IoT–Cloud Integration Security: A Survey of Challenges, Solutions, and Directions

Abstract

The confluence of the Internet of Things (IoT) and cloud computing heralds a paradigm shift in data-driven applications, promising unprecedented insights and automation across critical sectors like healthcare, smart cities, and industrial automation. However, this transformative synergy introduces a complex tapestry of security vulnerabilities stemming from the intrinsic resource limitations of IoT devices and the inherent complexities of cloud infrastructures. This survey delves into the escalating threats—from conventional data breaches and Application programming interface (API) exploits to emerging vectors such as adversarial artificial intelligence (AI), quantum-resistant attacks, and sophisticated insider threats—that imperil the integrity and resilience of IoT–cloud ecosystems. We critically evaluated existing security paradigms, including encryption, access control, and service-level agreements, juxtaposed with cutting-edge approaches like AI-driven anomaly detection, blockchain-secured frameworks, and lightweight cryptographic solutions. By systematically mapping the landscape of security challenges and mitigation strategies, this work identified the following critical research imperatives: the development of standardized, end-to-end security architectures, the integration of post-quantum cryptography for resource-constrained IoT devices, and the fortification of resource isolation in multi-tenant cloud environments. A comprehensive comparative analysis of prior research, coupled with an in-depth case study on IoT–cloud security within the healthcare domain, illuminates the practical challenges and innovative solutions crucial for real-world deployment. Ultimately, this survey advocates for the development of scalable, adaptive security frameworks that leverage the synergistic power of AI and blockchain, ensuring the secure and efficient evolution of IoT–cloud ecosystems in the face of evolving cyber threats.

1. Introduction

The intersection of the Internet of Things (IoT) and cloud computing has revolutionized how we interact with technology and manage data. The IoT refers to the network of physical objects embedded with sensors, software, and other technologies that enables them to connect and exchange data with other devices over the internet. These “smart” devices extend a wide range of applications from household devices and fitness trackers to industrial machines and city infrastructure. The IoT enhances our ability to monitor, control, and optimize various aspects of our daily lives and operational processes by providing real-time data and actionable insights [1].

On the other hand, cloud computing is a technology that allows users to access and manage computing resources such as servers, storages, databases, and applications over the internet. Therefore, cloud computing provides a scalable and flexible environment where resources can be easily managed rather than relying on local hardware and software. It offers several benefits, including cost savings, increased flexibility, and the ability to handle large volumes of data.

When the IoT and cloud computing are combined, they create powerful software. Accordingly, IoT devices generate large amounts of data, which can be collected, stored, and processed in the cloud. This integration facilitates advanced analytics, real-time monitoring, and improved decision-making. For instance, in a smart city context, sensors might track traffic flow and environmental conditions with the data analyzed in the cloud to optimize traffic signals and improve air quality.

Additionally, the growth of IoT devices and cloud computing has led to several limitations, particularly in security. The complexity of securing hybrid systems is compounded by the diversity of IoT devices and their resource limitations. That makes it challenging to apply traditional cloud security measures effectively. Moreover, issues like virtualization vulnerabilities, insider threats, and data breaches are increased when IoT data are transferred to cloud environments. Furthermore, the lack of standardized frameworks to address both IoT and cloud-specific vulnerabilities highlights a significant gap, as many solutions focus on one aspect without considering an overview approach to security. This failure underscores the need for innovative and validated strategies to tackle the emerging security challenges in this integration. Addressing these challenges requires robust security protocols and increased user awareness, as emphasized by Tawalbeh [2] and repeated by General Data Protection Regulation (GDPR) [3] principles that support risk awareness and privacy-preserving guarantees. However, this survey investigates key security challenges, analyzes existing mitigation strategies, and highlights research gaps to guide future advancements in securing IoT–cloud ecosystems.

The rest of this paper is structured as follows: Section 2 presents the background, while Section 3 provides an overview of related works. Section 4 presents security challenges in IoT–cloud integration. Section 5 explores existing mitigation techniques and security solutions. Section 6 discusses open research gaps and future directions. Finally, Section 7 concludes with a summary of findings and outlines future directions for research.

2. Background

2.1. Cloud Computing Architecture

A cloud computing architecture is designed to provide scalable and flexible IT resources over the internet. It typically involves several layers and components, as shown in Figure 1. They work together to deliver computing services efficiently and securely. Moreover, with the increasing adoption of the IoT, many critical infrastructures (CIs) are moving toward cloud-based systems to enhance operational efficiency and scalability. Critical Infrastructures refer to the essential systems and assets that are vital to national security, public health, transportation, and economic stability.

However, this shift increases the demand for strong security frameworks to ensure high assurance because vulnerabilities in connected systems can have significant consequences. Below is a breakdown of the main elements of cloud computing.

2.1.1. Cloud Service Models

(a)

Infrastructure as a Service (IaaS): Provides virtualized computing resources over the internet and has virtual machines, storage, and networking. Also, it is used for scalable computing resources, data storage, and networking capabilities. IaaS provides virtualized computing resources such as servers and storage that enable utility-like services for users [4].

(b)

Platform as a Service (PaaS): Offers hardware and software tools over the internet, which are usually used for application development, including development frameworks, databases, middleware, and development tools. Often, developers use it to build, deploy, and manage applications without dealing with the underlying infrastructure. PaaS offers development environments with APIs and middleware for custom application creation without the need for local configuration [4].

(c)

Software as a Service (SaaS): Provides software applications over the internet on a subscription basis. Moreover, it has fully functional software applications and user interfaces. Users can access SaaS applications via a web browser, which includes email services, CRM systems, and collaboration tools. Also, SaaS allows users to access cloud-based software on a subscription or pay-per-use basis [4].

2.1.2. Cloud Deployment Models

Cloud deployment models define how cloud services are provided and managed. Each model offers different levels of implementing cloud systems, varying in administration, ownership, access control, and security protocols [5]. The four primary deployment models are public, private, hybrid, and community clouds [6,7].

(a)

A public cloud is a cloud infrastructure that is owned and operated by a third-party cloud service provider that delivers computing resources like servers and storage over the internet. These resources are shared among multiple organizations (tenants).

(b)

A private cloud is a cloud infrastructure that is exclusively used by a single organization. It can be hosted on-premises within the organization’s data center or by a third-party provider.

(c)

A hybrid cloud is a combination of public and private clouds that allow data and applications to be shared between them. This model offers the benefits of both environments.

(d)

A community cloud is shared among several organizations with similar interests or requirements such as compliance and security. It is managed by one or more organizations in the community or by a third-party provider.

2.1.3. Cloud Computing Components

Cloud computing architectures consist of various components that work together to deliver cloud services. Thus, understanding these components helps in effectively managing and utilizing cloud resources.

Compute Resources

Computing resources provide the processing power required to run applications and services in a cloud. The components needed are as follows:

• Virtualized servers that run on physical hardware, but they are managed independently. Examples include AWS EC2 instances and Azure Virtual Machines;
• Containers that offer lightweight virtualization at the operating system level, providing agility and efficiency compared to traditional virtual machines (VMs) [8];
• Serverless computing, or Function as a Service (FaaS), which enables cost-efficient, rapidly scalable applications without configuration and management overheads [9].

Containers, serverless computing, and virtualized servers are complete parts of modern cloud computing. The integration of containers and serverless computing has led to serverless container solutions, such as AWS ECS with the Fargate and SCAR framework [10]. These technologies build upon microservice-based architectures and state-of-the-art container technology, allowing users to manage complex applications without system-level expertise [11]. However, container-based virtualization is facing challenges in terms of isolation and security that prompts the development of new container runtimes and security-oriented solutions [8].

Storage

Cloud storage services offer block, file, and object storage options as part of their IaaS offerings [12]. These storage types are crucial for modern healthcare systems, which generate large volumes of data requiring scalable, secure, and reliable storage solutions [13]. Also, object storage is increasingly adopted for healthcare big data due to its scalability, cost effectiveness, and suitability for data analytics. On the other hand, cloud-backed file systems seek to combine the benefits of local POSIX-interface storage with remote cloud storage. However, they faces challenges in supporting efficient random file access on object storage systems [14].

Networking

Networking components manage how cloud resources communicate with each other and with external networks, as follows:

• Virtual private clouds (VPCs) are integral components of cloud network architectures that provide isolated virtual network environments within a public cloud infrastructure [15].
• Load balancers distribute incoming traffic across multiple instances to ensure high availability and reliability.
• A content delivery network (CDN) is responsible for distributing content to edge locations around the world to improve performance and reduce latency.

Load balancers and CDNs are crucial components in cloud environments. Load balancers distribute traffic across virtual machines to prevent overloading or insufficient utilization of networking nodes that ensures data availability and perfect performance [16]. On the other hand, CDNs can be virtualized by using cloud infrastructure to provide customized content delivery services for providers. These virtual CDNs utilize shared virtual machines in IaaS clouds. Also, they can dynamically scale resources to meet changing demands while adhering to service level agreements [17].

Management and Monitoring

There are three main tools and services for managing cloud resources, monitoring performance, and ensuring security. First, monitoring tools, such as AWS CloudWatch, Azure Monitor, and Google Cloud Operations Suite, can track resource usage, performance metrics, and health. Second, management tools allow administrators to provide, manage, and automate resources. Last, automation tools like Azure Resource Manager enable automated deployment and scaling of resources. These tools and technologies collectively support the development of future internet applications, enhance market opportunities for smart infrastructures, and improve business processes in cloud computing environments [18].

Cloud Security

Cloud security is a vital concern for businesses adopting cloud computing. As organizations move their data and applications to the cloud, protecting sensitive information becomes essential. Several strategies have been proposed to enhance data security in cloud storage.

One important approach is using Service Level Agreements (SLAs). These formal contracts define expectations between users and cloud service providers. SLAs help ensure that both parties are aligned on data protection standards.

In addition to SLAs, it is crucial to implement strong protections for data storage, transfer, and authorization [19]. This includes techniques like encryption for data at rest and in transit, secure authentication protocols, and strict access controls.

A combined approach has been suggested to further enhance security. This includes using secure sockets layer (SSL) encryption for secure data transmission, message authentication codes (MACs) for integrity checks, and dividing data into three sections. This division reduces the risk of breaches by ensuring that no single point of failure can compromise all data [20].

Effective cloud security solutions should also focus on encryption, access control, data loss prevention, and regular security audits. These practices are crucial for maintaining data confidentiality, integrity, and availability [21]. Regular audits help identify vulnerabilities and ensure compliance with regulations.

Additionally, a new two-tier framework called WAY (Who Are You?) has been proposed. This framework uses a virtual machine (VM) monitoring system to assess user trust. Also, it enforces security measures at multiple levels that include the network, infrastructure, and data storage [22]. By addressing the unique challenges of diverse cloud platforms, WAY aims to improve overall data protection.

APIs and Interfaces

Application programming interfaces (APIs) are essential for deploying applications and facilitating interactions between cloud service providers and consumers [23,24]. They support various cloud service models like SaaS, PaaS, and IaaS [25]. Additionally, cloud APIs come in different forms like standards-based APIs, which are particularly useful for certain cloud applications [26]. Another form is command-line interfaces (CLIs), which developers generally favor over web consoles, especially for CRUD tasks [27].

How do APIs work?

• In the request phase, the application sends a request to a cloud service through an API. This request can include commands like “get data”, “store data”, or “delete data”.
• In the processing phase, the cloud service receives the request and processes it, and this might involve interacting with databases, computing resources, or other services.
• In the response phase, after processing the request, the cloud service sends a response back to the application via the API, as shown in Figure 2. This response typically includes the requested data or a confirmation of an action taken (like a successful upload).
• In the user interaction phase, the application uses the data or confirmation from the response to update what the user sees, completing the interaction.

As cloud computing adoption grows, securing APIs becomes increasingly important to protect cloud services and data [23]. Additionally, real-time computing capabilities and quality of service (QoS) assurance are emerging challenges that cloud providers are addressing through specialized APIs [25]. Understanding API trends and developments is crucial for both cloud users and providers [24].

2.1.4. Key Cloud Considerations

(a)

Scalability

A fundamental advantage of cloud computing is its ability to dynamically adjust resources based on current demands. This flexibility enables businesses to scale up their infrastructure during peak periods such as during a product launch or seasonal traffic spikes and scale down during quieter times to avoid unnecessary costs. Scalability can be achieved in the following two ways: horizontal scaling, which adds more instances, and vertical scaling, which upgrades existing instances. Additionally, auto-scaling features automatically adjust resources based on predefined policies. This ensures that applications remain responsive and cost effective without manual intervention. Cloud scalability enables modern computing systems to efficiently adapt to dynamic workloads [28].

(b)

Reliability

Reliability is crucial for maintaining continuous service and minimizing downtime. Cloud providers design their systems with high availability in mind, employing strategies like data replication across multiple geographic regions and implementing load balancing to evenly distribute traffic. Therefore, these practices ensure that if one component fails, another can take over, thereby maintaining service continuity. Disaster recovery plans, such as regular backups and failover mechanisms, enhance reliability by ensuring data recovery and operational continuity in the event of a major disruption.

(c)

Compliance and security

Cloud providers invest heavily in security measures, including encryption, access controls, and regular audits to safeguard data. However, organizations must also implement their own security practices to ensure compliance with regulations such as GDPR. This involves configuring security settings appropriately, managing access permissions, and continuously monitoring for vulnerabilities to protect against potential threats.

(d)

Performance optimization

Cloud environments require careful configuration of resources to meet performance expectations such as low latency and high throughput. Additionally, regular monitoring and performance setting are necessary to identify and address inefficiencies. Thus, performance monitoring tools provide insights into resource utilization and application behavior, enabling organizations to make necessary adjustments to maintain high performance levels.

(e)

Integration and interoperability

Effective integration involves using APIs and middleware to connect cloud services with on-premise systems and facilitate smooth data flows. Data migration strategies are important for transferring data between cloud environments or integrating with legacy systems, ensuring that all components of the IT infrastructure operate cohesively.

2.2. IoT Architectures

The IoT architecture typically consists of the following five layers: physical perception, the network and protocol, transport, application, and data/cloud services, as shown in Figure 3 [29]. These layers encompass various hardware, protocols, and services, each with its own specific security considerations.

2.2.1. Perception Layer

The perception layer, also known as the device layer, is the critical interface between digital data and physical devices. This serves as the foundation for environmental sensing and control [30]. This layer typically comprises various sensors, actuators, RFID tags, and other edge devices that gather real-time data from the surrounding environment. Due to its close interaction with physical components, it plays a pivotal role in detecting and collecting key parameters such as temperature, humidity, motion, light, and location.

However, the perception layer also encounters a wide array of security challenges. Many IoT devices operating at this level are constrained by limited computational power, memory, and energy resources, which makes it difficult to implement robust security mechanisms [31].

2.2.2. Network Layer

The network layer is integral for enabling seamless communication between devices that shapes the backbone of data transmission and device coordination. It supports the transfer of data from the perception layer to the application layer, typically through a combination of LANs, WANs, cellular networks, and specialized IoT communication protocols like 6LoWPAN, Zigbee, or LoRa [32]. One of the main challenges in the network layer is the integration of diverse device-to-device (D2D) communication technologies. With numerous devices relying on various protocols, such as IPv6, Bluetooth, and Zigbee, ensuring smooth interoperability requires robust addressing, routing, and mobility management solutions.

Additionally, the routing protocols used in this layer must be optimized to handle the unique characteristics of IoT networks, such as large-scale node deployment, frequent topology changes, and low-power operations. Also, routing decisions must balance energy consumption and communication reliability. This means that many IoT devices operate on limited battery power, particularly in large-scale environments like smart cities or industrial IoT [33].

Additionally, security is a significant concern in the IoT network layer, as it handles sensitive data and is vulnerable to various attacks [34]. As the layer responsible for transporting sensitive data between devices and central processing hubs, it is highly vulnerable to a variety of attacks. These include man-in-the-middle attacks, where malicious actors restrict or change communication between devices, representing denial of service (DoS) attacks. This means that the network will be overflown with traffic to disable services, and routing attacks, like wormhole attacks, disrupt normal data flow by manipulating routing information. Moreover, the rise of smart devices and their integration into IoT systems, along with the huge volume and diversity of devices, have significantly expanded the attack surface of IoT networks [35].

2.2.3. Edge or Fog Layer

This layer is a transformative architecture that brings computational power and data processing closer to physical devices and end-users. Unlike traditional cloud computing, which requires data to travel long distances to centralized servers, fog computing allows localized processing, which helps to reduce the bandwidth challenges posed by the large growth of IoT devices [36]. This proximity to the data source enables faster data collection, analysis, and processing, which makes it more efficient than relying only on cloud architectures.

Fog computing is especially crucial for IoT applications that demand low latency and real-time decision-making, such as autonomous vehicles, smart manufacturing, and healthcare systems. By reducing the data-processing time, the fog layer enhances response times, which are vital for mission-critical IoT deployments. The architecture is typically organized into two tiers—the lower tier, which manages incoming data streams from devices, and the upper tier, which focuses on more complex tasks such as data analytics and distributed storage [37].

This two-tier structure enables the fog layer to effectively support modern technologies like 5G networks and embedded artificial intelligence, where fast communication and intelligent processing are essential. By incorporating low-cost devices and FPGA-based (field programmable gate array) accelerators, the fog layer can process large amounts of data streams while running advanced machine learning algorithms at the same time, such as deep neural networks (DNNs), close to the data source [37]. This capability greatly enhances the efficiency and responsiveness of IoT systems that provide scalability and flexibility in a wide range of applications.

2.2.4. Middleware Layer

In the IoT, the middleware layer plays a pivotal role as a software layer that bridges the gap between the underlying technological infrastructure and the application layer. Its primary function is to provide common services that simplify the development, management, and integration of various IoT devices and systems. This is essential in environments where various devices, sensors, and protocols need to interact seamlessly. Middleware abstracts the complexities of device communication, data management, and protocol translation, thereby allowing developers to focus on creating applications without needing to worry about the specific implementation details [38].

Also, this layer makes IoT application development easier by providing reusable components like data storage and device management. This reduces the need for developers to manage hardware and protocols manually. Also, it supports data integration and combining data from numerous sources, which is especially crucial for large-scale IoT systems like smart cities and industrial IoT [39]. With the rise of 5G, middleware must now handle larger data volumes, high-speed communication, and low latency. This layer needs to efficiently process and transmit big data in real time, particularly in critical applications like autonomous vehicles, smart healthcare, and industrial automation [40].

2.2.5. Application Layer

The application layer is responsible for providing essential services to users and facilitating communication between devices that enable data exchange and coordination across various platforms [41]. Moreover, it acts as the interface between IoT devices and the end-users, translating raw data into actionable information and services. By supporting different protocols, this layer ensures that IoT devices, often built by different manufacturers and utilizing various technologies, can work together seamlessly [42]. This layer relies on multiple communication protocols, each designed to address specific requirements such as real-time data exchange, security, and scalability. The following are key protocols used at this layer:

Key Protocols in the Application Layer

• Constrained Application Protocol (CoAP)

This protocol is designed for lightweight devices with limited computational power and bandwidth and enables communication in resource-constrained environments like smart homes or industrial IoT. Also, it is often used with devices that operate on low power and in networks with limited data-transfer capacities.

2.

Message Queuing Telemetry Transport (MQTT)

A publish/subscribe protocol ideal for remote monitoring and control applications. MQTT enables devices to send messages to a broker, which then distributes them to subscribers. It is highly efficient for applications requiring minimal data transmission, such as sensors in smart agriculture.

3.

Extensible Messaging and Presence Protocol (XMPP)

This protocol is often used for instant messaging and real-time data exchange in IoT systems. For instance, in a smart healthcare system, it can be used for sending alerts and notifications between monitoring devices and medical staff.

4.

Data Distribution Service (DDS)

A DDS is a protocol designed for real-time systems where data need to be distributed across multiple nodes instantly. It is commonly applied in industries like aerospace, automotive, and robotics where real-time data exchange is crucial.

5.

Advanced Message Queuing Protocol (AMQP)

This protocol focuses on ensuring reliable and secure messaging between systems. It is widely used in environments that require guaranteed delivery, such as financial systems, and is increasingly being applied in IoT use cases that handle sensitive transactions or communications.

6.

Representational State Transfer (REST)

REST is commonly used in web-based applications and allows systems to communicate using HTTP protocols. This makes it a popular choice for IoT applications with cloud integration, such as smart home ecosystems that allow users to control devices via mobile apps or web interfaces.

7.

WebSocket

WebSocket provides bi-directional, full-duplex communication between clients and servers. This is essential for real-time IoT applications like live data streaming or instant messaging between devices in IoT ecosystems.

8.

Java Message Service (JMS)

JMS is used to send messages between Java-based applications, which makes it a preferred choice for enterprise-level IoT applications where Java is the dominant programming language.

These protocols ensure efficient data transfer, device interaction, and service delivery by enabling devices to communicate with one another and with cloud platforms. This provides the backbone for IoT services such as monitoring, automation, and control [43]. For example, in smart home systems, protocols like MQTT or CoAP allow the control of appliances (lights, thermostats, security systems) through apps or voice commands. Similarly, in smart cities, data from traffic sensors and surveillance cameras are processed and shared using these protocols to manage resources efficiently.

Table 1. Summary of Key Application Layer Protocols in IoT Systems.

Protocol	Transport	QoS	Architecture	Security
CoAP	UDP	Yes	Request/response	DTLS
MQTT	TCP	Yes	Publish/subscribe	TLS/SSL
XMPP	TCP	No	Request/response Publish/subscribe	TLS/SSL
DDS	TCP/ UDP	Yes	Publish/subscribe	TLS/SSL
AMQP	TCP	Yes	Publish/subscribe	TLS/SSL
REST	HTTP	No	Request/response	HTTPS
WebSocket	TCP	No	Publish/subscribe Client/server	TLS/SSL
JMS	MSTP	Yes	Client/server Request/response	SSL

compares communication protocols commonly used in the application layer based on the following four key parameters: transport, QoS, architecture, and security. Each protocol operates over specific transport layers, with most using TCP, which is known for reliable transmission, while protocols like CoAP rely on UDP, which prioritizes speed. Some protocols, like MQTT, DDS, AMQP, and JMS, offer built-in QoS that ensures guaranteed message delivery. Architecturally, they either follow a “request/response” or “publish/subscribe” model depending on the communication style, with WebSocket supporting both “client/server” and “publish/subscribe”. Finally, security is achieved through encryption standards like TLS/SSL, DTLS, or HTTPS, except for JMS, which utilizes SSL for secure messaging over MSTP. The protocols’ varying combinations of these features makes them suitable for different application environments.

Security is one of the most critical concerns for the application layer since it directly interacts with end-users and often deals with sensitive data. Common security threats at this layer include the following:

• Data breaches: Hackers can intercept data being transmitted between devices;
• DoS attacks: Malicious actors overflow the network, which makes services unavailable;
• Unauthorized access: Poor authentication mechanisms can lead to unauthorized users accessing sensitive systems, such as surveillance feeds in a smart city.

To mitigate these risks, researchers have proposed various security solutions, such as encryption techniques to protect data integrity, authentication protocols to ensure that only authorized devices and users can access the system, and access control mechanisms that limit the actions that users and devices can perform [43]. Additionally, there is a growing interest in applying blockchain and AI-driven security at the application layer to further enhance protection.

3. Related Work

The rapid growth of IoT devices and the widespread adoption of cloud computing have introduced significant security challenges across various domains. While numerous studies have been conducted on the individual security concerns of the IoT and cloud computing, few have focused on the unique risks arising from their intersection. To provide a comprehensive understanding of the current state of research in this area, it is essential to review the existing literature on IoT security, cloud security, and the integration of these technologies. The purpose of this section is to evaluate key studies and surveys that address these domains. By analyzing their contributions and limitations, this section highlights the gaps in the literature that necessitate further research. This review establishes a foundation for understanding challenges, highlights current studies, identifies open issues, and outlines future research directions.

3.1. IoT Security Studies

Recent surveys highlight ongoing security challenges in the IoT ecosystem. Key issues include confidentiality, integrity, and authenticity [44]. While some studies have categorized the most and least discussed IoT security issues, they often fall short of exploring how these challenges have been addressed by researchers.

Moreover, ref. [45] reports that industrial IoT faces critical security and privacy challenges due to its complex architecture. Also, the authors pointed out that existing solutions to address these issues might not be effective. Tan, Soo Fun, and Azman Samsudin proposed a four-layer Industrial Internet of Things (IIoT) security architecture and conducted a comprehensive security analysis on each layer. Also, their work identifies open security and privacy issues in IIoT, including the need for a standardized bottom-up security architecture. They provide a detailed review of security challenges and solutions relevant to various IIoT technologies and standards across the proposed layers. However, traditional security mechanisms may be insufficient for securing modern IIoT technologies. For example, relying on outdated or insecure cryptographic algorithms like RSA, MD5, RC4, and DES-56 is risky. Additionally, there are concerns about the limitations of IPSec and TLS/SSL mechanisms, such as insufficient authorization, access control, availability, and non-repudiation. Furthermore, using weak, single-factor password authentication makes systems more vulnerable.

Further highlighting these issues, ref. [46] identified several open research problems in IoT security, including secure service discovery, on-device credential security, network anomaly detection, and application-layer security. Also, the authors provide guidelines for future exploration. However, the study emphasizes the need for additional research to validate the usability of proposed security solutions (e.g., HIP, DTLS, CapBAC) within large-scale IoT systems. Existing security solutions mainly focus on access control and information security but often ignore critical aspects like resource efficiency and functional robustness, which are essential for IoT applications. Moreover, many current security mechanisms are incompatible with IoT systems, which leads to significant security and privacy concerns [47]. The literature reveals that while some vulnerabilities have been addressed, several challenges remain unresolved in IoT security. These vulnerabilities include weaknesses at the device level, insufficient authentication mechanisms, network security risks, and concerns related to data privacy [48]. Due to their simplistic architecture, low-power hardware, and design often prioritized for convenience over security, IoT devices are especially vulnerable to attacks [49]. Several studies have identified critical security vulnerabilities inherent in IoT architectures. For example, ref. [50] discusses various attacks targeting IoT devices, including unauthorized access and data breaches. While IoT security challenges have received significant attention, the cloud environment also presents unique threats that need consideration.

3.2. Cloud Security Studies

Cloud computing offers numerous benefits but faces significant security challenges, including data breaches, compliance, insider threats, and unauthorized access [51,52]. Ensuring data privacy, confidentiality, and integrity is crucial in addressing these challenges [52,53]. Identity and access management (IAM) plays a vital role in improving authentication and access controls [52,54]. Other challenges involve securing cloud orchestration platforms, ensuring service availability, and addressing cloud-native security risks [52]. Cyberattacks, misuse of cloud resources, and insecure APIs pose ongoing threats [54]. To reduce these risks, various solutions are proposed, including robust access controls, encryption, API security measures [51], advanced encryption techniques, virtual firewalls [54], and ensuring data availability and investigative support [53]. Collaborative efforts across fields are essential for developing innovative security solutions and best practices for cloud environments [52].

In addition, while cloud computing provides scalable and cost-effective services, security issues that span multiple levels of the cloud infrastructure, such as applications, networks, hosts, and data, remain a major concern. These issues limit its widespread adoption [55,56]. Also, multi-tenancy, a core feature of cloud computing, poses significant challenges across all infrastructure levels. This potentially leads to unavailability, data loss, and privacy breaches [56]. Researchers have proposed various solutions to address these concerns, such as multi-factor authentication (MFA) [57]. However, many challenges remain unresolved, particularly those related to cloud features like flexibility [56]. Ongoing research focuses on developing effective security measures to protect user data and applications in the cloud environment [55,58]. Addressing these security and privacy issues is essential for increasing cloud adoption and deployment [57]. However, integrating the IoT with cloud infrastructure introduces a new aspect of complexity, which is examined in the following section.

3.3. IoT and Cloud Integration Security Studies

The integration of IoT and cloud computing introduces substantial security challenges. This includes account hacking, phishing, malware attacks, man-in-the-middle attacks, and DoS [59]. The complexity of securing these systems is compounded by limited resources, diverse device types, and the vast volumes of data generated within IoT ecosystems [60]. Vulnerabilities in cloud environments arise from virtualization, insider threats, data breaches, and insecure APIs, which further complicate security [60].

Security concerns in IoT-enabled cloud computing can be categorized into the following four key areas: data security, network and service security, application security, and human-related issues [61]. Traditional security measures often fail, necessitating innovative approaches such as the use of deep learning and artificial intelligence (AI) [61]. Moreover, a shared responsibility model between IoT users and cloud service providers is important to improve security in cloud-based IoT applications [60]. The exploration of open-source solutions and the integration of security operations centers (SOCs) into IIoT systems are ongoing efforts in this area [62]. Addressing these challenges requires a comprehensive approach that integrates secure service discovery, on-device credential protection, and network anomaly detection [46]. In industrial contexts, it is necessary to focus on data collection methods, cloud system usability, and implementation of robust cybersecurity measures [62]. Ongoing research focuses on developing holistic security frameworks and best practices to mitigate these challenges.

A recent comprehensive study examined IoT privacy and security challenges and proposed a variety of solutions, such as robust encryption protocols and privacy-preserving mechanisms. However, it did not sufficiently address cloud-specific security concerns inherent in IoT–cloud integration scenarios [2]. Similarly, Sharma provided an in-depth review of security challenges in IoT environments, highlighting various attacks and mitigation strategies. However, it did not sufficiently cover the latest threats, such as adversarial attacks targeting AI-driven IoT–cloud applications [63]. Furthermore, Abdur conducted a broad analysis of IoT security issues, describing security threats, vulnerabilities, and defense mechanisms, but offered limited insights into lightweight cryptography techniques essential for resource-constrained IoT devices that communicate with cloud environments [64].

The review of existing studies indicates that while significant progress has been made in IoT and cloud security individually, limited research has focused on their integration. Key gaps include the lack of standardized security frameworks, lightweight cryptographic solutions, and adversarial AI threats, which will be further explored in the following sections.

Table 2. Evaluation of Previous IoT–Cloud Security Surveys and the Advancements Presented Herein.

Authors	Focus Area	Key Contributions	Limitations/Gaps	How Our Paper Improves
Tawalbeh et al. (2020) [2]	IoT risk security	Discusses data breaches, insecure APIs	Lacks coverage on IoT–cloud security integration	Analyzes IoT–cloud security holistically, including API security and replay attacks
Marco (2019) [3]	IoT privacy concerns	Covers GDPR compliance issues	Lacks discussion of post-quantum cryptography (PQC) risks	Explores PQC challenges and integration with IoT–cloud systems
Gibson et al. (2012) [4]	Cloud security risks	Covers IAM and insider threats	Ignores IoT-specific vulnerabilities	Discusses the integration of IAM with IoT–cloud-specific security threats
Sood (2012) [20]	Cloud data security	Discusses SSL, MAC-based integrity checks	Lacks zero-trust security and homomorphic encryption	Introduces lightweight cryptography for constrained IoT devices
Hussain et al. (2022) [34]	IoT network security	Analyzes DDoS, routing issues	Lacks discussion of API security concerns	Proposes API security best practices and lightweight cryptography
Alotaibi (2019) [65]	Blockchain in IoT	Focuses on decentralized trust	Lacks API security and multi-tenancy discussions	Explores blockchain-enhanced authentication tailored for IoT–cloud integration
Singh (2024) [58]	Cloud multi-tenancy risks	Covers virtualization security	Lacks discussion of adversarial AI and replay attacks	Analyzes adversarial AI threats in IoT–cloud systems and proposes mitigation strategies based on AI resilience techniques
Wang et al. (2016) [30]	IoT data processing	Discusses edge computing and secure APIs	Ignores API rate limiting and secure gateways	Analyzes API security gaps and proposes enhanced API gateway protections
Bello et al. (2017) [32]	IoT communication security	Covers authentication protocols	Lacks IoT–cloud-specific threats	Integrates device-to-cloud security mechanisms
Chiang and Zhang (2016) [36]	Fog computing security	Discusses latency and encryption	Lacks discussion of adversarial AI risks	Analyzes adversarial AI threats in IoT–cloud systems and proposes mitigation strategies based on AI resilience techniques
Alam et al. (2022) [35]	IoT data privacy	Covers encryption and privacy techniques	Lacks a focus on PQC and emerging cryptographic risks	Explores PQC integration for IoT–cloud privacy
Dritsas and Trigka (2025) [50]	Cybersecurity in IoT	Detailed survey on IoT cybersecurity and emerging threats	Lacks dedicated IoT–cloud integration and PQC discussions	Integrates IoT–cloud security, including PQC, API security, and adversarial AI threats
Tawalbeh et al. (2020) [2]	IoT privacy and security	Comprehensive IoT security and privacy overview	Cloud security integration gaps and emerging threats not covered clearly	Explores cloud integration and emerging threats
Shaukat et al. (2021) [63]	Security challenges in the IoT	Detailed analysis of IoT-specific threats	Limited discussion on IoT–cloud integration and adversarial AI	Provides detailed coverage of IoT–cloud security and adversarial AI
Abdur et al. (2021) [64]	Comprehensive IoT security	Broad IoT security survey	Lacks adequate discussion of PQC and API security	Provides integration of comprehensive API and PQC solutions

provides a structured comparison of past surveys, outlining their focus areas, key contributions, and limitations. Our study expands the scope of IoT–cloud security research by incorporating discussions on lightweight cryptographic techniques for constrained IoT devices, adversarial AI threats, API security best practices, and the transition to post-quantum security in IoT–cloud systems. This work extends the current body of literature and provides a clearer path for future research directions.

4. Security Threats and Challenges in IoT–Cloud Integration

The integration of the IoT and cloud systems has introduced several ongoing security challenges. While significant progress has been made in identifying risks and proposing countermeasures, several key gaps remain.

4.1. Device-Level Challenges

IoT devices often operate under severe resource constraints, limiting their ability to implement conventional security mechanisms. Also, they are often limited in terms of processing power, memory, and battery life. This makes it difficult to implement standard cryptographic algorithms such as AES, RSA, and SHA-256. These traditional methods require significant computational resources, leading to increased latency and energy consumption, which reduces the efficiency of IoT systems. Recent surveys on IoT security underscore the focus on confidentiality, integrity, and authenticity, with attention being directed toward resource-constrained environments and lightweight security protocols [2,34]. Moreover, many studies tend to overlook device-level security vulnerabilities, such as weak authentication mechanisms, insecure firmware updates, and poor physical security [36].

A growing concern in device-level security is the transition from classical cryptography to Post-quantum cryptography (PQC) while ensuring resistance to side-channel attacks. IoT devices are particularly vulnerable to physical attacks, such as power-based side-channel attacks, which can compromise cryptographic implementations. While PQC algorithms are designed to withstand quantum threats, they remain exposed to leakage through physical side channels, which makes their deployment in resource-constrained IoT devices difficult. Additionally, implementing effective countermeasures against side-channel attacks in PQC remains an ongoing research challenge, as existing methods may not be fully effective [66].

4.2. Network-Level Challenges

Network-level vulnerabilities are among the most exploited in IoT–cloud integration, particularly due to the wireless and untrusted nature of communication. The resource constraints of IoT devices make it difficult to implement advanced security protocols such as IPsec and TLS/SSL, which makes communications vulnerable to interception and manipulation [20]. Despite the development of alternative protocols, such as Datagram TLS and lightweight encryption methods, ensuring secure data transfer remains a challenge, particularly in large-scale and real-time IIoT environments [3,30].

A major network-level security concern is replay attacks, where attackers block valid messages and resend theirs to gain unauthorized access or manipulate behavior. These attacks exploit authentication codes and regular data exchanges, compromising system integrity and security [67]. Existing authentication mechanisms often fail to prevent replay attacks effectively, necessitating more robust cryptographic techniques and enhanced timestamp validation.

4.3. Cloud-Level Challenges

This integration makes security challenges more difficult, especially concerning data protection, network security, and malware attacks [2,3]. The challenge of securing hybrid systems is increased by the variety of IoT devices and their resource constraints. This makes it difficult to apply traditional cloud security mechanisms [34]. For instance, issues related to virtualization, insider threats, and data breaches are expanded when IoT data are transmitted to cloud environments. A common challenge highlighted in the literature is the lack of standardized frameworks that address both IoT and cloud-specific vulnerabilities. Many proposed solutions focus on either IoT or cloud security independently but fail to integrate a comprehensive approach that ensures end-to-end security [20]. The lack of a suitable framework increases the risk of inconsistent security implementations, which can leave gaps that attackers can exploit.

4.4. API and Interface Challenges

APIs are the primary communication channels between IoT devices and cloud platforms, enabling data exchange and remote-control functionalities. However, insecure APIs pose significant security risks, as attackers can exploit them to gain unauthorized access, manipulate data, or launch DoS attacks [68]. Many large-scale IoT deployments have suffered breaches due to weak API security, making it a critical area of concern.

Common API security threats include weak authentication and authorization, where attackers exploit insecure API mechanisms, such as hardcoded API keys or weak codes, to gain unauthorized access to sensitive IoT data or cloud resources [69]. Another risk is excessive data exposure, where APIs may return more data than necessary, which increases the potential for data leaks if controlled by malicious parties. Rate-limiting bypass is also a concern, as attackers can flood APIs with too many requests, causing DoS attacks or service degradation. Additionally, APIs that fail to sanitize inputs are vulnerable to injection attacks, including SQL injection, cross-site scripting (XSS), and remote code execution (RCE) [70]. These vulnerabilities enable attackers to manipulate database queries, execute malicious scripts, and potentially gain unauthorized control over IoT devices and cloud servers. Therefore, enhancing API security requires stronger authentication methods, encryption, and improved access control mechanisms to mitigate risks effectively.

4.5. AI and Advanced Threats

AI-driven security techniques are being explored to enhance IoT–cloud security, particularly in anomaly detection and automated threat mitigation. However, AI itself introduces new risks, such as adversarial AI attacks that manipulate machine learning models used for security analytics. Attackers can craft adversarial inputs to trick AI-based intrusion detection systems, which makes them ineffective [58]. However, the integration of AI also introduces new security challenges through adversarial attacks, where malicious inputs are crafted to exploit vulnerabilities in AI models and bypass detection mechanisms [71].

• Types of Adversarial AI Attacks

• Evasion Attacks

Attackers craft malicious inputs that trick AI models into misclassifying them. For instance, attackers may modify network traffic patterns to bypass AI-based intrusion detection systems (IDSs).

2.

Poisoning Attacks

Attackers inject manipulated data into the training dataset, which leads to compromised AI decision-making. This can be quite dangerous in IoT environments where AI models continuously learn from real-time data streams.

3.

Model Inversion Attacks

Attackers attempt to rebuild sensitive training data by analyzing the outputs of an AI model. This may extract confidential information processed in cloud environments [71].

5. Security Solutions and Mitigation Strategies

Various solutions have been proposed to mitigate the challenges discussed, with key areas of focus being lightweight cryptography, post-quantum cryptography, and enhancing cloud security.

5.1. Lightweight Cryptography and Post-Quantum Cryptography for IoT Security

Limitations in processing power, memory, and battery life make it challenging to implement traditional cryptographic algorithms like AES, RSA, and SHA-256, which can be addressed using the following approaches:

5.1.1. Lightweight Cryptographic Solutions

To address the limitations of conventional encryption methods, researchers have developed lightweight cryptographic algorithms specifically designed for resource-constrained IoT devices [72]. These approaches include the following:

• Elliptic curve cryptography (ECC), which offers strong security with shorter key sizes, reducing computational overhead while maintaining high levels of protection.
• Lightweight block ciphers
  • PRESENT is an ultra-lightweight cipher designed for embedded systems, offering strong encryption with minimal power consumption.
  • SIMON and SPECK are a pair of flexible lightweight ciphers optimized for IoT applications, balancing security and performance.
• Lightweight hash functions are cryptographic hash functions optimized for efficiency in IoT devices, ensuring secure data integrity with minimal resource usage.

5.1.2. Post-Quantum Cryptography and the IoT

With the beginning of quantum computing, traditional cryptographic methods such as RSA, ECC, and AES face significant security risks. Quantum algorithms like Shor’s algorithm can break widely used cryptographic techniques, which makes IoT systems vulnerable. However, integrating PQC into IoT environments presents challenges due to larger key sizes and higher computational requirements. Some promising PQC solutions include the following:

• NTRU (lattice-based cryptography) is known for its efficiency in resource-constrained environments. NTRU offers a balance between security and computational complexity, making it a possible option for IoT applications [73].
• Crystals–Kyber (NIST-recommended PQC algorithm) is a strong candidate for post-quantum secure IoT networks. It provides efficient key exchange mechanisms while maintaining high security standards [74].

5.2. Blockchain-Based Security Frameworks

IoT and cloud integration presents notable security challenges that lead researchers to explore blockchain-based solutions. Traditional centralized architectures are vulnerable to cyber threats like distributed DoS (DDoS) attacks and unauthorized access. Blockchain enhances security through decentralization, cryptographic hashing, and immutable records, ensuring data integrity and confidentiality [75]. Innovative frameworks such as adaptive multi-layer security (AMLS) and blockchain-enabled distributed trust (BEDT) have shown high detection rates for cyber threats and strong data integrity preservation [76]. Additionally, blockchain enables decentralized identity management to reduce dependence on vulnerable credential-based authentication.

Beyond authentication, blockchain strengthens data security and access control. Smart contracts execute automated policies that prevent unauthorized access and data leaks. A BEDT security framework using edge cloud and software-defined networking (SDN) has been effective in enhancing data confidentiality [77]. Moreover, integrating blockchain with decentralized storage solutions like IPFS improves secure data storage. Blockchain’s role in IoT–cloud integration promises enhanced privacy, data integrity, and secure transactions [78]. However, challenges like scalability and resource constraints must be addressed through optimized blockchain models and lightweight consensus mechanisms to ensure efficient large-scale adoption.

5.3. Mitigating Adversarial AI Threats in IoT–Cloud Security

AI-based security mechanisms, such as anomaly and intrusion detection systems, are increasingly used to enhance IoT–cloud security. However, as discussed in Section 4.5, these systems are vulnerable to adversarial AI threats that can bypass detection and compromise system integrity.

Real-world implications in IoT–cloud systems highlight significant vulnerabilities, especially in terms of adversarial threats. One major concern is the bypassing of IoT anomaly detection mechanisms. By introducing adversarial noise into sensor data, attackers can manipulate AI-driven monitoring systems to ignore security threats. For example, a smart city’s environmental sensors could be tricked into reporting normal pollution levels when an actual dangerous situation exists. Similarly, cloud-based intrusion detection systems (IDSs) powered by AI are exposed to manipulation through adversarial samples. These crafted inputs can mislead an IDS, enabling cybercriminals to evade detection while carrying out malicious activities.

• Countermeasures and Defenses

Adversarial training plays a crucial role in enhancing the resilience of AI systems by training models on adversarial examples, which enables them to recognize and defend against manipulated inputs. On the other hand, explainable AI (XAI) improves AI transparency, allowing security analysts to better understand decision-making processes and detect anomalies in adversarial scenarios [79]. Additionally, robust AI architectures, such as ensemble learning and defensive distillation techniques, can strengthen models against adversarial attacks. Addressing adversarial AI threats is vital for ensuring the reliability of AI-driven security systems in IoT–cloud environments. Future research should focus on enhancing the robustness of AI models, integrating explainability techniques, and developing proactive defenses against emerging adversarial attack strategies.

5.4. Defending Against Replay Attacks in IoT–Cloud Security

Many IoT devices use local networks for communication, which can be vulnerable to replay attacks. These attacks occur when an adversary intercepts legitimate signals (such as commands or data) between an IoT device and the cloud and then retransmits them to manipulate the system into executing unauthorized actions. A study revealed that 75% of devices tested for local connectivity were exposed to such attacks. The researchers proposed REPLIoT, a tool that automatically tests IoT devices for replay attack vulnerabilities with high accuracy (0.98–1). The study highlights the importance of securing local communication alongside cloud connectivity [67].

• Mitigation Techniques for Replay Attacks

• Nonce-based authentication implements unique, randomly generated values (nonces) for each authentication session, preventing attackers from reusing stopped credentials.
• Timestamp validation enforces strict timestamp-based request validation to ensure that old or replayed messages are automatically rejected [80].
• Secure session codes that use cryptographic session codes that expire after a single use can prevent attackers from exploiting previously valid authentication data [81].

To enhance IoT–cloud security, it is crucial to integrate these countermeasures into device communication protocols, authentication mechanisms, and cloud API security frameworks. Therefore, organizations can effectively mitigate the risks associated with replay attacks and strengthen the integrity of IoT–cloud systems.

5.5. API Security in IoT–Cloud Integration

To mitigate the API vulnerabilities outlined in Section 4.4, robust security mechanisms must be implemented to protect IoT–cloud systems. Weak authentication, data leaks, and injection attacks remain significant risks, emphasizing the need for secure API design principles [82].

The following best practices are essential for securing APIs in IoT–cloud environments:

• Secure APIs with OAuth 2.0 token-based authentication rather than relying on static API keys;
• Implement API gateways to act as intermediaries, filter out malicious traffic, and enforce security policies;
• Restrict the number of API requests per second to prevent abuse and DoS attacks;
• Use strict input validation to prevent injection attacks and ensure that all API requests use HTTPS encryption.

6. Case Study: IoT–Cloud Security Challenges in Smart Healthcare

The healthcare industry increasingly relies on IoT-enabled medical devices to monitor and manage patient health. Smart healthcare systems utilize wearable sensors, remote patient monitoring (RPM) devices, and cloud-based electronic health records (EHRs) to provide real-time diagnostics and treatment recommendations. These IoT devices collect, process, and transmit sensitive medical data to cloud platforms for storage and analysis. However, the integration of IoT with cloud services introduces significant security challenges, making patient data vulnerable to cyber threats.

6.1. Security Risks in Smart Healthcare

Several critical security risks affect IoT–cloud integration in healthcare environments, as follows:

• Data breaches: Unauthorized access to EHRs due to insecure APIs or weak authentication mechanisms can expose sensitive patient information. A comprehensive analysis of healthcare data breaches from 2010 to 2019 revealed that hacking and IT incidents were the most prevalent causes, with a significant increase in recent years [83].
• Replay attacks: Medical IoT devices, such as smart insulin pumps and pacemakers, rely on wireless communication for remote configuration and monitoring. In a replay attack, an attacker intercepts and resends previous commands to manipulate drug dosages or disable life-saving equipment, potentially leading to fatal consequences. Studies have highlighted vulnerabilities in wireless infusion pumps, which could be exploited for malicious purposes [84].
• Adversarial AI attacks: Many smart healthcare systems use AI-driven diagnostic models to detect health conditions based on sensor data. Attackers can manipulate input data (e.g., ECG readings, blood glucose levels) to trick AI models into misdiagnosing conditions, leading to incorrect treatments. Research has shown that adversarial attacks on medical image classification systems can lead to misdiagnoses, posing significant risks to patient safety [85].

6.2. Applied Security Solutions

To mitigate these security risks, various IoT–cloud security solutions have been implemented in smart healthcare, as follows:

• Lightweight cryptography: Given the resource constraints of medical IoT devices, lightweight encryption algorithms such as ECC and PRESENT are used to ensure data confidentiality while maintaining low power consumption. Research has identified that IoT healthcare vulnerabilities in both devices and software pose risks to patient safety and system integrity, making lightweight cryptographic solutions critical [84].
• API security measures: Healthcare APIs are secured using OAuth 2.0 authentication, API gateways, and rate limiting to prevent unauthorized data access and DoS attacks. A study emphasizes the need for robust API security measures in healthcare IoT systems to prevent unauthorized access and data breaches [86].
• AI-based IDS: Machine learning models monitor IoT device activity and detect anomalies in data transmission that may indicate an attack, such as replay attempts or adversarial AI manipulations. Therefore, deep learning techniques would be effective in identifying attack patterns and securing IoT healthcare networks.

6.3. Key Findings and Future Directions

Despite advancements in IoT–cloud security, smart healthcare systems still face critical security challenges. Balancing security with device constraints is a significant challenge for medical IoT devices, which operate with limited processing power and battery life. This makes it difficult to implement strong cryptographic protections. Recent studies emphasize the need for cybersecurity self-evaluation in healthcare organizations to effectively manage security alongside operational constraints [87]. As quantum computing advances, current encryption methods may become outdated, which highlights the need for PQC to secure healthcare data. While specific studies on PQC in healthcare IoT are limited, researchers emphasize the importance of developing quantum-resistant security measures [88]. Additionally, implementing a zero-trust security model, where every device and user must continuously authenticate before accessing cloud services, can mitigate the risk of unauthorized access in healthcare environments. A study suggests that zero-trust security can significantly enhance IoT–cloud integration resilience [89].

By integrating these security measures, smart healthcare systems can enhance patient safety and data protection, ensuring that IoT–cloud-based medical services remain resilient against emerging cyber threats. This case study supports the broader applicability of the IoT–cloud security frameworks discussed in this paper. Also, it highlights the urgent need for ongoing research and adaptive security strategies.

7. Discussion and Open Research Challenges

The integration of IoT and cloud computing has enabled scalable, data-driven services across various industries, but it also introduces critical security risks that remain poorly addressed. IoT devices, which are constrained in terms of processing power and memory, rely on cloud infrastructure for storage and computation. However, multi-tenancy vulnerabilities, API security flaws, adversarial AI attacks, and blockchain scalability issues continue to challenge the security of IoT–cloud environments. While recent research proposes various countermeasures, gaps remain in ensuring end-to-end security from IoT devices to cloud services. This section provides a critical analysis of the reviewed studies that focuses on common trends, weaknesses, and future research directions.

7.1. Evaluation of Current Security Solutions

Cloud computing has become a fundamental component in the realization of IoT ecosystems, offering scalable resources and on-demand computing power. As IoT devices generate massive amounts of data, cloud platforms provide an ideal solution for processing, storage, and analytics. However, cloud environments, particularly when integrated with the IoT, present unique security concerns that remain poorly addressed in many solutions.

A primary challenge in cloud security is ensuring data privacy, confidentiality, and integrity across multi-tenant environments. While IAM systems have been developed to address these issues, they still face challenges, such as maintaining consistent access control policies across hybrid environments and scaling with rapidly growing IoT devices and data streams. Existing IAM solutions often fail to secure cloud orchestration platforms that control and manage cloud resources, leaving them susceptible to insider threats and unsecure APIs [4]. These vulnerabilities can become worse in IoT–cloud systems where the interaction between resource-constrained devices and robust cloud infrastructures creates a complex attack surface.

Additionally, the multi-tenancy nature of cloud systems poses further risks, such as the potential for resource isolation failures, privacy breaches, and service unavailability. These issues arise when multiple tenants (e.g., IoT service providers and consumers) share the same cloud infrastructure. Current research proposes solutions like MFA, but these face limitations due to the cloud’s inherent flexibility, leading to inconsistent security implementation across various services.

To mitigate these risks, blockchain-based identity management has been explored for secure access control and decentralized authentication mechanisms. AI-driven security monitoring can enhance cloud threat detection by analyzing real-time attack patterns. However, these solutions require further refinement to handle cross-tenant security issues and dynamic cloud workloads efficiently.

7.2. IoT–Cloud Integration and Emerging Trends

The integration of the IoT with cloud systems has introduced new research areas, especially in terms of security. Since IoT devices are often deployed in diverse and resource-limited environments, traditional cloud security measures, such as encryption and access control, may not always be suitable. To address these challenges, lightweight cryptography has emerged as a promising solution. Algorithms like ECC and lightweight ciphers such as PRESENT, SIMON, and SPECK are being explored to ensure secure communication while minimizing the strain on the limited resources of IoT devices [45].

Despite the potential of lightweight cryptography, scalability remains a critical challenge. Many IoT systems, particularly those deployed in large-scale industrial contexts like IIoT, require real-time processing and low latency. Traditional cryptographic techniques like RSA and AES are too resource-intensive for IoT devices and fail to provide adequate scalability for large-scale deployments. This issue is particularly significant in IIoT systems where timely decision-making and security are critical. Therefore, lightweight cryptographic methods must balance between maintaining robust security and optimizing the efficiency of IoT systems. As IoT ecosystems develop, further exploration into hybrid models of cryptography, which combine lightweight and traditional methods, could offer more scalable solutions.

Moreover, recent research has highlighted the role of AI in enhancing IoT–cloud security. AI-driven anomaly detection and IDSs have proven to be effective in identifying suspicious activities within IoT networks. However, the vulnerability of AI models to adversarial attacks poses a significant risk to their deployment in IoT–cloud systems. Attacks like evasion, poisoning, and model inversion can compromise the performance of AI models, enabling attackers to bypass detection mechanisms and manipulate IoT systems without detection. Future research must focus on enhancing the resilience of AI models against adversarial attacks through techniques such as adversarial training, XAI, and robust optimization. Moreover, the integration of AI and blockchain could further strengthen security by providing decentralized and tamper-proof systems for secure data exchange and authentication.

7.3. Research Gaps and Future Directions

From the analysis of current studies, several research gaps are evident. First, while layered architectures are being proposed for IIoT systems, there is still a critical need for comprehensive end-to-end security frameworks. These frameworks should address the entire data lifecycle from IoT devices to the cloud. Additionally, they must be scalable and adaptable to accommodate various IoT use cases. Second, given the resource constraints of IoT devices, particularly in industrial and consumer contexts, there is a significant demand for lightweight cryptographic solutions. These algorithms must ensure robust security while maintaining good performance and finding a balance, which is critical for the effective operation of IoT devices. Third, as multi-tenancy remains a foundational aspect of cloud services, researchers should concentrate on developing improved resource isolation techniques. Stronger methods are essential to enhance the security of cloud environments to protect against cross-tenant attacks. Finally, integrating AI can enhance real-time detection and response to security threats when, for example, AI is deployed in a financial institution or bank to monitor transactions for malicious activity.

The AI system would analyze massive volumes of transaction data and detect unusual patterns (e.g., unusually large transfers or transactions from high-risk locations). Then, the system can flag suspicious transactions or temporarily suspend them in real time. Therefore, this would make the organization review or stop suspicious transactions before significant losses occur. However, using AI for monitoring financial issues might raise privacy and compliance concerns that need to be addressed. Additionally, applying blockchain technology can create decentralized and tamper-proof IoT–cloud ecosystems. Also, blockchain provides end-to-end traceability, data privacy, authentication, and cryptographic security benefits to address IoT security and privacy issues [65,90]. However, blockchain transactions are processed in blocks, and each block needs to be validated through a consensus mechanism, which causes delays. This latency is a significant concern in IoT–cloud ecosystems, particularly for real-time applications like self-driving vehicles and healthcare systems, where every second counts. These areas are promising for further exploration and validation. Such innovations could significantly strengthen security measures in both cloud and IoT environments.

Final Considerations and Future Impact

IoT–cloud security requires a mixed approach that integrates cryptography, AI-driven security models, and blockchain technology. Even though existing solutions partially address security threats, significant research gaps remain in ensuring scalability, real-time protection, and AI security against adversarial attacks.

The combination of AI-powered threat detection and blockchain-based security frameworks offers a promising direction for decentralized security models. Furthermore, integrating hybrid cryptographic techniques will enhance security performance for resource-constrained IoT devices [91]. Future research should prioritize the development of scalable, low-latency, AI-enhanced security mechanisms that ensure real-time threat detection, automated responses, and secure data transmission. As IoT ecosystems continue to expand into critical areas like healthcare, finance, and industrial automation, addressing these security gaps will be essential for building resilient and trustworthy IoT–cloud infrastructures.

Table 3. Summary of Key Security Challenges in IoT–Cloud Environments.

Risks	Existing Solutions	Future Research Directions
Data privacy and confidentiality in multi-tenant cloud environments	IAM, MFA, blockchain-based identity management	Developing adaptive IAM systems with AI-based anomaly detection, enhancing cross-tenant data isolation
Weak authentication and API security Vulnerabilities	OAuth 2.0, API gateways, rate limiting, secure session management	Strengthening API authentication with AI-driven anomaly detection, enhancing zero-trust API security models
Scalability challenges in lightweight cryptography	ECC and lightweight block ciphers (PRESENT, SIMON and SPECK)	Hybrid cryptographic models for large-scale IoT
Adversarial AI threats in IoT–Cloud security	Adversarial training, XAI, robust AI models (ensemble learning, defensive distillation)	Integrating robust adversarial AI models with blockchain for secure and tamper-proof AI-driven security
Replay attacks on IoT communication channels	Nonce-based authentication, timestamp validation, cryptographic session tokens	Improving real-time secure session management and adaptive authentication for IoT–cloud systems
Blockchain scalability for real-time IoT applications	Optimized blockchain consensus mechanisms (proof-of-authority, DAG-based blockchain)	Developing scalable blockchain solutions with low-latency transaction validation for time-sensitive IoT applications

summarizes risks, existing solutions, and future research directions identified in recent studies to provide a better understanding of the security challenges in IoT and cloud integration.

8. Conclusions

The combination of IoT and cloud computing has reformed data management and processing by enabling real-time monitoring, advanced analytics, and enhanced decision-making. IoT devices generate massive volumes of data that are stored and analyzed in the cloud to facilitate various applications. However, this integration also introduces significant security challenges, including data breaches, virtualization vulnerabilities, insider threats, insecure APIs, adversarial AI attacks, replay attacks, and post-quantum cryptographic concerns. The resource constraints of IoT devices, which are associated with the complexity of securing hybrid cloud environments, make traditional security mechanisms insufficient. Also, the lack of standardized frameworks to address combined IoT–cloud vulnerabilities further worsens the problem. While encryption, access control, and SLAs provide some level of security, emerging approaches such as AI-powered anomaly detection, blockchain-enhanced authentication, and lightweight cryptographic solutions show greater promise. Research highlights critical gaps such as the need for end-to-end security frameworks, lightweight cryptographic solutions for resource-constrained devices, the development of post-quantum cryptographic algorithms suitable for IoT devices, and improved isolation techniques for multi-tenant cloud environments. Replay attacks and adversarial AI threats have emerged as critical concerns, requiring robust countermeasures such as real-time authentication mechanisms and adversarial training models for AI security systems.

Furthermore, the case study on smart healthcare demonstrates how IoT–cloud security risks translate into real-world vulnerabilities that emphasize the urgency of securing medical data, APIs, and IoT-enabled medical devices. Moreover, future efforts should focus on integrating AI for intelligent threat detection, leveraging blockchain for decentralized security models, and optimizing cryptographic techniques for resource-constrained IoT environments. By addressing these challenges, the security, reliability, and scalability of IoT–cloud ecosystems can be significantly improved, ensuring their safe deployment across critical industries.