Cyber Security Threat Modeling of IoT Security Design Patterns

The role of threat modeling and attack simulation has become more prominent for information technology as well as operational technology due to the increasing number of cyber attacks on existing entities. Different constituents of IoT (like devices, services, users, etc.) are playing a crucial role in providing data to operational technologies such as industrial control systems, remote terminal units, transportation, healthcare, water treatment usages, etc. The constituents of IoT technology require in-depth analysis and design elements to model the possible threats beforehand and work upon the domain-specific vulnerabilities. In this study, a threat modeling framework is proposed to analyze the pattern-based solution for an IoT use case i.e., IoT security patterns. The pattern-based solutions are often specified by using UML Language, that is not a fully formal language. The semi-formal approach requires a thorough analysis. The presented threat modeling framework can identify hidden insecure issues and provides rigorous analysis, which are not found in security pattern notation. The proposed framework is based on a metamodling approach. A specific use case of IoT in the domain of health care is considered to analyze the efficacy of the proposed framework.