The capability to securely (re)program embedded devices over-the-air is a fundamental functionality for the emerging Internet of Things (IoT). Current approaches work efficiently by exploiting the homogeneity within sensing devices, where all nodes require the update and participate in the process. Due to the heterogeneity of IoT deployments, where the type of devices and program images vary, existing solutions suffer from severe performance degradation. We address this shortcoming with our system SEDA, which leverages a secure multicast approach. SEDA outperforms existing systems since the program image is securely delivered and processed on targeted nodes only, hence reducing the overhead for not involved nodes. In order to enable the multicast approach, we introduce an asymmetric broadcast encryption primitive, which we have optimized towards constrained nodes to reduce the communication/computation overhead as compared to existing approaches. With an extensive experimental study on a public testbed in several practical settings, we show SEDA's efficient performance compared to state-of-the-art approaches. Finally, our theoretical security analysis shows SEDA's security against identified adversary models.

IoT applications often utilize the cloud to store and provide ubiquitous access to collected data. This naturally facilitates data sharing with third-party services and other users, but bears privacy risks, due to data breaches or unauthorized trades with user data. To address these concerns, we present Pilatus, a data protection platform where the cloud stores only encrypted data, yet is still able to process certain queries (e.g., range, sum). More importantly, Pilatus features a novel encrypted data sharing scheme based on re-encryption, with revocation capabilities and in situ key-update. Our solution includes a suite of novel techniques that enable efficient partially homomorphic encryption, decryption, and sharing. We present performance optimizations that render these cryptographic tools practical for mobile platforms. We implement a prototype of Pilatus and evaluate it thoroughly. Our optimizations achieve a performance gain within one order of magnitude compared to state-of-the-art realizations; mobile devices can decrypt hundreds of data points in a few hundred milliseconds. Moreover, we discuss practical considerations through two example mobile applications (Fitbit and Ava) that run Pilatus on real-world data.

Low-power wireless devices suffer notoriously from Cross- Technology Interference (CTI). To enable co-existence, researchers have proposed a variety of interference mitigation strategies. Existing solutions, however, are designed to work with the limitations of currently available radio chips. In this paper, we investigate how to exploit physical layer properties of 802.15.4 signals to better address CTI. We present CrossZig, a cross-layer solution that takes advantage of physical layer information and processing to improve low-power communication under CTI. To this end, CrossZig utilizes physical layer information to detect presence of CTI in a corrupted packet and to apply an adaptive packet recovery which incorporates a novel cross-layer based packet merging and an adaptive FEC coding. We implement a prototype of CrossZig for the low-power IEEE 802.15.4 in a software-defined radio platform. We show the adaptability and the performance gain of CrossZig through experimental evaluation considering both micro-benchmarking and system performance under various interference patterns. Our results demonstrate that CrossZig can achieve a high accuracy in error localization (94.3% accuracy) and interference type identification (less than 5% error rate for SINR ranges below 3 dB). Moreover, our system shows consistent performance improvements under interference from various interfering technologies.

Internet of Things (IoT) applications today often utilize the cloud to provide storage and ubiquitous access to collected data. Leaving such granular, sensitive, and personal data unprotected on the cloud and vulnerable to system breaches or curious administrators is critical. In this extended abstract, we present Talos [3], a framework that embraces the computational resources available in the cloud and exploits them for encrypted data processing (e.g., using partially homomorphic encryption schemes). We have developed Talos further to enable encrypted data sharing, such that users can securely share their homomorphically encrypted data with add-on services and other users. We demonstrate a prototype implementation of a real-world application utilizing Talos. Talos enables applications to efficiently store and interact with encrypted sensory data in the cloud. With our prototype application, we show that with Talos in place the user experience remains unchanged (i.e., response time below 1 s) although all operations over data in the cloud incorporate encrypted data processing. Moreover, we demonstrate how Talos can be smoothly integrated into IoT apps (currently supporting Contiki and Android). Hence, we hope to encourage the development of secure IoT applications on top of the Talos framework.

We identify and address two primary challenges for computing on encrypted data in Internet of Things applications: synchronizing encrypted data across devices and selecting an appropriate encryption scheme. We propose a caching mechanism that operates across the three devices, enabling interactive order-preserving encryption schemes on resource-constrained devices. Additionally, the system can use a high-level description of an IoT application to select automatically appropriate encryption for the data on corresponding tiers and their mathematical operations. This assists in fine-tuning and choosing the core parameters for underlying data structures.

The rise of heterogeneity in wireless technologies operating in the unlicensed bands has been shown to adversely affect the performance of low-power wireless networks. Cross-Technology Interference (CTI) is highly uncertain and raises the need for agile methods that assess the channel conditions and apply actions maximizing communication success. In this paper, we present TIIM, a lightweight Technology-Independent Interference Mitigation solution that detects, quantifies, and reacts to CTI in realtime. TIIM employs a lightweight machine learning classifier to (i) decide whether communication is viable over the interfered link, (ii) characterize the ambient conditions and apply the best coexistence mitigation strategy. We present an in-depth experimental characterization of the effect of CTI on 802.15.4 links, which motivated and influenced the design of TIIM. Our evaluation shows that TIIM, while exposed to extensive and heterogeneous interference, can achieve a total PRR improvement of 30% with an additional transmission overhead of 5.6%.

The Internet of Things (IoT) is envisioned to digitize the physical world, resulting in a digital representation of our proximate living space. The possibility of inferring privacy violating information from IoT data necessitates adequate security measures regarding data storage and communication. To address these privacy and security concerns, we introduce our system that stores IoT data securely in the Cloud database while still allowing query processing over the encrypted data. We enable this by encrypting IoT data with a set of cryptographic schemes such as order-preserving and partially homomorphic encryptions. To achieve this on resource-limited devices, our system relies on optimized algorithms that accelerate partial homomorphic and order-preserving encryptions by 1 to 2 orders of magnitude. Our early results show the feasibility of our system on low-power devices. We envision our system as an enabler of secure IoT applications.

We present a system that leverages physical layer features to combat Cross-Technology Interference (CTI) in low-power wireless networks. Our system incorporates: (i) a lightweight interference detection mechanism for low-power radios that recognizes the type of interference in the received signal, (ii) a lightweight error detection mechanism to estimate and characterize error patterns within interfered packets, and (iii) a CTI-aware protocol that dynamically adapts transmission and recovery mode to the current interference patterns. We implement a prototype of our system for the low-power IEEE 802.15.4 in software-defined radios (SDR). Our early results of the system components demonstrate that we can achieve a high accuracy in error detection and interference type identification. Moreover, we observed a significant performance improvement compared to the standard 802.15.4 systems without interference-awareness.

Current Wireless Sensor Networks (WSNs) approaches do not provide an efficient and secure code dissemination function due to emerging issues of IoT applications. In this work, we adopt a multicast approach instead of the existing end-to-end or epidemic approaches. In order to enable the multicast approach, we propose an efficient/robust group key distribution scheme. We will evaluate and quantify the performance of our prototype implementation in a public testbed, while emulating several practical IoT settings, and show our security measures against known attack models.

The Internet of Things, by digitizing the physical world, is envisioned to enable novel interaction paradigms with our surroundings. This creates new threats and leads to unprecedented security and privacy concerns. To tackle these concerns, we introduce Talos, a system that stores IoT data securely in a Cloud database while still allowing query processing over the encrypted data. We enable this by encrypting IoT data with a set of cryptographic schemes such as order-preserving and partially homomorphic encryption. In order to achieve this in constrained IoT devices, Talos relies on optimized algorithms that accelerate order-preserving and partially homomorphic encryption by 1 to 2 orders of magnitude. We assess the feasibility of Talos on low-power devices with and without cryptographic accelerators and quantify its overhead in terms of energy, computation, and latency. With a thorough evaluation of our prototype implementation, we show that Talos is a practical system that can provide a high level of security with a reasonable overhead. We envision Talos as an enabler of secure IoT applications.

Low-power wireless networks deployed in indoor environments inevitably encounter high-power Cross Technology Interference (CTI) from a wide range of wireless devices operating in the shared RF spectrum bands. This severely reduces the performance of such networks and possibly causes loss of connectivity, which affects their availability and drains their resources. In this work, to address the channel uncertainty, a consequence of CTI, we propose a novel channel metric that (i) harnesses the local knowledge of a node about the wireless channel to discern the presence of persistent high-power interferers, and (ii) assists the node in inferring its proximity to the dominant interference sources in the physical space. In order to motivate and validate the necessity of such a metric, we empirically characterize the impact of the interaction between high/low-power cross technology interferers and IEEE 802.15.4.

Novel Internet services are emerging around an increasing number of sensors and actuators in our surroundings, commonly referred to as smart devices. Smart devices, which form the backbone of the Internet of Things (IoT), enable alternative forms of user experience by means of automation, convenience, and efficiency. At the same time new security and safety issues arise, given the Internet-connectivity and the interaction possibility of smart devices with human's proximate living space. Hence, security is a fundamental requirement of the IoT design. In order to remain interoperable with the existing infrastructure, we postulate a security framework compatible to standard IP-based security solutions, yet optimized to meet the constraints of the IoT ecosystem. In this ongoing work, we first identify necessary components of an interoperable secure End-to-End communication while incorporating Public-key Cryptography (PKC). To this end, we tackle involved computational and communication overheads. The required components on the hardware side are the affordable hardware acceleration engines for cryptographic operations and on the software side header compression and long-lasting secure sessions. In future work, we focus on integration of these components into a framework and the evaluation of an early prototype of this framework.

This paper presents a proximity-based authentication approach for the Internet of Things (IoT) that works in-band by solely utilizing the wireless communication interface. The novelty of this approach lies in its reliance on ambient radio signals to infer proximity within about one second, and in its ability to expose imposters located several meters away. We identify relevant features sensed from the RF channel to establish a notion of proximity across co-located low-power devices. We introduce our proximity-based authentication protocol and show the feasibility of our approach with an early prototype using off-the-shelf 802.15.4 sensors and an evaluation conducted in a real-world environment.

IP technology for resource-constrained devices enables transparent end-to-end connections between a vast variety of devices and services in the Internet of Things (IoT). To protect these connections, several variants of traditional IP security protocols have recently been proposed for standardization, most notably the DTLS protocol. In this paper, we identify significant resource requirements for the DTLS handshake when employing public-key cryptography for peer authentication and key agreement purposes. These overheads particularly hamper secure communication for memory-constrained devices. To alleviate these limitations, we propose a delegation architecture that offloads the expensive DTLS connection establishment to a delegation server. By handing over the established security context to the constrained device, our delegation architecture significantly reduces the resource requirements of DTLS-protected communication for constrained devices. Additionally, our delegation architecture naturally provides authorization functionality when leveraging the central role of the delegation server in the initial connection establishment. Hence, in this paper, we present a comprehensive, yet compact solution for authentication, authorization, and secure data transmission in the IP-based IoT. The evaluation results show that compared to a public-key-based DTLS handshake our delegation architecture reduces the memory overhead by 64 %, computations by 97 %, network transmissions by 68 %.

6LoWPAN is an IPv6 adaptation layer that defines mechanisms to make IP connectivity viable for tightly resource-constrained devices that communicate over low power, lossy links such as IEEE 802.15.4. It is expected to be used in a variety of scenarios ranging from home automation to industrial control systems. To support the transmission of IPv6 packets exceeding the maximum frame size of the link layer, 6LoWPAN defines a packet fragmentation mechanism. However, the best effort semantics for fragment transmissions, the lack of authentication at the 6LoWPAN layer, and the scarce memory resources of the networked devices render the design of the fragmentation mechanism vulnerable.