Industrial Internet of Things Ecosystems Security and Digital Forensics: Achievements, Open Challenges, and Future Directions

1 INTRODUCTION

For the past decade, the Internet of Things (IoT) has been embraced as a futuristic concept with a diverse focus cutting across numerous domains of information and communication technology (ICT) [1]. This trend has always been characterized as both a disruptive technology and a major player in the provision of effective services and communication. Indeed, the influence of the IoT has been felt across many application domains [2]. The emergence of Industry 4.0, with its focus on automation and manufacturing technologies, has acted as an enabler of cyber-physical systems (CPS) and the IoT [3, 4]. The major sectors that have benefited as a result of IoT proliferation include transport systems, healthcare, home automation systems, smart cities, and autonomous vehicles [5]. Industry 4.0 has the potential to optimize logistics, automation of equipment, smart manufacturing techniques, the IoT, and cloud systems. Additionally, while the number of IoT devices in use has increased, a more pertinent issue is the integration with CPS, as supported by various vendors and providers of IoT-based platforms. This has led to the development of IoT-based ecosystems that are mainly composed of “things” and service providers who ensure interoperability across IoT-based environments [6].

Leveraging the IoT to realize industrial tasks centered on Industry 4.0 goals such as smart transportation, smart manufacturing, smart energy management, service, and automation, constitutes the Industrial IoT (IIoT). In this context, the domain of the IIoT ranges from machine-to-machine (M2M) applications to the dynamics of industrial communication [7, 8]. Notably, the relevance of exploring IIoT ecosystems and their constituents is intended to propel Industry 4.0 objectives by operationalizing technology across diverse information technology domains [7]. The ultimate goal is for devices to become pervasive, as the majority of IoT-based devices possess powerful computing capabilities.

IIoT ecosystems play a significant role in collaborative communication as a means of achieving the desired Industry 4.0 objectives. For example, IIoT ecosystems have a consistent need for reliable application-centric processes as far as digital connectivity and data decisions are concerned. This is because the realization of day-to-day Industry 4.0 strategies requires a more secure and resilient approach during inter-process communication. It should be noted that IIoT ecosystems have also led to the diffusion of heterogeneous environments over which massive data and applications are exchanged on a daily basis, with little regard to safety and other ramifications.

While the IIoT spectrum has seen significant diversification through the emergence of prolific ecosystems, it is worth noting that critical aspects such as emerging configurations, applications, and resource migration have not been able to match the ever-changing IoT landscape. Regardless, to ensure the security of IIoT ecosystems, it is vital to enforce continuous, effective, and secure communication, given that both the IIoT and Industry 4.0 have the objectives of robustness, scalability, and security. Consequently, the current IIoT requirements and technological advances geared toward realizing Industry 4.0 goals have created the need to enforce secure communication and post-incident response strategies as a means of achieving secure, efficient, and reliable industrial processes. Sengupta, Ruj, and Bit [9] identified several security limitations that are still yet to be overcome. While there is a large body of literature focused on the IIoT as a whole, our study is entirely focused on the security and digital forensics aspects of the IIoT, which in our view pose serious research challenges. The IIoT is a novel and still emerging phenomenon, and given the structural and dynamic complexity involved in the integration of IIoT systems, there exist many unknown vulnerabilities and attacks, and there is a limited range of digital forensic processes, methodologies, and tools that can be used to address attribution problems in digitized IIoT ecosystems. The uniqueness of the present survey lies in its integrated consideration of both security and digital forensics.

1.2 Contributions

Various previous studies have considered the IIoT and security [15, 16, 17, 18, 19, 20, 21, 22, 23], but at present, no significant research results are available that provide guidance on how to evaluate the security and digital forensics ramifications of the interplay between OT and IT associated with the proliferation of the IIoT. To address these challenges, this article presents a comprehensive review of security and digital forensics in IIoT ecosystems. The main contributions of this article can be summarized as follows:

–	First, this study provides an in-depth analysis of relevant research on IIoT ecosystems from the perspectives of security and digital forensics. We identify and address pertinent research limitations in IIoT ecosystems by highlighting the relevant security requirements, weaknesses in the IIoT, and the present state of protocols, architectures, and standards, as well as proposing ways to strengthen these technologies.
–	From a holistic viewpoint, this study illustrates the key IIoT security achievements with the actualization of Industry 4.0. In particular, we explore key management strategies, edge and fog security, and the essence of the blockchain.
–	While this study has a strong emphasis on the realization of the IIoT and its impact, we also explore state-of-the-art studies in IIoT forensics and identify several key challenges.
–	We explore open problems in security and digital forensics and discuss possible high-level solutions. Finally, we provide a contextual evaluation of this study and identify avenues for future work.

The remainder of this article is structured as follows: Section 2 provides an overview, describing the scope of the present study, as well as related work with regard to the IIoT. This is followed by an explanation of IIoT ecosystems in Section 3. An overview of IIoT security, including security requirements, security weaknesses, and security standards, is presented in Section 4. Cutting-edge research results on the security of the IIoT are reported in Section 5. This is followed by a presentation of state-of-the-art investigations in IIoT forensics in Section 6. Open challenges are discussed in Section 7. Finally, future directions and conclusions are summarized in Sections 8 and 9, respectively. An overview of the entire article in terms of sections, subsections, and main concepts is shown in Figure 1.

Fig. 1.

View Figure

2 SCOPE AND RELATED WORK

The scope of this study is determined by the assumption that the amalgamation of IoT-based techniques with industrial processes represents the realization of a smart manufacturing concept, herein referred to as Industry 4.0. Within the context of Industry 4.0, connected devices and processes are automated in a fashion that enables them to realize quick and efficient production. Although the concepts of the IoT, the IIoT, and Industry 4.0 may not be used interchangeably [7], we explore relevant studies in all three areas, with the aim of identifying gaps that exist in research on the security and digital forensics of IIoT ecosystems. Table 1 summarizes previous surveys of security and digital forensics relevant to the IoT, the IIoT, and Industry 4.0 [15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28]. Note that the current study mainly considers the IoT and IIoT; however, where necessary, Industry 4.0 is referenced. The uniqueness of this research stems from the fact that it explores security achievements, the need for application-specific standards, IIoT-enabling technologies, and proactive and reactive digital forensic models that are tailored to post-event response strategies in IIoT ecosystems.

Boyes et al. [28] highlighted the relevance of the IIoT and associated relationships and concepts, such as CPS and Industry 4.0. They also presented a framework for analyzing the IIoT and an IoT-based taxonomy for enumerating and characterizing the IIoT while exploring security threats, vulnerabilities, and system architectures. As noted by Oztemel and Gursev [25], Industry 4.0 is part of the smart networked environment and an enabler of real-time CPS. It is also responsible for the management of complex systems, where safety and security are key to successful implementation. It has been shown that Industry 4.0 has a disruptive impact on companies, where it is seen as a threat to the security of conventional centralized technologies [24]. Other research with a focus on IoT/IIoT has illustrated the effects of various types of attacks, such as software attacks that exploit hardware vulnerabilities in IIoT. While such studies have explored malicious attack vectors in the IoT/IIoT, reactive forensics techniques have received little attention. Existing attack models and architectures have been comprehensively examined [26] alongside further assessment of the challenges related to secure application design in the IoT. While this research has identified essential approaches in the IIoT, post-incident response strategies have not been considered, although secure strategies that can be adopted have been listed as key aspects. In identifying the challenges and opportunities facing the development of a secure IIoT, the component lifespan and number of devices needed for deployment, configuration, and management of the IoT and IIoT, as well as IT/OT and human-centered factors that affect the IIoT, have been investigated in detail [29]. This research has suggested the IIoT is at greater risk of attack compared with the consumer IoT. In addition, the challenges in supervisory control and data acquisition (SCADA) forensics have been highlighted as a lack of forensic models and tools, a lack of live forensics, volatility in memory, limited logging, and challenges associated with current forensic tools [30]. In our opinion, these shortcomings exacerbate the security and forensic challenges addressed in this survey.

This article presents a comprehensive review of state-of-the-art studies on the IIoT from the perspective of security and digital forensics. Table 1 lists previous relevant review articles, indicating the scope and main focus of each one. The ultimate aim of the present study is to address the essential aspects of secure communication and post-event response strategies in IIoT ecosystems while highlighting the remaining challenges according to the layered architecture in Figure 2. The scope and focus of previous studies, as shown in Table 1, illustrate the intricacies that determine the success or failure of an IIoT ecosystem. From a security perspective, the present review focuses explicitly on the intrinsic existence, resilience, and robustness of IIoT ecosystems. It should also be noted here that the variations in the scope of previous studies demonstrate the propensity for inconsistencies in the definition of IIoT ecosystems.

Fig. 2.

View Figure

Overall, previous studies have not comprehensively considered digital forensics in the context of the IIoT, owing to the limitations of the standard methodologies and tools for conducting digital investigations on the IIoT. As a consequence, there remain longstanding security and digital forensics challenges, which are being exacerbated by digital proliferation and integration (see Table 1). This study differs from previous work in its extensive exploration of both proactive and reactive approaches in IIoT ecosystems. Notably, it provides an extended scope that, through contextualized descriptions, is able to show the impact of fusing specific emergent technologies.

3 IIoT Ecosystems

The context of the IIoT, although dynamic, is based on the interrelationship of components and communication, and the diversification, proliferation, and interoperability mechanisms of the constituent parts. There are different views of what constitutes an IIoT ecosystem. We consider an IIoT ecosystem to be a fusion of technologies that utilizes process automation approaches to achieve efficient manufacturing strategies [31]. Through a coordinated approach, IIoT tasks incorporate network augmentation, IoT-based applications, and CPS to enhance convenience, efficiency, and personalization of tasks [32, 33]. Figure 2 shows the layered architecture of the IIoT, including potentially vulnerable layers. For example, the perception layer is vulnerable to node capture attacks, timing attacks, eavesdropping, encryption, and key agreement. The network layer is vulnerable to integrity, confidentiality, and availability attacks. The control layer, however, is tasked with controlling the physical systems and processes in the industrial environment. It consists of control algorithms, industrial equipment management, SCADA systems, distributed control systems (DCS), programmable logic controllers (PLCs), human-machine interface (HCI), and maintenance actions. The control layer can be vulnerable to active adversarial attacks in control algorithms [34, 35], infrastructure attacks [36], and integrity attacks, while the application layer has vulnerabilities based on cloud security and encryption strategies [37]. It is worth noting that security vulnerabilities span more layers of other IIoT architectures. For instance, in the IIoT five-layer architecture, the key agreement strategies introduce vulnerabilities in the business layer [20]. This study focuses on the vulnerabilities introduced in the basic three-layer IIoT architecture.

The fusion of IoT processes with industrial processes supports the digital ubiquity and automation of advanced robotic techniques, edge computing, smart industries, the application of machine learning technologies, and the leveraging of CPS and IoT-based techniques. These trends are intended to digitize and propel the Industry 4.0 transformation. In the context of this article, Industry 4.0 is taken as an already-realized revolutionary industrial technology that relies on digital technology to achieve its objectives (e.g., real-time access to data of CPS, the IoT, and the IIoT), while Industry 4.0 transformation is taken to depict an umbrella revolution with continuously emerging technologies and concepts that allow key objectives to be realized. The overarching objective is to guarantee process automation and data exchange across manufacturing systems with the support of technologies such as artificial intelligence (AI), cognitive processing, and cloud computing [31]. While IIoT and M2M applications are envisioned as the enablers of Industry 4.0 [38], the IIoT ecosystem requires the backing of fused technologies for smart industries or Industry 4.0 for its full realization.

According to Schmid et al. [39] and Broring et al. [40], an ecosystem is a cross-platform, cross-standard, and cross-domain entity that provisions IIoT services and applications. By contrast, Mazhelis, Luoma, and Warma [41] see it as the interconnection of a global network with a service infrastructure that has a self-configuration capability over interoperable protocols with a number of roles [42]. Similarly, Westerlund, Leminen, and Rajahonka [43] view an IIoT ecosystem as having techno-economic as well as human-centric aspects that play a significant role in determining what things do within a connected environment [43]. Delicato et al. [44] perceive an ecosystem to be able to integrate heterogeneity to realize real-time data collection and control mechanisms with the visualization, processing, and storage of data. It is thus evident that an ecosystem is dependent on resources, technologies, platforms, standards, and processes. Madaan, Ahad, and Sastry [45] suggest that for an IoT ecosystem, such as a smart home, the acquired data that are aggregated to guarantee quality of service are of critical importance [46, 47].

Consequently, an IIoT ecosystem’s objective is centered on optimizing production processes through monitoring and analysis while targeting effective outcomes [45]. From the perspective of processing, this is a reflection of how future supply chains will operate as a result of the integration of information systems with operational processes in factories [48]. Other pertinent existing research illustrates that IIoT ecosystems co-exist with smart technologies, where a pool of network devices collaborate to extract and share digital data with the ultimate goal of boosting production [49]. On a similar note, the need for a dynamically digitized IIoT ecosystem has been highlighted by Skwarek [50], in which the digitization of industrial processes is subsumed into smart entities for the purpose of creating a highly dynamic reconfiguration of production processes.

The core foundation on which IIoT ecosystems thrive has been attributed to CPS. This is mainly due to the capability of CPS to monitor and control physical processes, which ultimately forms the basis for smart factories [23]. The relevance of this is that smart factories can dynamically arrange and optimize processes while processing the generated data [51, 52]. Mazhelis, Luoma, and Warma [41] portrayed an ecosystem as a hub-centered structure created on an IoT-based setup, which can also be viewed as a business ecosystem [53, 54]. This forms part of what constitutes the day-to-day use of the IoT and its application as services to be provisioned. For example, the movement of data and normal services can easily be strengthened and trust increased by leveraging the blockchain [55, 56]. Other uses include software-defined networks (SDNs) [57], event management for IIoT ecosystems [53], digital construction to transform expectations with the emergence of Industry 4.0 [58], and crowd-sensing techniques for enhancing data processes and agility [59].

4 IIoT Security: Overview

The transition from conventional and proprietary-based communication techniques to industrial automation processes represents a paradigm shift. In the current state-of-the-art, ecosystems embrace IoT environments that connect to smart environments, relying on sensors, actuators, timely controllers, and SCADA services [38]. This aspect of system digitization in readiness for Industry 4.0 requires secure technologies and standards. Furthermore, this integration opens up a threat landscape, with increased vulnerabilities that, from a security perspective, could lead to attacks on smart factories and compromise production processes [23, 74]. In this section, we explore the security requirements of IIoT ecosystems, weaknesses in the IoT and IIoT, and the state of the protocols, security architectures, and standards employed in the IIoT.

4.4 State of IIoT Protocols

Assessments of the security of IIoT connectivity protocols stem from the need to explore the suppositions that underlie the digitization of industrial processes. This subsection explores the state of the wireless technologies that support IIoT ecosystems, as summarized in Table 6 and Figure 3, which shows the IIoT protocols with the respective parts of the open systems interconnection (OSI) reference model.

Table 6.

Reference	Protocols	Focus	Significance to IIoT Ecosystems
[104]	MQTT	Offers support to data exchange	Suitability due to its lightweight nature
[65]	CoAP	Enables constrained devices to communicate with the Internet	Dedicated communication in the IIoT infrastructure
[65]	MoDBUS:TCP	Shows its suitability in control and monitoring	Can be used in monitoring across IIoT environments
[105]	Zigbee	Role played by its variants	Supports cryptographic transmission
[108]	NB-IoT	Connects devices to the IoT	Compatible with low power and reduced data rates
[105]	LoraWAN/6LowPAN	How information secrecy can be enhanced	Encryption and decryption could enhance secrecy in the IIoT
[113]	IEEE 802.15.4	Operation for LoraWAN and basis for Zigbee	Provides general IIoT connectivity
[114]	WirelessHART	HART is an open and realizable protocol for WSN	HART is suitable for industrial automation

View Table

Table 6. Summary of Current IIoT Communication Protocols

Fig. 3.

View Figure

5 IIoT Security Achievements

Given that the realization of Industry 4.0 is dependent on innovative technological developments, this section assesses the state of IIoT-enabling technologies based on the approaches outlined in the Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege (STRIDE) model [124]. STRIDE offers a unique approach to assessing threats and vulnerabilities (known and unknown) within IIoT ecosystems, resulting in a threat roadmap. This section concentrates on describing the key security achievements that have been realized in the IIoT as a result of the STRIDE model.

5.1 Key Management in IIoT

A lightweight key exchange (LKE) for Industry 4.0 solves the problem of illegitimate nodes in the IIoT. The key provides an assurance of mutual authentication across nodes through a secret key exchange, which is safe for the IIoT [125]. Other key exchange protocols include lightweight authentication for M2M communication in the IIoT based on hash and XOR tasks to target MITM and replay attacks [38], and a lightweight protocol for IIoT that is implemented via the MQTT protocol [126]. With this approach, MQTT is a suitable protocol for the industrial domain.

The key strategies that can be used to evaluate which security techniques offer protection for MQTT are as follows: payload encryption with the authenticated encryption scheme (AES), payload authentication with AES, payload-authenticated encryption with AES-offset codebook mode (AES-OCB), and link-layer encryption with AES, where it is possible to measure the latency between the publishing and processing times. A lightweight certificateless signature scheme for IIoT environments provides data authenticity [127], while an SDN-enabled multi-attribute method for secure communication over the smart grid of the IIoT monitors network traffic and dynamic routing [128]. A faster authentication key with perfect forward secrecy for the IIoT based on hash and XOR operations has been developed [129], and an interactive multifactor authenticated key exchange for IIoT invokes password hardening and exposes the attacker [130].

The key management approach shown in Figure 4 focuses on information retrieval and provides a robust means of supporting digital and textual searches in IIoT environments. The key management scenario shown in Figure 4 depicts a typical key management approach in an IIoT ecosystem. In this scenario, an IIoT operator requests a service provision from an IIoT service provider (Step 1). The key distribution center (KDC) manages the encryption keys (Step 2). The KDC communicates with a cloud key management center (Step 3) to exchange and manage encryption keys. To ensure that the KDC can be integrated with the IIoT application processes, the KDC integration must be done (Step 4). Once the KDC integration is complete, the IIoT user can request processes from the cloud key management center (Step 5). The cloud key management center generates a response (Step 6) and provides the necessary encryption keys to the KDC as presented in Figure 4.

Fig. 4.

View Figure

Using a hybrid keyword field search key management (HKFS-KM) scheme, this approach supports trapdoor unlinkability and drastically reduces the costs associated with key storage while supporting key revocation to guarantee secure IIoT records [131]. A study by Yasmine et al. [132] identified security weaknesses in authentication and key management during data transmission in the IIoT. The major security flaws were identified as replay attacks, DoS attacks, mutual authentication, and session key agreement. A mutual authentication scheme was proposed, but this does not support heterogeneous WSN environments. Zhou et al. [133] found that compromising devices to extract secret keys is still a challenge in IIoT communication, especially in side-channel attacks. Key weaknesses include IIoT key management, devices not embedded with cryptographic keys, IoT devices being easily attackable, and the resource constraints of IoT devices. A summary of key management approaches is presented in Table 8.

Table 8.

Reference	Focus	Significance to IIoT ecosystems
[38]	Lightweight authentication for M2M communication in the IIoT	Targets man-in-the-middle attacks on the IIoT
[125, 126]	Lightweight authentication support for the IIoT	Discusses MQTT, SDN, and other M2M support protocols in the IIoT
[127]	Lightweight certificateless signature scheme in the IIoT	Provides data authenticity
[128]	SDN-enabled multi-attributes for secure IIoT	Monitors traffic and offers dynamic routing
[129]	Authentication-based perfect forward secrecy in the IIoT	Uses XOR and hash to guarantee secrecy
[130]	Interactive multi-factor authentication in IIoT	Has password hardening and attacker exposure
[131]	Key management for textual search in the IIoT	Guarantees trapdoor unlinkability and privacy
[132]	Weaknesses in authentication and key management	Mutual authentication and session key agreement suggested
[133]	Device compromising with compromised keys	Identifies devices that are not embedded with cryptographic keys

View Table

Table 8. Summary of State-of-the-art Studies on Key Management in IIoT Ecosystems

5.2 Blockchain Technology in IIoT

While streamed sensor data can be extracted in real-time from IIoT environments, it is important to have a guarantee that these data are secure. The blockchain offers a precise distributed immutable ledger that allows for stronger security through the creation of a computationally infeasible cryptographic block of hashes. A scenario for implementing the blockchain in IIoT is shown in Figure 5. In the scenario depicting blockchain in IIoT shown in Figure 5, the IIoT ecosystem comprises the perception layer, network layer, control layer, blockchain service layer, and application layer, each of which is associated with various IIoT domains such as manufacturing, robotics, and mining. The blockchain service layer comprises three key components, namely, blockchain service support, smart contract, and transaction management, which together provide the necessary functionality to enable secure and decentralized data sharing, auditing, and trust among IIoT stakeholders. Moreover, the blockchain service layer is connected to a blockchain network comprising both on-chain and off-chain blockchain networks. The on-chain network is secured by verifier nodes [134, 135], which are responsible for validating transactions and maintaining the integrity of the blockchain.

Fig. 5.

View Figure

A blockchain scheme for collecting and sharing data in a multi-agent environment that combines Ethereum and deep learning techniques with a focus on achieving reliability has been proposed [136], but the mining nodes in this scheme are not intelligent. A truly fair non-repudiation blockchain scheme for IIoT has been developed as a service proxy for recording interactive evidence for providers in the IIoT. This technique has been verified using a homomorphic approach, but it has not yet been deployed in a real network-enabled IIoT platform for practical evaluation [137]. Current blockchain techniques are compared in Table 9. Studies using the blockchain have focused on IIoT access to equipment and power consumption, where the blockchain is deployed in high-performance systems to improve smart factory processes. For instance, a sharding–hashgraph technique that divides blockchain nodes has been employed for the purposes of optimization [138].

Table 9.

Reference	Focus	Significance for IIoT ecosystems
[136]	Scheme for collecting and sharing data	Discusses how data can be shared in a multi-agent environment using machine learning
[139]	Use of credit consensus in the IIoT	Discusses how the consensus protects data confidentiality and access control
[140]	How scalability is achieved	Discusses how lack of energy efficiency and lack of standards hinders the IIoT
[141]	How blockchain can give security assurance	Discusses resource efficiency, secrecy, and maintenance of tasks using blockchain
[137]	Non-repudiation scheme for the IIoT	Service proxy that records interactive evidence for providers
[142]	Blockchain framework for the IIoT	Identifies zero-knowledge transactions for security purposes

View Table

Table 9. Summary of State-of-the-art Research on Blockchain Applications in IIoT Ecosystems

A secure blockchain approach that uses the credit consensus technique in IIoT has been established to protect data confidentiality. This method uses a directed acyclic structured blockchain with data access control, which decreases power consumption for genuine nodes while increasing power consumption for malicious nodes. However, the detection of malicious nodes requires further investigation [139]. Blockchain applications targeting Industry 4.0 face issues concerning scalability (given that blockchain computations require significant resources), inherent blockchain vulnerabilities, energy, and cost efficiency, and the absence of industrial standards and regulations [140]. Other relevant research has examined the integration of blockchain and edge frameworks for IIoT, addressing latency, resource efficiency, security, and monitoring of tasks, but neglecting system performance [141]. A blockchain-enabled framework for IIoT would face challenges involving zero-knowledge transactions, standardization, security, and privacy [142]. Generally, the blockchain offers a suitable mechanism for securing IoT transactions based on its characteristics of decentralization, effectiveness, transparency, and immutability [143].

5.3 Edge and Fog Security in IIoT

While edge computing is popular at present, its focus is on reducing the volume of transmitted data. Its current integration with the IIoT has intensified security threats related to data [144]. A substantial number of vulnerabilities occur in the fog layer as a result of data and IIoT application migration. One example is a malicious attack from the edge to the communication network, where machine learning strategies are preferred for purposes of defense. Major vulnerable points include attacks on fog nodes/adversarial manipulations during the provisioning of real-time services, authentication of identities, leakages of sensitive data at IIoT edge nodes due to limited storage, difficulties in processing data, complexity of edge computing IIoT networks, and the problem of sharing and searching encrypted data [100].

Figure 6 shows a scenario depicting edge and fog in IIoT. It consists of a perception layer where data is gathered and authenticated. This layer is followed by the edge gateway, which serves as the entry point for data into the fog layer. The fog layer controls encryption, key management, data storage, and data processing. The cloud layer provides additional storage and processing capabilities to the system. The cloud gateway transmits data between the cloud and the fog layer. Finally, the application layer provides the interface for users to interact with the IIoT system. In the IIoT domains, such as robotics, manufacturing, and mining, the system provides data extraction capabilities, allowing users to extract relevant data for analysis and decision-making.

Fig. 6.

View Figure

A technique that addresses device unreliability and vulnerabilities has been developed in Reference [145] to allow secure data storage processes in the IIoT while integrating fog and cloud computing. This allows the collected data to be stored and processed at the edge server. However, this approach requires the encryption of fog-based data and effective privacy-preserving data mining approaches. As a result of encrypting fog-based data, fog nodes are forced to aggregate data to seal any form of information leakage during data dissemination [146, 147]. Consequently, edge computing faces challenges such as a lack of computational power, storage issues, and poor battery resources. Other threats include physical tampering with edge devices, identity forging, eavesdropping over shared wired channels, jamming links in IoT devices, and data privacy, as well as the various risks associated with network function virtualization, with the offloading of tasks to rich platforms, and with SDN [148].

Given that massive amounts of data are generated in IIoT environments, moving these data to the cloud for real-time analysis is a challenge. Other relevant challenges include managing access to applications, maintaining confidentiality, mitigating vulnerabilities, applying cryptographic protocols to the data generated from IIoT environments, and monitoring IIoT-related security events in real-time. Additionally, the cloud faces its own challenges in terms of confidentiality, integrity, authenticity, and availability [149].

As far as confidentiality is concerned, threat agents can propagate through the cloud and leak sensitive data related to the IIoT. The ultimate objective of an adversary is to defeat the cloud security goals by gaining control of the IT assets. Integrity issues arise from common attacks where adversaries are able to alter or modify part or all of the data at rest or in motion across different cloud models. The authenticity of entities within the cloud poses a challenge because of the existence of numerous illegitimate users. These vulnerabilities are fundamental, given the open nature of the cloud.

Another critical aspect concerning susceptibility is the issue of permission and privileges, where insufficient authorization of sessions and permissions makes cloud data vulnerable and susceptible to attacks. Recent studies of critical cloud attacks have identified DoS and distributed DoS (DDoS) to be the most common attacks, mainly propagated by botnets, virtualization/hypervisor attacks, user-to-root attacks, port scanning, MITM attacks, spoofing, and physical attacks. Most of these attacks attempt to defeat provisioned cloud services during IIoT integration [150, 151]. A summary of the key achievements in edge and fog security is presented in Table 10.

Table 10.

Reference	Focus	Significance for IIoT ecosystems
[100]	Vulnerable adversarial manipulations in IIoT edge nodes	Need to address complexity in IIoT networks
[144]	Integration of the volume of data in the IIoT	Vulnerabilities are experienced at the fog layer owing to application migration
[145]	Device unreliability and vulnerabilities in the IIoT edge	Need for encryption of data when fog and cloud integrate
[146, 147]	Encrypting fog-based data in the IIoT	Sealing data leakage points as a way of enhancing security
[148]	Computation and storage issues in the IIoT	Identifies the channels of compromise in the IoT
[149]	State of massive data generated in the IIoT environment	Data management solutions are key to managing huge volumes of data in the IIoT
[150, 151]	Permission and privileges in the cloud	Sufficient authorization and sessions and privileges in the cloud reduce potential intrusions

View Table

Table 10. Summary of Identified State-of-the-art Studies of Edge and Fog Security in IIoT Ecosystems

6 State-of-the-art Research in IoT and IIoT Forensics

The digitization of manufacturing processes further extends the attack and threat landscape and enhances the level of susceptibility, which could increase the potential for digitally propagated crimes. As a result, there is a constant need to analyze potential digital evidence to provide proof or prove facts if a potential security incident is detected. To date, there has been relatively little research on IIoT forensics, although some studies have explored how digital forensic investigations can be conducted in the IIoT, as well as the significant current challenges. We explore IIoT forensic investigations from the standpoint of integrating IoT-based forensic applications with industrial processes and assess how the prevailing IoT-based forensic models could be positioned to conduct digital forensic activities. A summary of the key research focusing on IIoT is presented in Table 11.

Currently, there exist vulnerabilities in the physical infrastructure that underpins IIoT applications, e.g., the CPS, ICS, and SCADA systems. Thus, there is a dire need for post-incident response strategies. For example, research by Cruz et al. [152] suggests placing a shadow security unit in parallel with field devices as an approach for continuous monitoring of PLCs, which could be leveraged for forensic purposes. Research on SCADA forensics has identified that current SCADA employs cloud-based technologies and suggests the following essentials: identifying the incident origin, assessing the system risks and alterations, identifying the SCADA impact and status, and live forensics, before employing rapid response, compatibility, and remote data acquisition techniques. This approach is useful for conducting digital investigations in IIoT but is limited by the available forensic artifact extraction tools [153]. An IIoT forensic investigation framework [154] suggests the collection of digital evidence to mitigate IIoT-based vulnerabilities. This study outlines the relationship between the OSI layer model and cross-layer forensic information and suggests a higher layer for digital forensic information in the IIoT [154].

Considering the existing digital forensic challenges in the IoT, MacDermott et al. [155] highlighted several shortcomings that have resulted from the changing landscape of digital crimes. The sources of evidence from IIoT environments were identified as smart devices and sensors, hardware and software, intrusion detection systems (IDS), firewalls, ISPs, mobile providers, and other online identities. IoT forensic techniques have been mapped to privacy as a feasible way of conducting digital investigations through the sharing of data by devices through a privacy-aware IoT forensic model [156]. For example, an IoT forensic model that underpins infrastructures has been constructed for Amazon Echo as a use-case and is able to support identification, acquisition, analysis, and presentation using a generic IoT architecture [157].

A forensic acquisition technique for the IoT based on the state of events has been developed and proved for controller-to-IoT, controller-to-cloud, and controller-to-controller cases. Through the use of an IP camera, it has been shown that relevant data based on states can be extracted from IoT devices [158]. Notably, a taxonomy for the challenges faced in IoT forensics has identified forensic tools, models, and sources of evidence as crucial aspects to consider in the IoT environment [159]. A technique for defending logged data against attack using anti-forensic techniques has been developed through data aggregation and encryption in an IoT setup with the modified information dispersal algorithm. This approach is based on the fragments transmitted from IoT devices [160].

A forensic-aware ecosystem for the IoT has been established to collect and analyze evidence systematically by supporting different IoT subdomains [161]. Subsequent studies have shown that IoT forensic challenges mainly target encryption and storage of data in the cloud. The IoT forensic tools and techniques for preserving volatile data have been identified as key aspects of IoT forensic research, but there are few IoT forensics tools with data acquisition capabilities [162].

A fog-based framework for IoT forensics has identified several challenges based on use-cases and implementation. As an example, a refrigerator was connected to a fog node as part of a home automation system. Although the effectiveness of this framework was not evaluated, it was able to reproduce some techniques for achieving digital forensics [163]. Research focused on IoT opportunities and challenges suggests that search, seizure, evidence correlation and analysis, and IoT attribution are core challenges [164]. Additionally, complexity and diversification, chain of custody, and limited storage for IoT devices require further research [165].

Other challenges include the type and quantity of data, blurred lines between networks, and the type and source of evidence [177]. A framework for IoT acquisition and forensics has identified data location, data format, data extraction, and data type as key forensic characteristics [178]. An efficient approach that combines cloud forensics with client-side forensics has been suggested for the Amazon Alexa ecosystem, with a proof-of-concept focused on identification and acquisition analysis from local devices [179]. Other relevant work includes the analysis of bulk digital forensic data as a semi-automated approach for scanning disparate digital forensics data subsets and data from IoT portable devices. There are also cross-device and cross-analysis approaches that are appropriate for diverse digital forensic cases [180]. Additionally, live forensic analysis in emerging configurations in IoT environments could utilize K-nearest neighbors, support vector machines (SVMs), naive Bayes classifiers, and random forest algorithms. These approaches illustrate how datasets could be utilized for the live detection of potential incidents [169].

Other IoT-based frameworks include a top-down IoT model for planning and authorization of forensic processes [176], integrated IoT forensic frameworks [170] that stipulate which IoT-based standards can be leveraged, and an application-specific model [173] for the IoT that extracts evidence from smart home and smart city devices. Acquisition based on a state forensics model has been explored [158] with both controller-to-IoT device and IoT-to-controller processes included in the forensics. A model for smart cities and smart vehicles [174] targets ECM data from the vehicle data hub to create forensic images. A digital evidence acquisition model [175] for the IoT environment uses graphs to model flows, whereas the FIF-IoT approach [171] uses a public ledger to verify evidence integrity. Research has also covered a cyber-forensics framework for IoT big data [167], forensic edge management for autonomous systems integrated with IoT networks [172], a forensic model for IoT trackers [181], and a forensic logging model for IoT ecosystems that supports cloud computing [168].

The existing overlap between the IoT and IIoT means that, in the context of this article, IIoT forensics are represented as a large-scale post-event/reactive technique that targets critical IIoT forensic information domains [154]. Examples include network protocols targeting ICS/SCADA, forensics from the lowest layers (physical layer), evidence from higher layers (bit-level forensics) from SCADA, PLCs, sensors, communication gateways, and network-level forensics [154]. As far as IoT forensics is concerned, information may be extracted from the respective layers, mostly from networked mobile digital devices; it should be noted here that mobile forensics lies at the center of the IoT. While the IIoT, IoT, and mobile forensics share a need for forensic evidence (digital data), there are major differences between them with regard to the complexity involved in extracting these data and the diverse range of architectures. This complexity, among other challenges, should ultimately underlie the forensic soundness and sanctity of potential digital evidence from the IIoT, IoT, and mobile forensic architectures for the purpose of litigation in the event of a security incident.

7 OPEN CHALLENGES

The preceding sections have highlighted the security requirements in IIoT ecosystems, the state of IIoT ecosystems in terms of architectures and protocols, IIoT ecosystem security achievements, and the state of digital forensics in the IIoT. Based on this analysis, we now identify the open challenges relating to these technologies from a security and digital forensic perspective. The categories of these challenges are depicted in Figure 7, and a summary of the challenges and high-level solutions is given in Table 12.

Fig. 7.

View Figure

8 FUTURE DIRECTIONS

The challenges and limitations addressed in this article cover a wide scope with a multitude of facets. While a number of the challenges identified in the IoT have some similarities with IIoT challenges, the former are more closely associated with device diversity and the corresponding security mechanisms, while the latter are associated with the security aspects of smart industrial processes and the corresponding security and digital forensic investigation techniques.

With the continuous increase in the number of devices and the volume of data across IIoT systems, it is vital that diverse data processing techniques be incorporated. In most instances, the processing techniques applied are not standardized or widely accepted, which raises key security, privacy, and data confidentiality concerns.

A number of studies have formulated proposals for authentication techniques, specifically during the key management stage. Although some of these methods appear to be pertinent, it is important to note that the majority of existing key agreement techniques are not widely deployed across heterogeneous environments. This leads to concerns regarding the security and secrecy of keys and data during communication.

According to the key objectives of Industry 4.0, the IIoT is integral to industrial control processes. As such, integrating key security achievements such as blockchains, smart contracts, and key management techniques with 5G technologies could harden the security of the IIoT by preventing energy theft. The addition of security layers could result in stronger authentication and authorization mechanisms, where only the authorized user’s details and secret keys are maintained.

Consequently, with the key achievements in edge and fog computing in the IIoT come privacy concerns during data processing at the edge. In achieving threat intelligence, federated data models are locally trained at the edge nodes and then shared to the global nodes. Thus, it is important to investigate how the shared intelligence of data is aggregated and shared across heterogeneous environments for the purposes of privacy and adversarial concerns in IIoT ecosystems.

Based on the connectivity that has arisen as a result of the 5G standard, it is projected that key achievements will be realized in mobile edge applications, making IIoT processes more effective through the expected lower latency of machine communication. While this is a key opportunity for faster communication across IIoT networks, it may also open further vulnerabilities, with IIoT ecosystems becoming susceptible owing to the heterogeneity of the services supported by 5G in the IIoT.

Finally, there remains a need for security standards for blockchains, given their paramount importance to the safeguarding of the IIoT from compromise, especially during the integration of smart contracts. Furthermore, the detection of malicious nodes in a blockchain requires key edge intelligence aspects of resource utilization.

9 CONCLUSION

The IIoT is still in a process of development, with current advances being geared toward enabling the industrial and manufacturing processes that will realize Industry 4.0. This paradigm shift is allowing systems to accumulate and analyze data to make certain decisions.

In this article, the state-of-the-art of IIoT ecosystems has been comprehensively studied from security and digital forensics perspectives to help identify the existing open challenges. The state-of-the-art has been explored in terms of IIoT ecosystem security parameters, connectivity protocols, security-enabling technologies, and digital forensics. Key security achievements and open challenges have also been identified, along with key high-level solutions.

The IIoT is still being integrated into our daily lives with the aim of improving quality through continuous industrial automation or processes leveraging IoT-based applications. Our state-of-the-art survey has provided a comprehensive analysis of existing research, from which it is evident that the current IIoT suffers from relatively weak security protocols and a lack of unified accepted standards. Together, these weaknesses make IIoT integration vulnerable to a variety of security attacks.