Architectures for securing low-cost IoT

Student thesis: Doctoral Thesis

Abstract

This PhD study proposes various solutions to enable low-cost Internet of Things (IoT) devices to employ end-to-end encryption, with consideration to the financial and practical requirements of such devices. Manufacturers of IoT devices often sacrifice security in favour of features, user friendliness, time to market or cost, in order to stay ahead of their competitors. However, numerous recent hacks on IoT devices have shown this is unwise. Extremely low-cost, microcontroller-based devices, in particular struggle to create sufficient random data required for state-of-the-art security features. This is in stark contrast to common internet connected devices such as smartphones, and personal computers, which with their high-performance processors can generate sufficient randomness to implement state of the art security features. Through taking advantage of existing devices this PhD study enables these extremely low-cost devices implement state of the art security features. One such existing device is a smartphone which are abundant and have multiple sources of randomness for strong key generation. This abundance and power enables two discrete architectures to be proposed which offload key generation and transfer to the user's smartphone, removing the requirement for constrained IoT devices to participate in public key infrastructure. The first proposed architecture takes advantage of the ubiquity of Wi-Fi in consumer devices, and employs it as a key transfer mechanism. The design only requires a {dollar}1 general-purpose microcontroller and a Wi-Fi module. The performance of such an architecture was modelled, and a threat analysis conducted. The design allows all communication to and from the device to be encrypted, without any additional manufacturing cost or sacrificing user experience. Since the architecture does not require any additional hardware, it can be retroactively applied and deployed to existing devices through a firmware update. This architecture has been integrated into a smart light switch product. The second architecture targeted at increasingly popular low-power wide-area networks (LPWAN) technologies, such as LoRaWAN. Future utility networks will require much greater levels of machine to-machine interaction to enable smart grid applications, and ultimately increase the efficiency of the network. In response a low-cost LPWAN module was developed to be retrofitted to existing monitoring device, Fault Passage Indicators (FPI), creating an automatic remote detection and location system for medium voltage faults, reducing the time to find faults from hours to minutes. This prototype device was then tested on a physical 11kV overhead line network, where the device demonstrated it was robust and suitable for mass deployment on a live network. The finalised prototype module costs roughly 5% of a single FPI unit, making the solution cost effective. The system additionally features the ability to remotely reconfigure the FPI, making the installation and future maintenance more convenient. Two high costs in a full-scale LPWAN deployment are the cost of deployment and the potential cost of re-keying the compromised network. Therefore, this thesis also explores methods of decentralising sensor device deployment using commonly available hardware. It details a procedure which uses a smartphone's camera ash to transfer the necessary credentials to such low-cost sensor devices. As with the domestic Wi-Fi-based solution, smartphones were chosen as a transfer mechanism since they are both abundant and suitably powerful to generate random keys. Using smartphone's LED ash removes the need for a wired connection, a laptop, and programming software, allowing devices to be provisioned out in the _eld without the need for specialised tools or knowledge. An implementati
Date of Award31 Jul 2020
Original languageEnglish
Awarding Institution
  • University Of Strathclyde
SponsorsUniversity of Strathclyde
SupervisorJames Irvine (Supervisor) & Christos Tachtatzis (Supervisor)

Cite this

'