Elevating SIoT Security: A 3D Leap Over the Complexity of 2D Modelling

TL;DR

As Social IoT (SIoT) blends human interaction with billions of smart devices, the security landscape has become too dense for traditional 2D flowcharts. This paper presents a 3D Security Modelling Platform built on Unity, extending BPMN into the third dimension. By separating security requirements onto a vertical axis and using game-engine modularity, the researchers achieved a 169% accuracy boost in identifying security flaws compared to conventional 2D methods.

The "Sticker" Problem: Why 2D BPMN Fails

In the world of Business Process Model and Notation (BPMN), adding security has traditionally been an exercise in "stamping." If a task needs encryption, access control, and privacy logging, authors simply pile three icons onto one box.

The Pain Point: As SIoT environments scale, these diagrams become a cluttered "alphabet soup." Previous extensions suffered from:

• Construct Deficit: Missing 80% of necessary security concepts (e.g., non-repudiation or binding of duty).
• Cognitive Overload: The human brain struggles to differentiate 10+ overlapping icons on a single 2D plane.
• Poor Semantic Transparency: Using a simple "padlock" for every security concept makes it impossible to distinguish Authentication from Integrity at a glance.

Methodology: The Geometry of Security

The authors' core insight is to treat security not as a flat attribute, but as a perpendicular dimension.

1. The 3D Architecture

By using the Unity engine, the SIoT scenario (the business logic) stays on the horizontal "ground" plane (X/Z axes). Security requirements are "holders" that grow vertically (Y-axis).

Fig 1: The standard 2D view vs. the proposed 3D spatial separation.

2. The Physics of Notations

Following Daniel Moody’s "Physics of Notations," the team designed a shield-based visual vocabulary:

• Perceptual Discriminability: Security is always a shield; IoT tasks are rectangles. They never look alike.
• Visual Expressiveness: They utilized 7 out of 8 visual variables, including Brightness (higher hierarchy symbols are brighter), Color (coding for 6 core areas like Privacy vs. Integrity), and Vertical Position.

Fig 2: Example of visual variables applied to shield notations.

3. Modularization & Game Logic

To prevent a "forest of shields," the platform uses game-like interaction logic. If a user clicks on the "Access Control" shield, only its children (Authentication, Authorization) appear, while others collapse. This ensures the user only sees 6 constructs at a time, staying well within the limits of human working memory.

Experimental Results: Complexity is 3D's Best Friend

The researchers tested their platform against standard 2D models. The results were telling:

• Simple Diagrams: For low-complexity tasks, users preferred 2D for its familiarity.
• Complex SIoT Scenarios: When the diagram included 36 security constructs, the 3D platform crushed the competition.

Fig 3: Accuracy and completion rates showing the massive efficiency gain in 3D (red) vs 2D (blue).

Key Stat: Users completed 21% more tasks with double the accuracy just by switching the view from flat to depth.

Critical Insight & Conclusion

The genius of this work isn't just "putting things in 3D"; it's the ontological mapping behind the graphics. By creating an ontology of 79 cyber-security requirements first, and then mapping them to a hierarchical 3D interface, the authors solved the "construct deficit" that plagued BPMN for a decade.

Limitations:

• Navigation Curve: Managing a 3D camera (WSAD keys) may be difficult for non-gamers.
• Asset Production: Creating 3D textures for every security nuance is more labor-intensive than 2D icons.

The Takeaway: As IoT environments evolve into "Social" entities involving human-device interaction, our modelling tools must evolve too. This paper proves that spatial depth is not just a gimmick—it's a fundamental tool for managing the exploding complexity of modern cyber-physical security.