A Blockchain-Based OCF Firmware Update for IoT Devices

In the IEEE S&P 2017, Ronen et al. exploited side-channel power analysis (SCPA) and approximately 5 000 power traces to recover the global AES-CCM key that Philip Hue lamps use to decrypt and authenticate new firmware. Based on the recovered key, the attacker could create a malicious firmware update and load it to Philip Hue lamps to cause Internet of Things (IoT) security issues. Inspired by the work of Ronen et al., we propose an AES-CCM-based firmware update scheme against SCPA and denial of service (DoS) attacks. The proposed scheme applied in IoT terminal devices includes two aspects of design (i.e., bootloader and application layer). Firstly, in the bootloader, the number of updates per unit time is limited to prevent the attacker from acquiring a sufficient number of useful traces in a short time, which can effectively counter an SCPA attack. Secondly, in the application layer, using the proposed handshake protocol, the IoT device can access the IoT server to regain update permission, which can defend against DoS attacks. Moreover, on the STM32F405+M25P40 hardware platform, we implement Philips’ and the proposed modified schemes. Experimental results show that compared with the firmware update scheme of Philips Hue smart lamps, the proposed scheme additionally requires only 2.35 KB of Flash memory and a maximum of 0.32 s update time to effectively enhance the security of the AES-CCM-based firmware update process.

The Internet of Things (IoT) technology has grown rapidly over the past decade, resulting in deployments of thousands of IoT devices around the world. Then, managing firmware updates for these numerous devices poses significant challenges. Firmware updates face issues such as version rollback, modified firmware files, and potential man-in-the-middle (MITM) attacks, highlighting the need for a secure over-the-air (OTA) firmware update mechanism. In this paper, we propose an automated OTA firmware update mechanism, integrated with continuous integration (CI) and continuous delivery (CD) to ensure trusted sources for firmware origins. It offers security, error handling during firmware updates, and monitoring of the update process. For evaluations, we implemented the proposal with the SEMAR IoT application server that has been implemented in our previous studies. Then, we verified the integrity and authentication, measured the performance and resource utilization, and performed benchmarking tests to assess the efficiency. The results demonstrate that the proposal is sufficiently reliable and efficient.

The increase of relying on intelligent and connected devices in our home, company, and everyday life aspect leads to the rapid growth of the Internet of Things (IoT) technology. While some IoT devices communicate without the involvement of users, their functionalities must be protected against various attacks. This work proposes the delivery of a secure firmware update to IoT devices. Ensuring fast firmware updates should be implemented using a trusted network. In our proposal, we deployed blockchain to be our trusted network. The approach will be based on securely verifying the firmware version of the IoT device, validating the integrity of the firmware file, downloading the latest version of the firmware update. The primary objective is to mitigate the attacks targeting firmware updates of embedded devices by maintaining and guaranteeing the firmware is up-to-date and not altered in the IoT devices.

The number of Internet of Things (IoT) devices has increased recently and will increase further in the future. IoT devices are vulnerable, so vendors update and distribute firmware. At the time of firmware distribution, a huge number of IoT devices may connect to the firmware server and excessive network traffic may occur. Consequently, a method using a peer-to-peer file sharing system and a blockchain has been proposed. One study proposed an update scheme considering incentives for distributors to help with updating. However, this method requires the IoT devices, which have limited processing power, to decrypt encrypted files, and the distribution nodes to pay the transaction cost. This paper proposes a firmware distribution method that provides incentives for distributors to help with distribution to reduce the gas costs, using a smart contract and access control based on update records. The additional computations performed by IoT devices and distributors key management were reduced compared to those in previous studies by using access control instead of encryption. Further, the proposed approach was implemented and evaluated using a Raspberry Pi and laptop. The evaluation demonstrated that the gas cost per update was successfully lowered compared to the costs in previous studies.

The deployment of a client–server-based distributed intelligent system involves application development in both the network domain and the device domain. In the network domain, an application server (typically in the cloud) is deployed to execute the network applications. In the device domain, several Internet of Things (IoT) devices may be configured as, for example, wireless sensor networks (WSNs), and interact with each other through the application server. Developing the network and the device applications are tedious tasks that are the major costs for building a distributed intelligent system. To resolve this issue, a low-code or no-code (LCNC) approach has been purposed to automate code generation. As traditional LCNC solutions are highly generic, they tend to generate excess code and instructions, which will lack efficiency in terms of storage and processing. Fortunately, optimization of automated code generation can be achieved for IoT by taking advantage of the IoT characteristics. An IoT-based distributed intelligent system consists of the device domain (IoT devices) and the network domain (IoT server). The software of an IoT device in the device domain consists of the Device Application (DA) and the Sensor Application (SA). Most IoT LCNC approaches provide code generation in the network domain. Very few approaches automatically generate the DA code. To our knowledge, no approach supports the SA code generation. In this paper, we propose DeviceTalk, an LCNC environment for the DA and the SA code development. DeviceTalk automatically generates the code for IoT devices to speed up the software development in the device domain for a distributed intelligent system. We propose the DeviceTalk architecture, design and implementation of the code generation mechanism for the IoT devices. Then, we show how a developer can use the DeviceTalk Graphical User Interface (GUI) to exercise LCNC development of the device software.

SummaryRecently, the deployment of novel smart network concepts, such as the Internet of things (IoT) or machine‐to‐machine communication, has gained more attention owing to its role in providing communication among various smart devices. The IoT involves a set of IoT devices (IoTDs) such as actuators and sensors that communicate with IoT applications via IoT gateways without human intervention. The IoTDs have different traffic types with various delay requirements, and we can classify them into two main groups: critical and massive IoTDs. The fundamental promising technology in the IoT is the advanced long‐term evolution (LTE‐A). In the future, the number of IoTDs attempting to access an LTE‐A network in a short period will increase rapidly and, thus, significantly reduce the performance of the LTE‐A network and affect the QoS required by variant IoT traffic. Therefore, efficient resource allocation is required.In this paper, we propose a priority‐based allocation scheme for multiclass service in IoT to efficiently share resources between critical and massive IoTD traffic based on their specific characteristics while protecting the critical IoTDs, which have a higher priority over the massive IoTDs. The performance of the proposed scheme is analyzed using the Geo/G/1 queuing system focusing on QoS guarantees and resource utilization of both critical and massive IoTDs. The distribution of service time of the proposed system is determined and, thus, the average waiting and service times are derived. The results indicate that the performance of the massive IoTDs depends on the data traffic characteristics of the critical IoTDs. Furthermore, the results emphasize the importance of the system delay analysis and demonstrate its effects on IoT configurations.

The Internet of Things (IoT) which creates a hyper-connected society is playing a major role in the 4th industrial revolution. The IoT is being leveraged across various fields of business globally and the number of IoT devices is causing serious security concerns. Since the firmware update of an IoT device is necessary for its lifecycle, secure firmware update of the IoT device is being brought as the first step in IoT security. The Internet Engineering Task Force (IETF) Software Updates for Internet of Things (SUIT) working group has started to specify a software update architecture for IoT devices. However, the current SUIT working group adopts a traditional client-server model to distribute firmware images, which potentially causes security risks. The current approach of the SUIT working group is unable to solve a targeting issue and an author-disappearing issue, which is suggested in this paper. Therefore, in this work, we introduce a distributed firmware update architecture based on the SUIT firmware update architecture applying blockchain. Our update architecture can prevent the issues we concern through the characteristics of blockchain, such as decentralization, transparency, and irreversibility. The blockchain network has registration nodes that process registration of manifest and firmware image files from authors, and retrieval nodes that process downloading manifest and firmware image files. The firmware image files are stored in a distributed file system and the hash values of firmware image chunks are stored on the blockchain with manifest files. The proposed architecture in this paper enables the irreversible downloads even in the author-disappearing state and tolerant to a single point of failure.

The Internet of Things (IoT) devices is able to communicate with another IoT devices in heterogeneous environments. They are also able to create a network by their own using wireless capabilities without a centralized approach. This network is called wireless mobile ad hoc network (MANET). The MANET facilitate IoT devices to communicate with each other in an infrastructure less network of the Internet of Things environment. The IoT devices can dynamically join, create connection and exchange information among them. The role of cloud in this framework is to store and process the data by IoT devices. The communication Security has been raised as one of the most critical issues of cloud computing where resolving such an issue would result in a constant growth in the use and popularity of cloud. Our purpose of this study is to create a framework for providing the communication in an integrated framework of Cloud and MANET among IoT devices. Our main contribution links a new study that integrates cloud computing to the MANET and provides communication to the internet of things. This study can be used in the framework of the Internet of Things in future.

With the advancement of 5G mobile telecommunication, various IoT (Internet of Things) devices communicate massive amounts of data by being connected to wireless networks. Since this wireless communication is vulnerable to hackers via data leakage during communication, the transmitted data should be encrypted through block ciphers to protect the data during communication. In addition, in order to encrypt the massive amounts of data securely, it is essential to apply one of secure mode of operation. Among them, CTR (CounTeR) mode is the most widely used in industrial applications. However, these IoT devices have limited resources of computing and memory compared to typical computers, so that it is challenging to process cryptographic algorithms that have computation-intensive tasks in IoT devices at high speed. Thus, it is required that cryptographic algorithms are optimized in IoT devices. In other words, optimizing cryptographic operations on these IoT devices is not only basic but also an essential effort in order to build secure IoT-based service systems. For efficient encryption on IoT devices, even though several ARX (Add-Rotate-XOR)-based ciphers have been proposed, it still necessary to improve the performance of encryption for smooth and secure IoT services. In this article, we propose the first parallel implementations of CTR mode of ARX-based ciphers: LEA (Lightweight Encryption Algorithm), HIGHT (high security and light weight), and revised CHAM on the ARMv8 platform, a popular microcontroller in various IoT applications. For the parallel implementation, we propose an efficient data parallelism technique and register scheduling, which maximizes the usage of vector registers. Through proposed techniques, we process the maximum amount of encryption simultaneously by utilizing all vector registers. Namely, in the case of HIGHT and revised CHAM-64/128 (resp. LEA, revised CHAM-128/128, and CHAM-128/256), we can execute 48 (resp. 24) encryptions simultaneously. In addition, we optimize the process of CTR mode by pre-computing and using the intermediate value of some initial rounds by utilizing the property that the nonce part of CTR mode input is fixed during encryptions. Through the pre-computation table, CTR mode is optimized up until round 4 in LEA, round 5 in HIGHT, and round 7 in revised CHAM. With the proposed parallel processing technique, our software provides 3.09%, 5.26%, and 9.52% of improved performance in LEA, HIGHT, and revised CHAM-64/128, respectively, compared to the existing parallel works in ARM-based MCU. Furthermore, with the proposed CTR mode optimization technique, our software provides the most improved performance with 8.76%, 8.62%, and 15.87% in LEA-CTR, HIGHT-CTR, and revised CHAM-CTR, respectively. This work is the fastest implementation of CTR mode on ARMv8 architecture to the best of our knowledge.

DDoS attacks often happen in cloud servers and cause a devastating problem. However, an increasing number of Internet of Things (IoT) devices makes us not ignore the influence of large-scale DDoS attacks from IoT devices. In this paper, we propose a machine learning-based on a multi-layer IoT DDoS attack detection system, including IoT devices, IoT gateways, SDN switches, and cloud servers. Firstly, we build eight smart poles with various sensors on our campus and collect sensor data as our datasets through wireless networks or wired networks. Next, we extract the features based on DDoS attack types. The feature selection can result in high accuracy DDoS attack detection in the real IoT environment. The experimental results show that our multi-layer DDoS detection system can accurately detect DDoS attacks. And the SDN controller can block venomous devices effectively according to blacklists from the results of our IoT DDoS attacks detection system.

Seeing is not always believing: Insights on IoT manufacturing from firmware composition analysis and vendor survey

With the advancement in science and technology, the demand for electronic Internet of Things (IoT) devices has increased to store and process digital data. With the advancement in IoT technology, we are more reliant on IoT devices to perform our regular tasks. IoT Forensics deals with the investigation of IoT devices such as smartphones, tablets, smart watches, or any device which is connected to the Internet. The data on these devices can still be retrieved via IoT forensics even if they are destroyed, resold, or misplaced. Before discarding any IoT device, we must consider how to secure the data stored on them. We are then going to discuss the several types of personal data that could be retrieved from discarded IoT devices. Finally, we are going to discuss the protection measures for the safe disposal of IoT devices.

The Internet of Things (IoT) has had a considerable influence on our daily lives by enabling enhanced connection of devices, systems, and services that extends beyond machine-to-machine interactions and encompasses a wide range of protocols, domains, and applications. However, despite privacy concerns shown by IoT users, little has been done to reduce and protect individual information exposure. It is extremely difficult to mitigate IoT devices from reidentification threats which is why it is still a major challenge for IoT users to securely protect their information. The trust controls how we regulate privacy in our IoT platforms in the same way that it governs personal relationships. As IoT devices become increasingly linked, more data is shared across individuals, businesses, governments, and ecosystems. Technologies, sensors, machines, data, and cloud connections all rely largely on trust relationships that have been formed. With the rapid growth of additional types of IoT devices that are being introduced, it, therefore, expands privacy concerns and is difficult to develop trust with an IoT system or device without the option to regulate information privacy settings. Privacy has always been a barrier for many devices as they race for the early adoption of IoT technologies. Several Internet of Things devices or systems will continue to pose privacy threats. As a result, the main objective of this study was to examine the individual understanding of privacy and to promote information privacy protection awareness not only to IoT users but also to organizations that use IoT devices or platforms to run their day-to-day business operations. Furthermore, the objective extends to compare user knowledge and concerns about IoT privacy, as well as to identify any common attitudes and variances. However, in terms of enhancing individuals’ knowledge, an artifact was developed to educate and enhance information privacy awareness among IoT users. A pre- and postquestionnaire was generated to test and validate user knowledge regarding information privacy protection in IoT. The study was conducted using a quantitative research method. Findings indicate that IoT users’ awareness of information privacy protection turned out to be average, suggesting a need for education and awareness. Several participants stated that information privacy protection awareness is required within the community to educate, raise awareness, eliminate human error, and enable individuals to be conscious of their privacy when surfing the Internet.

In the modern security-conscious world, Deep Packet Inspection (DPI) proxies are increasingly often used on industrial and enterprise networks to perform TLS unwrapping on all outbound connections. However, enabling TLS unwrapping requires local devices to have the DPI proxy Certificate Authority certificates installed. While for conventional computing devices this is addressed via enterprise management, it's a difficult problem for Internet of Things (IoT) devices which are generally not under enterprise management, and may not even be capable of it due to their resource-constrained nature. Thus, for typical IoT devices, being installed on a network with DPI requires either manual device configuration or custom DPI proxy configuration, both of which solutions have significant shortcomings. This poses a serious challenge to the deployment of IoT devices on DPI-enabled intranets. The authors propose a solution to this problem: a method of installing on IoT devices the CA certificates for DPI proxy CAs, as well as other security configuration (security bootstrapping). The proposed solution respects the DPI policies, while allowing the commissioning of IoT and IIoT devices without the need for additional manual configuration either at device scope or at network scope. This is accomplished by performing the bootstrap operation over unsecured connection, and downloading certificates using TLS validation at application level. The resulting solution is light-weight and secure, yet does not require validation of the DPI proxy's CA certificates in order to perform the security bootstrapping, thus avoiding the chicken-and-egg problem inherent in using TLS on DPI-enabled intranets.

As of today, most of the Internet of Things (IoT) devices work in a centralized environment. With IoT devices having to execute thousands of operations per second, it has become difficult for centralized systems to handle such platforms. Also, factors like operational and maintenance cost of these server machines and danger of DoS(Denial of Service) attack on such servers has threatened the practitioners to come up with a more distributed way of storing the contents. With its decentralized and privacy preserving features, blockchain technology fits well into the scheme of things. This mitigates the quintessential challenges faced in most of the centralized systems. In this paper, we are focusing on the new firmware update scheme to perform the update operations securely. We propose a blockchain based solution for managing firmware updates in IoT. Improper management of devices and distribution of firmware updates from the device vendor could sabotage the IoT ecosystem. The objective of this proposed scheme is to verify and distribute the firmware binaries securely to the IoT device deployed by the device vendor. The PUSH-based method is used for a firmware update in which verification of firmware is done by Hash Chain. It preserves the integrity of firmware by linking the latest version information by previous versions information with the help of a smart contract mechanism.