A Traceability and Assessment Framework for Information Assurance of Internet of Things Systems: Use Cases

Introduction

Internet of Things (IoT) systems are increasingly complex, integrating heterogeneous devices, cloud services, and artificial intelligence (AI). Conducting Information Assurance (IA) analyses across these systems is labor-intensive, inconsistent, and difficult to trace. This work presents a platform architecture that integrates AI-assisted information flow analysis, formal IA modeling, quantitative assessment, and automated reporting to provide a repeatable and auditable framework for IA analyses of IoT systems.

Methods

The proposed platform employs a three-layer architecture consisting of user interface, application/services, and data layers. An extensible multidimensional IA cube organizes assurance activities across assurance characteristics, information states, and assurance measures. Large language models assist analysts by extracting information flows and proposing assurance measures, while traceability mappings link information items to IA tasks, evidence, and completion status. Progress is quantified through coverage metrics and visualized using spider charts. Structured PDF reports are automatically generated from the underlying data model.

Results

A prototype implementation illustrates integrated IA modeling, AI-assisted workflow, traceability, and automated reporting. The architecture was applied to three IoT domains: automatic emergency braking, pressure-controlled mechanical ventilation, and sports medicine injury monitoring. 

To illustrate the information assurance content this framework has revealed, consider the pressure-controlled mechanical ventilator use case. It revealed the IA model of the ventilator, including individual information items exchanged during operation and it maps out traceability of the requirements added to the IA characteristic addressed. Finally, a full report of information items addressed and the traceability is generated.

Conclusions

The proposed platform provides a scalable and extensible environment for conducting Information Assurance analyses of IoT systems. By combining IA modeling with AI-assisted workflow and auditable traceability, the architecture improves consistency, transparency, and repeatability while preserving human oversight of AI-generated artifacts. The results demonstrate the feasibility of integrating modern AI capabilities into structured IA engineering applicable across diverse cyber-physical domains.