About this previous year paper
SECTION A — Very Short Answers (2 Marks Each)
a. IoT vs Traditional IT Security Requirements
IoT: resource-constrained, heterogeneous, large scale
Traditional IT: centralized, high computing power, fewer devices
b. Significance of Access Control in IoT Prevents unauthorized device/user access
Ensures data confidentiality and system integrity
c. Asymmetric Encryption in IoT
Advantages Secure key distribution
Strong authentication
Limitations High computational overhead
Not ideal for low-power devices
d. Role of Hash Functions in IoT Ensures data integrity
Supports authentication and message verification
e. Identity Lifecycle in IoT vs Traditional IAM
IoT identities are dynamic, device-centric, and large-scale
Traditional IAM is user-centric and static
f. Secure Storage of Credentials Hardware security modules (HSM)
Secure enclaves Encrypted key storage
g. Regulatory Frameworks in IoT Privacy Enforce data protection laws
Ensure user consent and accountability
h. Privacy in Resource-Constrained Devices Use lightweight cryptography
Edge processing Minimal data collection
i. Cloud-Enabled IoT Security Challenges Data leakage
Weak encryption Shared infrastructure risks
j. Cloud Provider Security Controls Identity management
Encryption services Monitoring and compliance tools
SECTION B — Analytical / Conceptual Answers (10 Marks)
a. Transport Encryption in IoT Uses TLS/DTLS
Protects data in transit Mitigates eavesdropping and MITM attacks
b. Cryptographic Controls in IoT Protocols
Authentication Encryption
Integrity checks Enhances secure communication
c. Identity Federation in IoT Enables cross-platform authentication
Improves scalability and interoperability
d. Privacy Schemes for Wearable Sensor Networks
Lightweight encryption Anonymization
Energy-efficient protocols
e. Blockchain for Cloud-Based IoT
Benefits Decentralization
Data immutability
Challenges Scalability
High energy consumption
SECTION C — Privacy & Fault Tolerance (10 Marks)
a. IoT vs Traditional Privacy Concerns IoT collects continuous, real-time personal data
Higher privacy risk in healthcare & smart homes
b. Fault Tolerance in IoT Security Maintains system availability under attacks
Attack trees help identify vulnerabilities and countermeasures
SECTION D — Cryptography in IoT (10 Marks)
a. Random Number Generation (RNG) Critical for key generation
Uses hardware RNGs, entropy sources Ensures unpredictability
b. Key Management in IoT Key generation, distribution, rotation
Lightweight key exchange protocols Secure communication among nodes
SECTION E — Access Control & Identity (10 Marks)
a. RBAC vs ABAC in IoT
| RBAC | ABAC |
|---|---|
| Role-based | Attribute-based |
| Static | Dynamic |
| Less flexible | More scalable |
ABAC is better for dynamic IoT environments
b. IoT Identity & Privacy
Identity links devices to users
Privacy-enhancing technologies reduce tracking and profiling
SECTION F — Privacy Preservation (10 Marks)
a. Consumer IoT vs Industrial IoT Privacy
Consumer IoT: personal data, user privacy Industrial IoT: operational secrecy, IP protection
b. Privacy-Preserving Data Dissemination
Data anonymization Secure aggregation
Challenges: scalability, latency
SECTION G — Cloud & IoT Security (10 Marks)
a. Multi-Tenancy in Cloud IoT
Shared infrastructure increases attack surface
Isolation via virtualization, access control
b. Cloud Models for IoT
| Model | Security Aspect |
|---|---|
| Public | Cost-effective, less control |
| Private | High security, costly |
| Hybrid | Balanced approach |