from attacks including DoS, insider attackers, port scanning attacks, flooding attacks on virtual machine, MITM
;Blockchain security for fog computing
:Blockchain is a way to cryptographically ensure the validity of a system while simultaneously increasing it's security. Using blockchain for edge computing reduces single point failure, increases network security and helps with tracking node status effectively.

==6.3 Security Protocols and Frameworks for Edge Systems==

To further illustrate the edge computer security concepts, we will give a couple of short case studies where edge
computing security plays a prevalent role, as well as some solutions:

===Securing Egyptian VMSs Smart City Infrastructure===
Over hundreds of thousands of these edge devices such as traffic sensors, surveillance cameras,
smart lighting systems, and environmental monitors are deployed in an urban Smart City. We
have on the `the city edge cloud' these instruments for real-time traffic flow management, public
safety alarm, environmental monitoring with life supports among the green plants – in the area
usually known as! This city suffered a massive blackout, when multiple traffic lights were compromised at the source which caused them to act irregularly: Not
issuing signals, leading to gridlocks.
====Challenges:====
How were the traffic controllers found to be vulnerable? Meaning they hack the password hole
punch so they can bypass the external username password and gain direct access to the temples
of our data. Moreover, on some cameras, the public IP of that camera is exposed, making remote
attack possible: it was obviously a disadvantage for them. The edge network stutters steps from
one organization to the next, making it hard however much one tries to apply security policy
uniformly, as whose department is solely responsible for a given thing?
====Solutions Introduced:====
;Net Separation
: The city designed its infrastructure with isolation zones; meaning traffic
systems are completely isolated from all other municipal services so if one zone is attacked all
other zones of that type remain intact.
;Password Overhaul
: Each unit was provided with a complete rehash to change its default
passwords and other weak credentials to hardened unique passwords. Remote administrative
access was only accepted with Multi-Factor Authentication.
;Embrace of a Zero Trust Model
: In this city, we employed a robust, Zero Trust model. A
central token service gives authorization to every device communication and does not assume
the inherent trust of devices.
;Firmware Handling
: The OTA management system required by installation ensures known
exploits like traffic light management are repaired when discovered. Firmware cannot be
updated at weaker sites as the assumption is it is regularly updated.
;AI-based IDS Deployment
: An AI-based IDS at a traffic control center learns about every
equipment normal behavior going on at this session (like how frequently commands are sent out
for lighting systems) generate alerts, activate promise lockdowns any time an abnormal behavior
appears Mechanisms for rapid dissemination throughout the city.
==== Outcome:====
As a result of the proactive settings, these attempts were quickly identified and contained, with a
limited impact on operations. For example, a virus event that targeted digital kiosks was
contained through micro-segmentation and AI detection mechanisms that quickly isolated and as
such quarantined the attack. It led to enhanced overall resilience of this intelligent city — its
citizens’ trust in IoT services is continually getting better.

=== IIOT (INDUSTRIAL IOT) IN MANUFACTURING===
The production floor of a manufacturing company has integrated an IIoT system that is edge-
based. Sensors associated with the machinery connect to edge gateways that track the health of
the equipment for predictive maintenance. One extreme incident involved the main assembly
robot producing inaccurate sensor readings that were altered, driving the robot to malfunction
and claim weeks of expensive downtime on production. This revealed the insertion of an
unauthorized device, a small single-board computer that was disguised as a sensor node and
which fed erroneous data back to the control system.
====CHALLENGES:====
Even though it was optimized for efficiency, the factory edge network didn't include a device
authentication protocol; attackers could access new sensors without the need for tight controls.
Ensuring up time and keeping operational was prioritized often at the expense of timely
application of security updates. Moreover, the presence of devices from many vendors further
complicated efforts to establish consistent security standards, and production engineers received
little training in cybersecurity best practices.
====SOLUTIONS IMPLEMENTED====
To solve these problems, stringent onboarding procedures were put in place: each sensor or
controller must now present a digital certificate signed by the organization before being allowed
onto the network. Any unknown device attempting to gain access is rejected and notification
alerts are immediately sent out to ensure the remedying of bogus sensors does not take place in
future.
Additionally, they created a blockchain ledger to monitor device identities and to log any
configuration changes over time. Every new addition or firmware update triggers a blockchain
transaction being recorded to guarantee the creation of an immutable audit trail that can be
reviewed by IT as well as OT (operational technology) teams increasing trust and accountability
between departments. They segmented their network by listener and gateway: your sensors only
talk to local gateway, and then your gateway only talks to central controls understanding that if
any one part is breached there are limitations to how much of your network is attacked. More
importantly, they rolled out an AI-powered detection system that monitored sensor readings for
abnormalities.
For known rogue sensors where outputs were statistically different from expected machine
behavior; it is likely that ML models would have picked up on this irregularity early enough to
allow for preemptive safety shutters before doing damage.In addition, maintenance processes
were revised to ensure that scheduled downtimes were regular intervals of time explicitly
dedicated towards security (for example, patching software vulnerabilities and routine
equipment calibration checks). Training of staff on basic cyber hygiene such as ensuring that a
USB drive or laptop was validated before connecting it into the organization edge networks have
reduced the threat of the organization network being infected by malware.
====OUTCOME====
Then after enhancements made at this facility had enabled quick identification of anomalies; The
next, an internal attempt by someone trying to connect using unauthorized monitoring tools was
quickly detected and blocked ensuring nothing could affect operations in our pursuit against
cyber-physical threats going forward. This includes how to properly secure our edges given their
unique properties tightly coupled with how data generation happens right at the host itself which
underlines an edge rather than left assume by further maintaining data access principles and
protocols as logs have significantly aided audits of compliance as well being fitted into our own
investigation processes during incidents reducing times taken before identifying potential
problems where an immutable changelog was adapted into the process itself. Key Takeaways –
Smart cities & IIOT factories share common challenges yet demonstrate needs for customized
solutions & technologies but also show similar trends including segmentation, authentication
continuous supervision Reacting quickly overcoming new challenges through advanced
technology tools - Artificial Intelligence& Blockchain technologies just to name a few.

==Citations==
Y. Xiao, Y. Jia, C. Liu, X. Cheng, J. Yu and W. Lv, "Edge Computing Security: State of the Art and Challenges," in Proceedings of the IEEE, vol. 107, no. 8, pp. 1608-1631, Aug. 2019, doi: 10.1109/JPROC.2019.2918437.
keywords: {Edge computing;Servers;Task analysis;Security;Cloud computing;Mobile handsets;Computer science;Smart phones;Internet of Things;Network security;Data security;edge computing;Internet of Things;network security},

Chapter 6: Edge Security and Privacy

2025-04-16T20:04:10Z

Ali Siddiqi: /* 6.1 Overview of Security Challenges in Edge Computing */

==6. Edge Security and Privacy==

==6.1 Overview of Security Challenges in Edge Computing==
From previous chapters, Edge Computing has shown that it is here to stay and it will keep rapidly growing throughout the years. However, Edge Computing has its own security challenges that have to be addressed, because it is not a perfect system. Edge Computing has many security challenges that have to be dealt with in order to keep data safe. In this section, we will be talking about the different kinds of attacks that can happen on an Edge server or device, as how they are able to do this.

==='''DDoS'''===
''DDoS'' is a type of cyberattack in which an attacker aims to disrupt services provided by one or more servers based on distributed based on distributed resources such as a cluster of compromised Edge devices, which are also known as ''botnets''.

''DDoS attacks'' occur when an attacker persistently sends streams of packets to a victim from compromised electronic devices, which causes the hardware resources of the victim to be quickly exhausted by handling these malicious packets and can no longer process any legitimate request on time. There are two kinds of DDoS attacks: Flooding-based and Zero-day DDoS attacks.

[[File: DDoS-Botnet.png|300px]]

*''Flooding-based'' DDoS attacks are a type of of DDoS attacks aiming to shut down normal service of a server based on large amount of flooded malformed or malicious network packets and are mainly classified as UDP flooding, ICMP flooding, SYN flooding, ping of death (PoD), HTTP flooding, and Slowloris.

[[File: UDPFLOODING.png|300px]]

*''Zero-Day'' DDoS attacks are when an attacker must find an unknown vulnerability in a piece of code running on the target Edge server or device, which can cause memory corruption and finally result in a service shutdown. For example, newly built Edge servers could have ''code vulnerabilities'', such as a hanging pointers or stack overflows, and an attacker can abuse those vulnerabilities in order to cause the Edge servers or devices to overload due to memory issues and shut down.

[[File: ZeroDayDDoS.png|300px]]

==='''Side-Channel Attacks'''===

''Side-Channel Attacks'' happen when an attacker constantly obtains certain ''side-channel information'', like using public information that is not privately-sensitive for a user, from the target edge computing infrastructure and then feeds it into specific algorithms or machine learning models that outputs the desired sensitive information. There are three kinds of Side-Channel attacks: attacks exploiting communication channels, attacks exploiting power consumption, and attacks exploiting smartphone-based channels.

*''Attacks exploiting communication channels'' are when an attacker can use a malicious node, that doesn't have to be an edge server or device, in order to exploit communication channels and uses the node to continuously sniff the network traces and wishes to extract sensitive information out of them.

*''Attacks exploiting power consumption'' are when attackers use smart meters and oscilloscopes in order to measure the power consumption of a system since it carries information related to either the device that consumes the energy as different devices have different power.

*''Attacks exploiting smartphone-based channels'' are when attackers exploit vulnerabilities using /proc and smartphone embedded sensors due to how sensors can leak information and send malware to the user that they can install but disguised as something important and attack /proc.

[[File: sidechannelattack.png|300px]]

==='''Malware Injection'''===

''Malware Injection'' is when an attacker injects malicious code, or ''malware'', into edge devices or servers and is classified as either server-side or device-side injections.

#''Server-side injections'' are separated into four types: SQL, XSS, CSRF and SSRF, and XML.

*''SQL injection'' is a code injection technique that attackers can use in order to destroy back-end databases by using the SQL query and escape sequences to trick the server into thinking the code is valid.
*''XSS injection'' is a client-side attack in which an attacker injects malicious code into data content, which can be accessed and executed automatically by the servers.
*''CSRF injection'' is an attack in which an end user is forced to execute unwanted actions through Web applications.
*'SSRF injection'' is an attack in which Edge servers are abused to read or alter the internal resources.
*''XML injection'' is an attack which an attacker intercepts an XML message and edits with malicious code so that it is sent to the Edge servers using ''Simple Object Access Protocol'' (SOAP).

#''Device-side injection'' is when an attacker injects the malware directly into IoT devices since IoT devices are highly heterogeneous, so an attacker can physically inject or use third-party malicious libraries that are powerful and less likely to get detected.

[[File: SQLinjectionattack.png|300px]]

==='''Authorization and Authentication Attacks'''===

When these attacks happen, an attacker can bypass authentication processes and gain unauthorized access by using four techniques: dictionary attacks, attacks exploiting vulnerabilities in authorization protocols, attacks exploiting vulnerabilities in authorization protocols, and overprivileged attacks.

''Dictionary attack'' is when an attacker possesses a dictionary containing the most used credentials or passwords and inputs all possible entries in this dictionary in order to brute force a match.

''Attacks exploiting vulnerabilities in authorization protocols'' are when attackers look for design flaws in how authentication protocols are being used, like finding vulnerabilities in WPA2 or WPA3 protocols which can give an attacker messages that have encrypted information. They can also use 4G or 5G vulnerabilities in order to find a person's location and inject fabricated paging messages to mess with them and gain more information.

''Attacks exploiting vulnerabilities in authorization protocols'' are when attackers look for flaws in how authorization protocols are designed, such as an attacker using vulnerabilities in OAuth single sign-in which let them access victims personal information without authorization.

''Overprivileged attacks'' are when attackers are able to develop malicious apps that can do things that they do not have permission to do without needing to authenticate, such as changing door pins and setting off fire alarms in a house.

[[File: dictionaryattack.png|300px]]

==='''How are attackers able to perform these attacks?'''===

Attackers are able to attack Edge devices or servers using different attack techniques, but it is more than just that. Attackers are able to abuse vulnerabilities and flaws in the Edge systems, specifically protocol-level design flaws, implementation-level flaws, code-level vulnerabilities, data correlations, and lacking in fine-grained access controls.

''Protocol-level design flaws'' are caused by many protocols edge computing having adopted design flaws due to their designers mainly focus on utility and user experience rather than not providing security as well.

''Implementation-level flaws'' are logic flaws that can cause security strength to decrease significantly after being proved that it was strictly secure on paper, because developers may misunderstand the foundations of the protocol and migrating a protocol from other platforms to the edge computing platform may cause adaptivity inconsistency.

''Code-level vulnerabilities'' can be system bugs that cause memory failure or corruptness, like stack or heap overflow, and can be caused when a person is programming millions of lines of code but leaves something like a dangling pointer.

''Data correlations'' is caused when there could be hidden correlations between sensitive and insensitive data that edge produces that might not be straightforward to notice, which an attack can abuse using side-channels.

''Lacking in fine-grained access controls'' means that Edge computing systems cannot implement fine-grained access controls, because it cannot be adapted to edge computing due to the more complex and fine-grained permissions scenarios, making it easier to attack edge systems.

Overall, the Edge security challenges can be avoided if there was more attention to the potential vulnerabilities or flaws. In the next sections, the content that will be discussed is about data privacy on Edge systems, security protocols that Edge systems use to combat attacks on their systems, and real cases about actual security breaches that happened on the edge.

==6.2 Data Privacy and Compliance in Edge Applications==

===Privacy Issues in Fog Computing===

====Attack Vectors====
----
Below are some of the major attack vectors that plague existing edge and fog networks.
; Forgery
:Forgery is a security threat where the attacker copies someone else's identities and behavior by producing fake information. This is a serious issue that degrades existing network resources for everyone in the network.
;Tampering
: Attackers alter data that is to be sent to other websites. This is difficult to detect since users in an edge environment are mobile and we can't differentiate if the data has been tampered with or anomalous behavior is due to packet loss.
;Spam
:Attackers send fake information that overwhelms the processing power of the edge devices. Similar to DoS, on a smaller scale.
;Sybil
:Attackers fake identity to control the performance of edge network. Falsifying their identity allows them to create fake crowdsensing reports, which affects the reliability of the whole network.
;Jamming
:Attackers generate large amounts of packets to jam transmission channels and occupy important resources
;Eavesdropping
:Attackers listen to confidential data of genuine users from transmission channel by pretending to be a part of the network
; Man in the Middle (MITM)
: MITM is a type of cyberattack where the attacker not only eavesdrops on communication between two devices, but also modifies the payload for destructive payloads.
;Collusion
:Multiple groups band together to mislead fog nodes
;Impersonation
:Attacker acts as real server to trick users to steal all their data
;Virtual Machine Attack
:Attackers take control of hypervisor for the virtual machine's VM
;Side channel
: Attackers brute force passwords to steal information being shared between two parties. Due to the poor resource availability of edge devices, there is a constraint on the use of computationally expensive hashing algorithms.
; Session Hijacking
: Attackers intercept and steal user session to get access to confidential data

==== Privacy Issues in Fog Computing ====
# User privacy
## fog computing contains large number of IoT devices that are inter-connected via sensors
## generated senesitive data and transmit to fog nodse for processing. This sensitive data includes personal information which can be stolen
# Identity Privacy
## ID of users is extremely vulnerable of getting disclosed while having auth to nodes including name, phone , address
# Data Privacy
## data can be exposed to network attacker who is trying to steam user's personal data from the transmission medium or relay nodes
# Usage privacy
## Pattern in which accesses services of fog computing
## intruder knows when user is accessing the channel for data transmission and when he is not communicating
## intruder attacks on user's confidential information or the channel
# Location Privacy
## location privacy helps attackers know the trajectory of the user
# Network Privacy
## wireless connections always at risk
## maintenance of fog nodes is challenging since they are present at edge of internet
## privacy breach is not difficult to occur

=== Security and Privacy issues for edge computing===
# nodes of edge connected to large number of IoT
## these have limited resources
## heterogeneous internal components
## Key management for ensuring privacy of data is difficult

==== Issues ====
# Edge nodes are near to users which makes large amount of sensitive data, which might be stolen
# Edge computing possess low network resources so doesn't support expensive encryption algos
# Edge environment consists of dynamic env which is changing, which allows attackers multiple ways to join the network
Also difficult to create securiy rules for a changing network

==== Attacks ====
; Eavesdropping: Monitor channel to steal data
;# DoS
: take control of network by sending fake requests
;# DDoS
: interrupt normal services provided by different servers
;# Data Tampering
: Attacker can alter the data transmitted over comm channel
;False data injection
:Attacker injects false code in network which brings all data to the attacker
;Physical attack
:Physical protection of edge infra is weak, which allows attackers to compromise the physical locations of edge devices.
; Rogue gateway
:inject large amounts of traffic into edge network infra, similar to MITM

==== Privacy issues in edge computing =====
# weak security techniques for system protection
# unsafe communication between devices
# difficult recovery and data backup
# no specific pattern of update reception
# lack of proper network visibility
# lack of user's selective data collection

==== Countermeasures for Fog Computing ====
;Efficient encryption techniques
:Allows for resource constrained edge devices to encrypt communcations with complex algorithms
;Decoy technique
:Authenticate data of user present the computing network by replacing original information with fake information that is provided to attackers
When breached, the attackers find the decoy files
;Intrusion detection system
:Detect and protect from attacks including DoS, insider attackers, port scanning attacks, flooding attacks on virtual machine, MITM
;Blockchain security for fog computing
:Blockchain is a way to cryptographically ensure the validity of a system while simultaneously increasing it's security. Using blockchain for edge computing reduces single point failure, increases network security and helps with tracking node status effectively.

==6.3 Security Protocols and Frameworks for Edge Systems==

To further illustrate the edge computer security concepts, we will give a couple of short case studies where edge
computing security plays a prevalent role, as well as some solutions:

===Securing Egyptian VMSs Smart City Infrastructure===
Over hundreds of thousands of these edge devices such as traffic sensors, surveillance cameras,
smart lighting systems, and environmental monitors are deployed in an urban Smart City. We
have on the `the city edge cloud' these instruments for real-time traffic flow management, public
safety alarm, environmental monitoring with life supports among the green plants – in the area
usually known as! This city suffered a massive blackout, when multiple traffic lights were compromised at the source which caused them to act irregularly: Not
issuing signals, leading to gridlocks.
====Challenges:====
How were the traffic controllers found to be vulnerable? Meaning they hack the password hole
punch so they can bypass the external username password and gain direct access to the temples
of our data. Moreover, on some cameras, the public IP of that camera is exposed, making remote
attack possible: it was obviously a disadvantage for them. The edge network stutters steps from
one organization to the next, making it hard however much one tries to apply security policy
uniformly, as whose department is solely responsible for a given thing?
====Solutions Introduced:====
;Net Separation
: The city designed its infrastructure with isolation zones; meaning traffic
systems are completely isolated from all other municipal services so if one zone is attacked all
other zones of that type remain intact.
;Password Overhaul
: Each unit was provided with a complete rehash to change its default
passwords and other weak credentials to hardened unique passwords. Remote administrative
access was only accepted with Multi-Factor Authentication.
;Embrace of a Zero Trust Model
: In this city, we employed a robust, Zero Trust model. A
central token service gives authorization to every device communication and does not assume
the inherent trust of devices.
;Firmware Handling
: The OTA management system required by installation ensures known
exploits like traffic light management are repaired when discovered. Firmware cannot be
updated at weaker sites as the assumption is it is regularly updated.
;AI-based IDS Deployment
: An AI-based IDS at a traffic control center learns about every
equipment normal behavior going on at this session (like how frequently commands are sent out
for lighting systems) generate alerts, activate promise lockdowns any time an abnormal behavior
appears Mechanisms for rapid dissemination throughout the city.
==== Outcome:====
As a result of the proactive settings, these attempts were quickly identified and contained, with a
limited impact on operations. For example, a virus event that targeted digital kiosks was
contained through micro-segmentation and AI detection mechanisms that quickly isolated and as
such quarantined the attack. It led to enhanced overall resilience of this intelligent city — its
citizens’ trust in IoT services is continually getting better.

=== IIOT (INDUSTRIAL IOT) IN MANUFACTURING===
The production floor of a manufacturing company has integrated an IIoT system that is edge-
based. Sensors associated with the machinery connect to edge gateways that track the health of
the equipment for predictive maintenance. One extreme incident involved the main assembly
robot producing inaccurate sensor readings that were altered, driving the robot to malfunction
and claim weeks of expensive downtime on production. This revealed the insertion of an
unauthorized device, a small single-board computer that was disguised as a sensor node and
which fed erroneous data back to the control system.
====CHALLENGES:====
Even though it was optimized for efficiency, the factory edge network didn't include a device
authentication protocol; attackers could access new sensors without the need for tight controls.
Ensuring up time and keeping operational was prioritized often at the expense of timely
application of security updates. Moreover, the presence of devices from many vendors further
complicated efforts to establish consistent security standards, and production engineers received
little training in cybersecurity best practices.
====SOLUTIONS IMPLEMENTED====
To solve these problems, stringent onboarding procedures were put in place: each sensor or
controller must now present a digital certificate signed by the organization before being allowed
onto the network. Any unknown device attempting to gain access is rejected and notification
alerts are immediately sent out to ensure the remedying of bogus sensors does not take place in
future.
Additionally, they created a blockchain ledger to monitor device identities and to log any
configuration changes over time. Every new addition or firmware update triggers a blockchain
transaction being recorded to guarantee the creation of an immutable audit trail that can be
reviewed by IT as well as OT (operational technology) teams increasing trust and accountability
between departments. They segmented their network by listener and gateway: your sensors only
talk to local gateway, and then your gateway only talks to central controls understanding that if
any one part is breached there are limitations to how much of your network is attacked. More
importantly, they rolled out an AI-powered detection system that monitored sensor readings for
abnormalities.
For known rogue sensors where outputs were statistically different from expected machine
behavior; it is likely that ML models would have picked up on this irregularity early enough to
allow for preemptive safety shutters before doing damage.In addition, maintenance processes
were revised to ensure that scheduled downtimes were regular intervals of time explicitly
dedicated towards security (for example, patching software vulnerabilities and routine
equipment calibration checks). Training of staff on basic cyber hygiene such as ensuring that a
USB drive or laptop was validated before connecting it into the organization edge networks have
reduced the threat of the organization network being infected by malware.
====OUTCOME====
Then after enhancements made at this facility had enabled quick identification of anomalies; The
next, an internal attempt by someone trying to connect using unauthorized monitoring tools was
quickly detected and blocked ensuring nothing could affect operations in our pursuit against
cyber-physical threats going forward. This includes how to properly secure our edges given their
unique properties tightly coupled with how data generation happens right at the host itself which
underlines an edge rather than left assume by further maintaining data access principles and
protocols as logs have significantly aided audits of compliance as well being fitted into our own
investigation processes during incidents reducing times taken before identifying potential
problems where an immutable changelog was adapted into the process itself. Key Takeaways –
Smart cities & IIOT factories share common challenges yet demonstrate needs for customized
solutions & technologies but also show similar trends including segmentation, authentication
continuous supervision Reacting quickly overcoming new challenges through advanced
technology tools - Artificial Intelligence& Blockchain technologies just to name a few.

==Citations==
Y. Xiao, Y. Jia, C. Liu, X. Cheng, J. Yu and W. Lv, "Edge Computing Security: State of the Art and Challenges," in Proceedings of the IEEE, vol. 107, no. 8, pp. 1608-1631, Aug. 2019, doi: 10.1109/JPROC.2019.2918437.
keywords: {Edge computing;Servers;Task analysis;Security;Cloud computing;Mobile handsets;Computer science;Smart phones;Internet of Things;Network security;Data security;edge computing;Internet of Things;network security},

Chapter 6: Edge Security and Privacy

2025-04-16T20:03:02Z

Ali Siddiqi: /* 6.1 Overview of Security Challenges in Edge Computing */

==6. Edge Security and Privacy==

==6.1 Overview of Security Challenges in Edge Computing==
From previous chapters, Edge Computing has shown that it is here to stay and it will keep rapidly growing throughout the years. However, Edge Computing has its own security challenges that have to be addressed, because it is not a perfect system. Edge Computing has many security challenges that have to be dealt with in order to keep data safe. In this section, we will be talking about the different kinds of attacks that can happen on an Edge server or device, as how they are able to do this.

==='''DDoS'''===
''DDoS'' is a type of cyberattack in which an attacker aims to disrupt services provided by one or more servers based on distributed based on distributed resources such as a cluster of compromised Edge devices, which are also known as ''botnets''.

''DDoS attacks'' occur when an attacker persistently sends streams of packets to a victim from compromised electronic devices, which causes the hardware resources of the victim to be quickly exhausted by handling these malicious packets and can no longer process any legitimate request on time. There are two kinds of DDoS attacks: Flooding-based and Zero-day DDoS attacks.

[[File: DDoS-Botnet.png|300px]]

''Flooding-based'' DDoS attacks are a type of of DDoS attacks aiming to shut down normal service of a server based on large amount of flooded malformed or malicious network packets and are mainly classified as UDP flooding, ICMP flooding, SYN flooding, ping of death (PoD), HTTP flooding, and Slowloris.

[[File: UDPFLOODING.png|300px]]

''Zero-Day'' DDoS attacks are when an attacker must find an unknown vulnerability in a piece of code running on the target Edge server or device, which can cause memory corruption and finally result in a service shutdown. For example, newly built Edge servers could have ''code vulnerabilities'', such as a hanging pointers or stack overflows, and an attacker can abuse those vulnerabilities in order to cause the Edge servers or devices to overload due to memory issues and shut down.

[[File: ZeroDayDDoS.png|300px]]

==='''Side-Channel Attacks'''===

''Side-Channel Attacks'' happen when an attacker constantly obtains certain ''side-channel information'', like using public information that is not privately-sensitive for a user, from the target edge computing infrastructure and then feeds it into specific algorithms or machine learning models that outputs the desired sensitive information. There are three kinds of Side-Channel attacks: attacks exploiting communication channels, attacks exploiting power consumption, and attacks exploiting smartphone-based channels.

''Attacks exploiting communication channels'' are when an attacker can use a malicious node, that doesn't have to be an edge server or device, in order to exploit communication channels and uses the node to continuously sniff the network traces and wishes to extract sensitive information out of them.

''Attacks exploiting power consumption'' are when attackers use smart meters and oscilloscopes in order to measure the power consumption of a system since it carries information related to either the device that consumes the energy as different devices have different power.

''Attacks exploiting smartphone-based channels'' are when attackers exploit vulnerabilities using /proc and smartphone embedded sensors due to how sensors can leak information and send malware to the user that they can install but disguised as something important and attack /proc.

[[File: sidechannelattack.png|300px]]

==='''Malware Injection'''===

''Malware Injection'' is when an attacker injects malicious code, or ''malware'', into edge devices or servers and is classified as either server-side or device-side injections.

''Server-side injections'' are separated into four types: SQL, XSS, CSRF and SSRF, and XML.

*''SQL injection'' is a code injection technique that attackers can use in order to destroy back-end databases by using the SQL query and escape sequences to trick the server into thinking the code is valid.
*''XSS injection'' is a client-side attack in which an attacker injects malicious code into data content, which can be accessed and executed automatically by the servers.
*''CSRF injection'' is an attack in which an end user is forced to execute unwanted actions through Web applications.
*'SSRF injection'' is an attack in which Edge servers are abused to read or alter the internal resources.
*''XML injection'' is an attack which an attacker intercepts an XML message and edits with malicious code so that it is sent to the Edge servers using ''Simple Object Access Protocol'' (SOAP).

''Device-side injection'' is when an attacker injects the malware directly into IoT devices since IoT devices are highly heterogeneous, so an attacker can physically inject or use third-party malicious libraries that are powerful and less likely to get detected.

[[File: SQLinjectionattack.png|300px]]

==='''Authorization and Authentication Attacks'''===

When these attacks happen, an attacker can bypass authentication processes and gain unauthorized access by using four techniques: dictionary attacks, attacks exploiting vulnerabilities in authorization protocols, attacks exploiting vulnerabilities in authorization protocols, and overprivileged attacks.

''Dictionary attack'' is when an attacker possesses a dictionary containing the most used credentials or passwords and inputs all possible entries in this dictionary in order to brute force a match.

''Attacks exploiting vulnerabilities in authorization protocols'' are when attackers look for design flaws in how authentication protocols are being used, like finding vulnerabilities in WPA2 or WPA3 protocols which can give an attacker messages that have encrypted information. They can also use 4G or 5G vulnerabilities in order to find a person's location and inject fabricated paging messages to mess with them and gain more information.

''Attacks exploiting vulnerabilities in authorization protocols'' are when attackers look for flaws in how authorization protocols are designed, such as an attacker using vulnerabilities in OAuth single sign-in which let them access victims personal information without authorization.

''Overprivileged attacks'' are when attackers are able to develop malicious apps that can do things that they do not have permission to do without needing to authenticate, such as changing door pins and setting off fire alarms in a house.

[[File: dictionaryattack.png|300px]]

==='''How are attackers able to perform these attacks?'''===

Attackers are able to attack Edge devices or servers using different attack techniques, but it is more than just that. Attackers are able to abuse vulnerabilities and flaws in the Edge systems, specifically protocol-level design flaws, implementation-level flaws, code-level vulnerabilities, data correlations, and lacking in fine-grained access controls.

''Protocol-level design flaws'' are caused by many protocols edge computing having adopted design flaws due to their designers mainly focus on utility and user experience rather than not providing security as well.

''Implementation-level flaws'' are logic flaws that can cause security strength to decrease significantly after being proved that it was strictly secure on paper, because developers may misunderstand the foundations of the protocol and migrating a protocol from other platforms to the edge computing platform may cause adaptivity inconsistency.

''Code-level vulnerabilities'' can be system bugs that cause memory failure or corruptness, like stack or heap overflow, and can be caused when a person is programming millions of lines of code but leaves something like a dangling pointer.

''Data correlations'' is caused when there could be hidden correlations between sensitive and insensitive data that edge produces that might not be straightforward to notice, which an attack can abuse using side-channels.

''Lacking in fine-grained access controls'' means that Edge computing systems cannot implement fine-grained access controls, because it cannot be adapted to edge computing due to the more complex and fine-grained permissions scenarios, making it easier to attack edge systems.

Overall, the Edge security challenges can be avoided if there was more attention to the potential vulnerabilities or flaws. In the next sections, the content that will be discussed is about data privacy on Edge systems, security protocols that Edge systems use to combat attacks on their systems, and real cases about actual security breaches that happened on the edge.

==6.2 Data Privacy and Compliance in Edge Applications==

===Privacy Issues in Fog Computing===

====Attack Vectors====
----
Below are some of the major attack vectors that plague existing edge and fog networks.
; Forgery
:Forgery is a security threat where the attacker copies someone else's identities and behavior by producing fake information. This is a serious issue that degrades existing network resources for everyone in the network.
;Tampering
: Attackers alter data that is to be sent to other websites. This is difficult to detect since users in an edge environment are mobile and we can't differentiate if the data has been tampered with or anomalous behavior is due to packet loss.
;Spam
:Attackers send fake information that overwhelms the processing power of the edge devices. Similar to DoS, on a smaller scale.
;Sybil
:Attackers fake identity to control the performance of edge network. Falsifying their identity allows them to create fake crowdsensing reports, which affects the reliability of the whole network.
;Jamming
:Attackers generate large amounts of packets to jam transmission channels and occupy important resources
;Eavesdropping
:Attackers listen to confidential data of genuine users from transmission channel by pretending to be a part of the network
; Man in the Middle (MITM)
: MITM is a type of cyberattack where the attacker not only eavesdrops on communication between two devices, but also modifies the payload for destructive payloads.
;Collusion
:Multiple groups band together to mislead fog nodes
;Impersonation
:Attacker acts as real server to trick users to steal all their data
;Virtual Machine Attack
:Attackers take control of hypervisor for the virtual machine's VM
;Side channel
: Attackers brute force passwords to steal information being shared between two parties. Due to the poor resource availability of edge devices, there is a constraint on the use of computationally expensive hashing algorithms.
; Session Hijacking
: Attackers intercept and steal user session to get access to confidential data

==== Privacy Issues in Fog Computing ====
# User privacy
## fog computing contains large number of IoT devices that are inter-connected via sensors
## generated senesitive data and transmit to fog nodse for processing. This sensitive data includes personal information which can be stolen
# Identity Privacy
## ID of users is extremely vulnerable of getting disclosed while having auth to nodes including name, phone , address
# Data Privacy
## data can be exposed to network attacker who is trying to steam user's personal data from the transmission medium or relay nodes
# Usage privacy
## Pattern in which accesses services of fog computing
## intruder knows when user is accessing the channel for data transmission and when he is not communicating
## intruder attacks on user's confidential information or the channel
# Location Privacy
## location privacy helps attackers know the trajectory of the user
# Network Privacy
## wireless connections always at risk
## maintenance of fog nodes is challenging since they are present at edge of internet
## privacy breach is not difficult to occur

=== Security and Privacy issues for edge computing===
# nodes of edge connected to large number of IoT
## these have limited resources
## heterogeneous internal components
## Key management for ensuring privacy of data is difficult

==== Issues ====
# Edge nodes are near to users which makes large amount of sensitive data, which might be stolen
# Edge computing possess low network resources so doesn't support expensive encryption algos
# Edge environment consists of dynamic env which is changing, which allows attackers multiple ways to join the network
Also difficult to create securiy rules for a changing network

==== Attacks ====
; Eavesdropping: Monitor channel to steal data
;# DoS
: take control of network by sending fake requests
;# DDoS
: interrupt normal services provided by different servers
;# Data Tampering
: Attacker can alter the data transmitted over comm channel
;False data injection
:Attacker injects false code in network which brings all data to the attacker
;Physical attack
:Physical protection of edge infra is weak, which allows attackers to compromise the physical locations of edge devices.
; Rogue gateway
:inject large amounts of traffic into edge network infra, similar to MITM

==== Privacy issues in edge computing =====
# weak security techniques for system protection
# unsafe communication between devices
# difficult recovery and data backup
# no specific pattern of update reception
# lack of proper network visibility
# lack of user's selective data collection

==== Countermeasures for Fog Computing ====
;Efficient encryption techniques
:Allows for resource constrained edge devices to encrypt communcations with complex algorithms
;Decoy technique
:Authenticate data of user present the computing network by replacing original information with fake information that is provided to attackers
When breached, the attackers find the decoy files
;Intrusion detection system
:Detect and protect from attacks including DoS, insider attackers, port scanning attacks, flooding attacks on virtual machine, MITM
;Blockchain security for fog computing
:Blockchain is a way to cryptographically ensure the validity of a system while simultaneously increasing it's security. Using blockchain for edge computing reduces single point failure, increases network security and helps with tracking node status effectively.

==6.3 Security Protocols and Frameworks for Edge Systems==

To further illustrate the edge computer security concepts, we will give a couple of short case studies where edge
computing security plays a prevalent role, as well as some solutions:

===Securing Egyptian VMSs Smart City Infrastructure===
Over hundreds of thousands of these edge devices such as traffic sensors, surveillance cameras,
smart lighting systems, and environmental monitors are deployed in an urban Smart City. We
have on the `the city edge cloud' these instruments for real-time traffic flow management, public
safety alarm, environmental monitoring with life supports among the green plants – in the area
usually known as! This city suffered a massive blackout, when multiple traffic lights were compromised at the source which caused them to act irregularly: Not
issuing signals, leading to gridlocks.
====Challenges:====
How were the traffic controllers found to be vulnerable? Meaning they hack the password hole
punch so they can bypass the external username password and gain direct access to the temples
of our data. Moreover, on some cameras, the public IP of that camera is exposed, making remote
attack possible: it was obviously a disadvantage for them. The edge network stutters steps from
one organization to the next, making it hard however much one tries to apply security policy
uniformly, as whose department is solely responsible for a given thing?
====Solutions Introduced:====
;Net Separation
: The city designed its infrastructure with isolation zones; meaning traffic
systems are completely isolated from all other municipal services so if one zone is attacked all
other zones of that type remain intact.
;Password Overhaul
: Each unit was provided with a complete rehash to change its default
passwords and other weak credentials to hardened unique passwords. Remote administrative
access was only accepted with Multi-Factor Authentication.
;Embrace of a Zero Trust Model
: In this city, we employed a robust, Zero Trust model. A
central token service gives authorization to every device communication and does not assume
the inherent trust of devices.
;Firmware Handling
: The OTA management system required by installation ensures known
exploits like traffic light management are repaired when discovered. Firmware cannot be
updated at weaker sites as the assumption is it is regularly updated.
;AI-based IDS Deployment
: An AI-based IDS at a traffic control center learns about every
equipment normal behavior going on at this session (like how frequently commands are sent out
for lighting systems) generate alerts, activate promise lockdowns any time an abnormal behavior
appears Mechanisms for rapid dissemination throughout the city.
==== Outcome:====
As a result of the proactive settings, these attempts were quickly identified and contained, with a
limited impact on operations. For example, a virus event that targeted digital kiosks was
contained through micro-segmentation and AI detection mechanisms that quickly isolated and as
such quarantined the attack. It led to enhanced overall resilience of this intelligent city — its
citizens’ trust in IoT services is continually getting better.

=== IIOT (INDUSTRIAL IOT) IN MANUFACTURING===
The production floor of a manufacturing company has integrated an IIoT system that is edge-
based. Sensors associated with the machinery connect to edge gateways that track the health of
the equipment for predictive maintenance. One extreme incident involved the main assembly
robot producing inaccurate sensor readings that were altered, driving the robot to malfunction
and claim weeks of expensive downtime on production. This revealed the insertion of an
unauthorized device, a small single-board computer that was disguised as a sensor node and
which fed erroneous data back to the control system.
====CHALLENGES:====
Even though it was optimized for efficiency, the factory edge network didn't include a device
authentication protocol; attackers could access new sensors without the need for tight controls.
Ensuring up time and keeping operational was prioritized often at the expense of timely
application of security updates. Moreover, the presence of devices from many vendors further
complicated efforts to establish consistent security standards, and production engineers received
little training in cybersecurity best practices.
====SOLUTIONS IMPLEMENTED====
To solve these problems, stringent onboarding procedures were put in place: each sensor or
controller must now present a digital certificate signed by the organization before being allowed
onto the network. Any unknown device attempting to gain access is rejected and notification
alerts are immediately sent out to ensure the remedying of bogus sensors does not take place in
future.
Additionally, they created a blockchain ledger to monitor device identities and to log any
configuration changes over time. Every new addition or firmware update triggers a blockchain
transaction being recorded to guarantee the creation of an immutable audit trail that can be
reviewed by IT as well as OT (operational technology) teams increasing trust and accountability
between departments. They segmented their network by listener and gateway: your sensors only
talk to local gateway, and then your gateway only talks to central controls understanding that if
any one part is breached there are limitations to how much of your network is attacked. More
importantly, they rolled out an AI-powered detection system that monitored sensor readings for
abnormalities.
For known rogue sensors where outputs were statistically different from expected machine
behavior; it is likely that ML models would have picked up on this irregularity early enough to
allow for preemptive safety shutters before doing damage.In addition, maintenance processes
were revised to ensure that scheduled downtimes were regular intervals of time explicitly
dedicated towards security (for example, patching software vulnerabilities and routine
equipment calibration checks). Training of staff on basic cyber hygiene such as ensuring that a
USB drive or laptop was validated before connecting it into the organization edge networks have
reduced the threat of the organization network being infected by malware.
====OUTCOME====
Then after enhancements made at this facility had enabled quick identification of anomalies; The
next, an internal attempt by someone trying to connect using unauthorized monitoring tools was
quickly detected and blocked ensuring nothing could affect operations in our pursuit against
cyber-physical threats going forward. This includes how to properly secure our edges given their
unique properties tightly coupled with how data generation happens right at the host itself which
underlines an edge rather than left assume by further maintaining data access principles and
protocols as logs have significantly aided audits of compliance as well being fitted into our own
investigation processes during incidents reducing times taken before identifying potential
problems where an immutable changelog was adapted into the process itself. Key Takeaways –
Smart cities & IIOT factories share common challenges yet demonstrate needs for customized
solutions & technologies but also show similar trends including segmentation, authentication
continuous supervision Reacting quickly overcoming new challenges through advanced
technology tools - Artificial Intelligence& Blockchain technologies just to name a few.

==Citations==
Y. Xiao, Y. Jia, C. Liu, X. Cheng, J. Yu and W. Lv, "Edge Computing Security: State of the Art and Challenges," in Proceedings of the IEEE, vol. 107, no. 8, pp. 1608-1631, Aug. 2019, doi: 10.1109/JPROC.2019.2918437.
keywords: {Edge computing;Servers;Task analysis;Security;Cloud computing;Mobile handsets;Computer science;Smart phones;Internet of Things;Network security;Data security;edge computing;Internet of Things;network security},

Chapter 6: Edge Security and Privacy

2025-04-07T00:55:46Z

Ali Siddiqi: /* Citations */

Chapter 6: Edge Security and Privacy

2025-04-07T00:54:58Z

Ali Siddiqi:

Chapter 6: Edge Security and Privacy

2025-04-06T21:15:00Z

Ali Siddiqi: /* Authorization and Authentication Attacks */

Chapter 6: Edge Security and Privacy

2025-04-06T21:13:25Z

Ali Siddiqi: /* Malware Injection */

Chapter 6: Edge Security and Privacy

2025-04-06T21:13:03Z

Ali Siddiqi: /* Side-Channel Attacks */

Chapter 6: Edge Security and Privacy

2025-04-06T21:12:47Z

Ali Siddiqi: /* DDoS */

Chapter 6: Edge Security and Privacy

2025-04-06T21:12:24Z

Ali Siddiqi: /* 6.1 Overview of Security Challenges in Edge Computing */

Chapter 6: Edge Security and Privacy

2025-04-06T21:09:18Z

Ali Siddiqi: /* How are attackers able to perform these attacks? */

Chapter 6: Edge Security and Privacy

2025-04-06T19:19:34Z

Ali Siddiqi: /* How are attackers able to perform these attacks? */

Chapter 6: Edge Security and Privacy

2025-04-06T19:13:47Z

Ali Siddiqi: /* 6.1 Overview of Security Challenges in Edge Computing */

File:Dictionaryattack.png

2025-04-06T18:40:39Z

Ali Siddiqi:

Chapter 6: Edge Security and Privacy

2025-04-06T18:40:25Z

Ali Siddiqi: /* 6.1 Overview of Security Challenges in Edge Computing */

File:SQLinjectionattack.png

2025-04-06T18:23:52Z

Ali Siddiqi:

Chapter 6: Edge Security and Privacy

2025-04-06T18:23:31Z

Ali Siddiqi: /* 6.1 Overview of Security Challenges in Edge Computing */

File:Sidechannelattack.png

2025-04-06T17:52:08Z

Ali Siddiqi:

Chapter 6: Edge Security and Privacy

2025-04-06T17:51:48Z

Ali Siddiqi: /* 6.1 Overview of Security Challenges in Edge Computing */

Chapter 6: Edge Security and Privacy

2025-04-06T02:42:00Z

Ali Siddiqi: /* Side-Channel Attacks */

Chapter 6: Edge Security and Privacy

2025-04-06T02:41:09Z

Ali Siddiqi: /* Side-Channel Attacks */

Chapter 6: Edge Security and Privacy

2025-04-06T02:35:14Z

Ali Siddiqi: /* 6.1 Overview of Security Challenges in Edge Computing */

File:ZeroDayDDoS.png

2025-04-06T02:26:18Z

Ali Siddiqi:

Chapter 6: Edge Security and Privacy

2025-04-06T02:26:05Z

Ali Siddiqi: /* 6.1 Overview of Security Challenges in Edge Computing */

Chapter 6: Edge Security and Privacy

2025-04-06T02:17:30Z

Ali Siddiqi:

File:UDPFLOODING.png

2025-04-06T02:15:57Z

Ali Siddiqi:

Chapter 6: Edge Security and Privacy

2025-04-06T02:15:46Z

Ali Siddiqi: /* 6.1 Overview of Security Challenges in Edge Computing */

Chapter 6: Edge Security and Privacy

2025-04-06T02:13:39Z

Ali Siddiqi:

Chapter 6: Edge Security and Privacy

2025-04-06T02:13:08Z

Ali Siddiqi:

Chapter 6: Edge Security and Privacy

2025-04-06T02:12:59Z

Ali Siddiqi: /* 6.1 Overview of Security Challenges in Edge Computing */

File:DDoS-Botnet.png

2025-04-06T02:12:00Z

Ali Siddiqi:

Chapter 6: Edge Security and Privacy

2025-04-06T02:11:51Z

Ali Siddiqi:

File:Ddos-attack.jpg.webp

2025-04-06T02:08:46Z

Ali Siddiqi:

Chapter 6: Edge Security and Privacy

2025-04-06T02:08:26Z

Ali Siddiqi: /* DDoS */

Chapter 6: Edge Security and Privacy

2025-04-06T01:59:05Z

Ali Siddiqi: /* DDoS */

Chapter 6: Edge Security and Privacy

2025-04-06T01:58:26Z

Ali Siddiqi: /* 6.1 Overview of Security Challenges in Edge Computing */

Chapter 6: Edge Security and Privacy

2025-04-06T01:35:23Z

Ali Siddiqi: /* 6.4 Case Studies: Real-World Security Breaches */

==6. Edge Security and Privacy==

==6.1 Overview of Security Challenges in Edge Computing==
==='''yes'''===

==6.2 Data Privacy and Compliance in Edge Applications==

==6.3 Security Protocols and Frameworks for Edge Systems==

==6.4 Case Studies: Real-World Security Breaches==

Chapter 6: Edge Security and Privacy

2025-04-06T01:35:10Z

Ali Siddiqi: /* 6.3 Security Protocols and Frameworks for Edge Systems */

Chapter 6: Edge Security and Privacy

2025-04-06T01:34:51Z

Ali Siddiqi: /* 6.2 Data Privacy and Compliance in Edge Applications */

==6. Edge Security and Privacy==

==6.1 Overview of Security Challenges in Edge Computing==
==='''yes'''===

==6.2 Data Privacy and Compliance in Edge Applications==

=='''6.3 Security Protocols and Frameworks for Edge Systems'''==

=='''6.4 Case Studies: Real-World Security Breaches'''==

Chapter 6: Edge Security and Privacy

2025-04-06T01:34:40Z

Ali Siddiqi: /* 6.1 Overview of Security Challenges in Edge Computing */

==6. Edge Security and Privacy==

==6.1 Overview of Security Challenges in Edge Computing==
==='''yes'''===

=='''6.2 Data Privacy and Compliance in Edge Applications'''==

=='''6.3 Security Protocols and Frameworks for Edge Systems'''==

=='''6.4 Case Studies: Real-World Security Breaches'''==

Chapter 6: Edge Security and Privacy

2025-04-06T01:34:04Z

Ali Siddiqi: /* 6. Edge Security and Privacy */

==6. Edge Security and Privacy==

=='''6.1 Overview of Security Challenges in Edge Computing'''==
==='''yes'''===

=='''6.2 Data Privacy and Compliance in Edge Applications'''==

=='''6.3 Security Protocols and Frameworks for Edge Systems'''==

=='''6.4 Case Studies: Real-World Security Breaches'''==

Main Page

2025-04-06T01:32:45Z

Ali Siddiqi:

<span style="color: red;"> Please note that: </span>
* you can only create or edit a page when you are on campus or connected to the UM VPN.
* read this help page for formatting: [https://www.mediawiki.org/wiki/Help:Formatting Formatting]
* read this help page for user's guide: [https://www.mediawiki.org/wiki/Special:MyLanguage/Help:Contents User's Guide]

Consult the [https://www.mediawiki.org/wiki/Special:MyLanguage/Help:Contents User's Guide] for information on using the wiki software.

== Getting started ==
* [https://www.mediawiki.org/wiki/Special:MyLanguage/Manual:Configuration_settings Configuration settings list]
* [https://www.mediawiki.org/wiki/Special:MyLanguage/Manual:FAQ MediaWiki FAQ]
* [https://lists.wikimedia.org/postorius/lists/mediawiki-announce.lists.wikimedia.org/ MediaWiki release mailing list]
* [https://www.mediawiki.org/wiki/Special:MyLanguage/Localisation#Translation_resources Localise MediaWiki for your language]
* [https://www.mediawiki.org/wiki/Special:MyLanguage/Manual:Combating_spam Learn how to combat spam on your wiki]

== Structure of this WiKi ==

1. [http://www.edgecomputingbook.com/index.php/Edge_Cloud:_Bringing_Computing_Close_to_the_User Edge Cloud Demo] - Sample

2. [http://www.edgecomputingbook.com/index.php/Chapter_1:_Edge_Computing Edge Computing Chapter 1] - Reference Sample

1. [http://www.edgecomputingbook.com/index.php/Introduction_to_Edge_Computing Introduction to Edge Computing] (Vrunda Kadam, Aayush Chopra, and Riya Pawar)

1.1 [http://www.edgecomputingbook.com/index.php/Introduction_to_Edge_Computing#1.1_What_is_Edge_Computing? What is Edge Computing?]

1.2 [http://www.edgecomputingbook.com/index.php/Introduction_to_Edge_Computing#1.2_Why_we_need_Edge_Computing? Why We Need Edge Computing?]

1.3 [http://www.edgecomputingbook.com/index.php/Introduction_to_Edge_Computing#1.3_Edge_Computing_application_Domains_and_Typical_Applications Edge Computing Application Domains and Typical Applications]

1.4 [http://www.edgecomputingbook.com/index.php/Introduction_to_Edge_Computing#1.4_Different_Edge_Computing_Paradigms Different Edge Computing Paradigms ]

2.[http://www.edgecomputingbook.com/index.php/User:Farhan#Edge_Computing_Architecture_and_Layers Edge Computing Architecture and Layers (Amit Saha, Md Eleus, Farhan Tanvir)]

2.1 [http://www.edgecomputingbook.com/index.php/User:Farhan#1.1_IoT,_Mobile,_and_Digital_Twins IoT, Mobile, and Digital Twins]

2.2 [http://www.edgecomputingbook.com/index.php/User:Farhan#1.2_Cloud Cloud]

2.3 [http://www.edgecomputingbook.com/index.php/User:Farhan#1.3_Edge_and_Fog Edge and Fog]

2.4 [http://www.edgecomputingbook.com/index.php/User:Farhan#1.4_Edge-Cloud_Continuum Edge-Cloud Continuum]

3.[http://www.edgecomputingbook.com/index.php/Edge_Computing_Products_and_Frameworks Edge Computing Products and Frameworks (Ashwin Alinkil, Jasmine Rabie, Nate Pierce, Brian Retterer)]

3.1 [http://www.edgecomputingbook.com/index.php/Edge_Computing_Products_and_Frameworks#3.1_Industry_Products:_AWS_as_an_Example Industry Products: AWS as an Example]

3.2 [http://www.edgecomputingbook.com/index.php/Edge_Computing_Products_and_Frameworks#3.2_Open_Source_Frameworks Open Source Frameworks]

3.3 [http://www.edgecomputingbook.com/index.php/Edge_Computing_Products_and_Frameworks#3.3_Serverless_at_the_Edge Serverless at the Edge]

4.[http://www.edgecomputingbook.com/index.php/Machine_Learning_at_the_Edge Machine Learning at the Edge] (Vlad Nitu, Joel Henry Arun, Ciaran Grabowski, and Haneen Syed)

4.1 [http://www.edgecomputingbook.com/index.php/Machine_Learning_at_the_Edge#4.1_Overview_of_ML_at_the_Edge Overview of ML at the Edge]

4.2 [http://www.edgecomputingbook.com/index.php/Machine_Learning_at_the_Edge#4.2_ML_Training_at_the_edge ML Training at the Edge]

4.3 [http://www.edgecomputingbook.com/index.php/Machine_Learning_at_the_Edge#4.3_ML_Model_Optimization_at_the_Edge ML Model Optimization at the Edge]

5. Federated Learning (Manoj Alexander, Ram Kumar Ippili, Sai Revanth Iddum, and Chakradhar Nidujuvvi )

6.[http://www.edgecomputingbook.com/index.php/Chapter_6:_Edge_Security_and_Privacy Edge Security and Privacy] (Nitin Madhu, Ali Siddiqi, Jyotsana Sharma, Vedant Patel)

6.1 [http://www.edgecomputingbook.com/index.php/Chapter_6:_Edge_Security_and_Privacy#6.1_Overview_of_Security_Challenges_in_Edge_Computing Overview of Security Challenges in Edge Computing]

6.2 [http://www.edgecomputingbook.com/index.php/Chapter_6:_Edge_Security_and_Privacy#6.2_Data_Privacy_and_Compliance_in_Edge_Applications Data Privacy and Compliance in Edge Applications]

6.3 [http://www.edgecomputingbook.com/index.php/Chapter_6:_Edge_Security_and_Privacy#6.3_Security_Protocols_and_Frameworks_for_Edge_Systems Security Protocols and Frameworks for Edge Systems]

6.4 [http://www.edgecomputingbook.com/index.php/Chapter_6:_Edge_Security_and_Privacy#6.4_Case_Studies:_Real-World_Security_Breaches Case Studies: Real-World Security Breaches]

7. [http://www.edgecomputingbook.com/index.php/Emerging_Research_Directions Emerging Research Directions (7.1~7.3: Erika Valle-Baird, Mohamed Aboulsaad, Matthew Kwan)]

7.1 [http://www.edgecomputingbook.com/index.php/Emerging_Research_Directions#7.1_Task_and_Resource_Scheduling Task and Resource Scheduling]

7.2 [http://www.edgecomputingbook.com/index.php/Emerging_Research_Directions#7.2_Edge_for_AR/VR Edge for AR/VR]

7.3 [http://www.edgecomputingbook.com/index.php/Emerging_Research_Directions#7.3_Vehicle_Computing Vehicle Computing]

7.4 [http://www.edgecomputingbook.com/index.php/Emerging_Research_Directions#7.4_Energy-Efficient_Edge_Architectures Energy-Efficient Edge Architectures (Zaid Ghazal, Matthew Correa)]

7.5 [http://www.edgecomputingbook.com/index.php/Emerging_Research_Directions#7.5_Data_Persistence Data Persistence (Warren Lazarraga)]

8. [http://www.edgecomputingbook.com/index.php/Applications_of_Edge_Computing Applications of Edge Computing: Underwater Internet of Things (UIoT)]

8.1 [http://www.edgecomputingbook.com/index.php/Applications_of_Edge_Computing#8.1_Introduction_to_UIoT_and_AUVs Introduction to UIoT and AUVs]

8.2 Edge Computing for AUVs: Benefits and Necessity

8.3 Key Challenges in Applying Edge Computing to AUVs

8.4 State-of-the-Art Edge Computing Solutions

8.5 Future Research Directions

9.Conclusion and Future Outlook (cannot be chosen by students)

Chapter 6: Edge Security and Privacy

2025-04-06T01:30:15Z

Ali Siddiqi: /* yes */

=='''6. Edge Security and Privacy'''==

=='''6.1 Overview of Security Challenges in Edge Computing'''==
==='''yes'''===

=='''6.2 Data Privacy and Compliance in Edge Applications'''==

=='''6.3 Security Protocols and Frameworks for Edge Systems'''==

=='''6.4 Case Studies: Real-World Security Breaches'''==

Chapter 6: Edge Security and Privacy

2025-04-06T01:29:56Z

Ali Siddiqi: /* yes */

=='''6. Edge Security and Privacy'''==

=='''6.1 Overview of Security Challenges in Edge Computing'''==
=='''yes'''==

=='''6.2 Data Privacy and Compliance in Edge Applications'''==

=='''6.3 Security Protocols and Frameworks for Edge Systems'''==

=='''6.4 Case Studies: Real-World Security Breaches'''==