STRIDE-IoT - catálogo de padrões de requisitos de segurança para sistemas IoT

Abstract

The Internet of Things (IoT) has rapidly expanded across domestic, industrial, and urban environments, raising concerns regarding security, privacy, and operational reliability. Due to the heterogeneity, hardware limitations, and distributed nature of IoT devices, establishing consistent and reusable security requirements remains a significant challenge. Although the literature documents vulnerabilities and best practices, few efforts translate this knowledge into structured requirement patterns that effectively support requirements engineering. This work proposes STRIDE-IoT, a catalog of security requirement patterns for IoT systems, organized according to the STRIDE threat model and structured using Withall’s Requirement Patterns methodology. The catalog was developed based on a systematic mapping of the literature and on the analysis and conversion of IoT vulnerabilities—especially those documented by Pessoa (2025)—into functional and non-functional requirement patterns (FRPs and NFRPs). The resulting catalog offers a multilayered structure composed of Requirement Pattern Groups (RPGs), Functional Requirement Patterns (FRPs), Non-Functional Requirement Patterns (NFRPs), and supporting infrastructures, enabling traceability between threats, requirements, and IoT technologies. The STRIDE-IoT provides a systematic, reusable, and navigable approach to IoT systems engineering, strengthening requirements specification and the integration between threat modeling and security practices.