Security and privacy in IoT workshop at the IoT week Lisbon

The workshop had a double focus and was split in two parts.

Preserving security as IoT matures and consolidates from the current fragmentation

The contribution by Leonard Ciprian Pitu from Siemens highlighted that the number of attacks increased dramatically recently. Thus, hacking has become a major concern for manufacturers. It was stressed that security should start on device level, and on the hardware level. Life cycle risks: The impact of a large scale call back of for example white goods and the associated costs could be immense.

The contribution of Alexandros Fragkiadakis from FORTH highlighted that as IoT consists of highly heterogeneous networked entities and networks, a number of challenges have emerged including security, trust and privacy, scalability, legislation, and standardisation issues. The vast majority of the security challenges focus on authentication, access control, confidentiality, integrity, availability, and non-repudiation. A number of traditional security attacks (e.g. jamming), as well as novel attacks (e.g primary user emulation attacks in cognitive radio systems), are difficult to be detected and mitigated in the IoT, for reasons related to the vague ownership of the IoT devices, the resource constrained nature of these devices, standardisation issues, and legislation shortcomings.

The final contribution to the security topic from Antonio Jara (HOP UBIQUITOUS S.L.) discussed that in order to successfully break the traditional silos multi purpose and generic solutions, generic enablers, commodity like solutions and re-use of components are needed. Naturally, this process is expected to further increase complexity and heterogeneity, however integration should handle and manage the resulting heterogeneity. Further to heterogeneity scale is also an issue. Bootstrapping and registration of devices should be automated to scale. Connectivity should be global.

Levels of security – a layered approach is envisioned. Basic security should be present, to which increased levels can be added.

 

Innovation and privacy − approaches and best practices that support the innovation process and lead to actual privacy solutions that sell on the market

Klaus Moessner from the University of Surrey emphasised that we should not forget that ultimately the goal of IoT is to support people – technology solutions are only the means but not the end themselves. This means that users need to be involved. In the project SOCIOTAL a co-creation process is adopted to generate applications and uses that are responding to actual user needs and demands. However, the process needs to be transparent for bootstrap and to gain trust. Example given is measuring use and mileage of elevators to schedule service and maintenance in large block of flats – the Novi Sad case.

Data ownership –in most cases the situation is not black and white. Following the bubble principle, privacy circle / sphere, sensors of my smart phone, or other device might collect data for someone else, upon the initiative of that person. In case of a decision later by that someone else, actual data collected must be removed, but the fact / event that some data was collected cannot be erased.

Also, SOCIOTAL does not directly focus on preventing passing on the data to third parties that was made available. However, there were other research efforts that focused exactly on that − the “sticky policy” approach investigated in iCore was provided as an example.

Open data – principle is that data collected using public money should be of public good and serve the purpose of the community. However, as the presentation from Smart Aarhus by Jesper Algren revealed privacy needs to be observed, which sometimes means that geographic accuracy / precision of data needs to be reduced, or only cumulative data (for example from a certain geographic area) needs to be stored to prevent traceability back to individuals. Furthermore, economic impact and interest should be of concern, as certain data generated might have severe negative impact on property valuation, etc.

Another observation made was that health data / records are immensely sensitive.

Open Data Aarhus, being a small player with administration backing can not afford mistakes similar to the XBOX case, when user data was leaked on a very large scale. Any such or similar incident would have a devastating effect on reputation of the initiative, and would mean the end of the project, political support would stop.

Suggestion from floor – Ivan Meseguer, Institut Mines-Télécom – that a more active international dialogue might be helpful, as the problems the different European countries are facing are similar in this relatively unchartered territory. Admittedly though there are historical and cultural differences also embedded in the various jurisdiction frames and practices. Still, a more active dialogue and sharing of best practices would support and ease the way forward, as opposed to acting in isolation.

IoT edge, the primary attack surface

One of the main messages that emerges from the IoT week discussions in Lisbon concerning security is that the edge including the devices themselves represents the primary attack surface due to the resource constraints of the devices and the associated difficulty to adequately protect them, exacerbated by their physical exposure, being deployed in uncontrolled, or difficult to control environments. This situation is expected to prevail even on the long term as the exposure and resource constrained nature are intrinsic characteristics of the edge. Admittedly, technology advancement is expected to make edge devices somewhat more resourceful and less constrained, but this will not change their position as remaining the weakest point in the IoT − the same level of sophistication and protection that is available in more controlled environments and closer to the core of the system will not become feasible. So the edge is expected to remain the main battlefield with a continued arms race between defence and attack or intrusion, with the defence being in a disadvantaged position.

This message came across clearly, both from the discussions within the IERC constituency and also as part of the dialogue with the CHIST-ERA initiative which has Security and Privacy in the IoT as one of its two focus areas in its 2015 Call for projects looking for long term issues in ICT.

RERUM @ VTC Spring

RERUM co-organised the VTC Spring 2015 workshop for Heterogeneous Networking for the Internet of Things together with the EU FP7 MC-IAPP MESH-WISE project. The workshop included a poster session, where the RERUM architecture was presented (as seen in the photo).
Elias Tragos presented a paper on Rate-adaptive compressive sensing for IoT applications, which was well accepted by the audience, raising a nice discussion.
Stefanos Papadakis presented a paper on Empowering the IoT Heterogeneous Wireless Networking with Software Defined Radio, describing the way RERUM uses SDRs at the gateway to handle with one hardware interface multiple networking technologies.
Vangelis Angelakis presented at the demo session the smart traffic monitoring solution developed by Linkoping University as part of the RERUM use cases for ensuring the privacy of the location of the users.

Furthermore, Septimu Nechifor and Elias Tragos participated at a panel entitled “Networking and data in smart city IoT use cases: challenges and opportunities”, which attracted the interest of the participants, raising triggering questions for the challenges of big data and data analytics in the IoT and how future networks can help for the reliable delivery of the data in IoT use cases.

Approximately 40 participants attended the workshop.

image7 IMG_20150511_110552 IMG_20150511_104905

First long-range test with the RERUM Re-Mote platform

IMG-20150525-WA0014

The RERUM Re-Mote platform was taken for its first long-range test early last week, and the results were promising: a 3.14 Km distance was easily achieved using IEEE 802.15.4g settings (50Kbps on the 868Mhz band), with an average RSSI of -56dBm, higher than the -110dBm sensitivity value our on-board CC1120 RF transceiver can achieve, thus being  possible to reach a higher distance!

IMG-20150525-WA0016

The field test was done near Barcelona with two Re-Motes featuring simple omni-directional antennas with almost no gain, no special fixtures or highly-directive antenas, just good old duct tape and some amazing views at the Parc de la Serralada de Marina.

The results are shown below.

Mountain range test (Canyet) 868MHz IEEE802154g 3Km

With new technologies and players like SIGFOX and the LoRa alliance betting on long-range solutions to unlock the Internet of Things (IoT), specially for Smart City applications, as well as industry-based solutions, the Re-Mote platform provides a compatible sub-1Ghz transceiver to build applications on top of these technologies, as well as IEEE 802.15.4g support to create Open Source solutions based on the best and most used standards.

RERUM aims to provide a complete architectural framework for dependable, reliable, and secure networks to support IoT and Smart City applications, with this goal in mind the Re-Mote platform was developed to tackle the specific need for long range and reliable communication, ultra low-power operation and robust operation.

Zolertia Re-Mote (RERUM mote) platform officially included in Contiki OS!

 

The Zolertia Re-Mote platform has been included in Contiki OS as one of the officially supported platforms, providing developers, hackers, researchers and enthusiast an industrial-ready and easy to use hardware platform to build the next Internet of Things!  The port is available at commit 330e450.

Re-Mote commit Contiki

The Re-Mote platform was jointly developed with Universities and Industry partners inside RERUM FP7 European Project, and ported to Contiki with the collaboration of George Oikonomou from the University of Bristol.

More information about the Re-Mote port and the available features can be browsed in its README file.

The Re-Mote is already available in pre-order at our store, scheduled to be launched by August/September 2015.

RESI 2015 conference

 

Promotional snippet from the organisers’ program.

Promotional snippet from the organisers’ program.

Dr Tryfonas was invited in the above event to discuss the role of smart connected objects, and their security and resilience on the built environment (Photo). RESI is the largest annual industry showcase of the residential housing sector in the UK and features a range of demonstrations, exhibitions and talks that address aspects of housing. Theo represented RERUM and discussed the potential impact of relevant technologies when deployed in the built environment.

RERUM @ Net Futures 2015 event

RERUM participated at the Net Futures 2015 conference that was held 25-26th of March in Brussels.
RERUM had an exhibition booth at the event, demonstrating two very interesting showcases of the technologies that are being developed within the project.
What was demonstrated was:
1) on device signature scheme, where ECDSA was used to sign json messages on the very constrained Zolertia Z1 platform (see here for a video showing this example)
2) Software Defined Radio (SDR) based IoT gateway, which used SDR devices in order to implement entirely in software the protocols for IEEE 802.11 and IEEE 802.15.4. (see here for a video showing this example)
3) Compressive sensing based encryption on temperature and RSSI measurements (see here for the video)
4) a first draft of the RERUM middleware

The booth attracted a lot of visitors who were very interested on the RERUM activities and asked various questions (i.e. how secure are the people’s data right now and what we can do more).

RERUM plans to showcase more advanced examples of its technologies at the IoT week — stay tuned!

DSC01125 DSC01122 DSC01140 DSC01192

RERUM in IERC village at SIDO 2015, Lyon, France

Recent outcomes of the RERUM project were demonstrated at SIDO 2015, an international event where startups, manufacturers, tech companies, digital players, labs, investors, designers, contractors and media gather to explore the Internet of Things and make it the new economy.

20150407_125825

RERUM’s booth attracted many individuals, as well as companies, finding the project’s approach particularly interesting. The majority of the people interested in RERUM expressed their feeling that major players in IoT industry rarely mention anything about privacy and security of data.

20150407_100454

Furthermore, some IoT service providers expressed their interest to incorporate RERUM’s results (e.g., middleware) to 3rd party’s platforms in order to enhance their security and privacy mechanisms, acknowledging the fact that they play a crucial role in IoT business deployment

 

RERUM On Device Signatures (JSON and ECDSA) Prototype

This is a video showing the prototype implementation of the On-Device-Signatures signing JSON formatted temperature data (JSON Sensor Signatures) on a constrained device (Zolertia Z1). This way RERUM ensures seamless integrity protection for measurements from constrained sensors towards the higher levels of the IoT (gateways, middleware, databases, message queues, and applications), and vice versa.

Workshop on Scientific Applications for the Internet of Things (IoT)

16 – 27 March 2015, ICTP-Trieste

http://wireless.ictp.it/school_2015/

Antonio Liñán (Zolertia) was invited as a speaker to participate in the 2015 ICTP workshop about Internet of Things, amongst a fine crowd of speakers from the Academia, International organizations and organizations from all over the world, for 2 hectic weeks, covering a wide range of subjects from basics about sensors and IPv6 to deploying real live IoT applications using Wireless Sensor Networks, cloud platforms and Big Data.

photo 1

Over 30 participants from 25 different countries and most diverse scientific backgrounds were invited at the Abdus Salam International Centre for Theoretical Physics (ICTP), sponsored by the International Telecommunications Union (ITU), the Network Startup Resource Center (NSRC) and NetworkTheWorld (NTW).

The workshop objective was to prepare scientists for the IoT paradigm shift, to begin to evaluate new and developing technologies, establish collaborations and participate in joint efforts with experts in sensor technology, communications, information management, and networking to design and implement prototypes of IoT.

photo 2

Antonio was to organize the hands-on sessions to work on Contiki OS using Zolertia hardware development platforms, covering from basics such as timers, sensors and blinking a LED, to deploy low power and wireless MQTT, CoAP, UDP and RESTFull networks, able to communicate with external IoT known platforms such as Ubidots, Plotly, etc, over IPv6, enabling devices to be reached from anywhere in the world and truly connect things to the Internet.

The Zolertia Re-Mote platform, developed jointly with Universities and Industrial partners in the frame of the European research project RERUM (RERUM: REliable, Resilient and secUre IoT for sMart city applications), was presented to the crowd with a positive feedback from the attendees, as it provides a solution for their most common requirements such as low-power operation, long range to deploy on most diverse environments without range constrains, and industrial grade design, built on top of Open Source tools and resources, enabling researchers and scientists to build their own applications and improve their existing projects, such as “Smart Energy Monitoring” by the University of the Western Cape (UWC), “Wireless Sensor Network for Radiation Monitoring at Argentinean Nuclear Research Reactor RA-6” by the Bariloche Atomic Center, and “IoT for Tea plantation” by the Rajarata University of Sri Lanka.

photo 0

On day eight, the talks were focused on IoT, privacy and security by Stephen Hailes (University College London) and Steve Song (University of Oregon), covering the requirements and challenges for the IoT paradigm such as Trust/key establishment, assurance of middleware and components, secure routing. RERUM tackles these challenges developing a framework based on the concept of “security and privacy by design”, embedding security and reliability on the hardware smart objects (such as the Re-Mote platform), and providing reliable, robust and context-aware communications minimizing the energy consumption.

The feedback and insights gotten from the attendees and speakers at the workshop proved to be very valuable, validates both the Zolertia Re-Mote platform value proposal, and the need for a secure and privacy-aware framework to enable real IoT applications.