Hierarchically defining Internet of Things security: From CIA to CACA

Abstract

With the rapid development of Internet of Things technology (e.g. wireless sensor networks), security has become a global issue. Confidentiality, integrity, and availability (known as the CIA triangle) is widely used to define and model information security. However, this CIA triangle is insufficient to address rapidly changing security requirements. In this article, we divide information systems into four layers: physical layer, operational layer, data layer, and content layers (PODC). Corresponding, hierarchy of information security is proposed. Furthermore, we define the basic security properties for each layer and show that the four properties (i.e. confidentiality, availability, controllability, and authentication, called CACA) are minimally complete and independent for information security. Based on PODC and CACA, a new definition of information security is proposed, which acts as a secure foundation for information systems.