Esp32 Iot Health Monitor

Arxiv:1810.04645V2 [Cs.Ni] 5 Mar 2019

If you cite this paper, please use the WF-IoT reference: M. Frey, C. G¨undo˘gan, P. Kietzmann, M. Lenders, H. Petersen, T. C. Schmidt, F. Juraschek,

Information-Centric Networking

Michael Frey∗, Cenk G¨undo˘gan†, Peter Kietzmann†, Martine Lenders‡, Hauke Petersen‡, Thomas C. Schmidt†,

Freie Universit¨At Berlin, Germany‡

Abstract—Industrial production plants traditionally include sensors for monitoring or documenting processes, and actuators for enabling corrective actions in cases of misconfigurations, failures, or dangerous events. With the advent of the IoT, embedded controllers link these ‘things’ to local networks that often are of low power wireless kind, and are interconnected via gateways to some cloud from the global Internet. Inter-networked sensors and actuators in the industrial IoT form a critical subsystem while frequently operating under harsh conditions.

It is currently under debate how to approach inter-networking of critical industrial components in a safe and secure manner. In this paper, we analyze the potentials of ICN for providing a secure and robust networking solution for constrained controllers in industrial safety systems. We showcase hazardous gas sensing in widespread industrial environments, such as refineries, and compare with IP-based approaches such as CoAP and MQTT.

Our findings indicate that the content-centric security model, as well as enhanced DoS resistance are important arguments for deploying Information Centric Networking in a safety-critical industrial IoT. Evaluation of the crypto efforts on the RIOT operating system for content security reveal its feasibility for common deployment scenarios.

Index Terms—DoS resilience, unprotected channel, robust

I. Introduction

Things in the Internet of Things (IoT) are often represented by small embedded controllers which possess orders of mag- nitude less resources (kBytes of memory, MHz CPU speed, mW of power) than regular Internet nodes, but still need to communicate using protocols that interoperate in a common infrastructure. One predominant deployment area is industrial automation and surveillance, since embedded controllers are already prevalent in this industry, and adding a networking layer can generate immediate cost and performance benefits for its users. Initial deployments rely on legacy protocols such as MQTT—convergence on a future common networking standard for the industrial IoT is still under debate.

Today’s things are sensors or actuators that speak with a remote cloud or talk with each other locally. The preva- lent communication for edge devices happens on wireless channels that are from low power lossy networks (LLNs) BLE, or LWPAN standard, these nodes can exchange only small packets at very low rates and sleep frequently. Violating these constraints quickly leads to successive overload, extreme packet losses, and may strongly degrade network operation and node availability. Repeated incidents have shown that the mass of IoT nodes can be both highly threatened and a threat to the global Internet.

Information Centric Networking (ICN) was introduced as a networking paradigm for improved content access in a Future Internet. Ubiquitous caching is a core feature of ICN.

NDN (or CCN) , its most popular flavor, was designed from a strong security perspective as a pure request-response scheme. It became apparent – that ICN exhibits great potential for the IoT. The access of named content instead of distant nodes does not only allow for a much leaner and more robust implementation of a network layer, but in particular the request-response pattern of NDN prevents overloading the receiver with data.

ICN deployment in the IoT has been studied with increasing intensity , –, touching various design aspects and practical use cases. Several implementations have become available in common IoT operating systems. CCN-Lite runs

On Riot , And On Contiki , Ndn Has Been Ported

to RIOT . Thus, grounds are prepared for opening the floor to real-world IoT applications with NDN. In this paper, we discuss central security aspects of NDN using the example of an industrial safety system. We in- troduce a real-world use case which we implemented in a recent prototype and identify key security requirements in Section II. The fundamental security contributions of the ICN networking layer are derived in Section III. Section IV is dedicated to comparative analyses of NDN versus traditional IP-based approaches. We further show by measurements that the underlying crypto-complexity can be well handled by constrained IoT nodes. A summary and an outlook conclude this paper in Section V.

Industrial Environments

Industrial safety and control systems are increasingly in- terconnected to interchange operational conditions locally and to report their status updates to external observers. A typical deployment scenario consists of IoT stub networks that are often wireless and confined to the production plant, together with gateways that uplink to an Internet service provider.

2

Current initial deployment scenarios further involve a (private) cloud which a dedicated group of trustees can access. Typical stakeholders are the operators of the systems. All parties rely on secure communication channels established between the network endpoints and the cloud. This scenario builds closed data silos for a preselected, confined group. It is visualized in Figure 1a.

Already today it becomes apparent that the number of stake- holders in emerging scenarios will widen—plant operators, emergency teams, equipment vendors, and supervisory author- ities may retrieve information about current safety conditions, intermediate operational statistics, as well as long-term reports.

Furthermore, even a wider public may legitimately require civil participation in affairs of common impact, as is develop- ing from many open urban sensing initiatives , as well as participatory European laws. Following this demand, data silos need to break up in favour of a flexible, distributed data access that cannot easily rely on preconfigured trusted channels. Still, data might not be uniformly public, but continue to require protection. Protecting the data itself instead of the transmission channels paves the way to transparent data replication and caching—an efficient method for eliding today’s silos. This heterogeneous environment built from several independent stakeholders is visualized in Figure 1b.

Industrial deployments often operate under harsh conditions. In our use case, we consider industrial environments with a threat of hazardous contaminant (e.g., explosive gas) that need continuous monitoring by stationary, as well as mobile sensors.

In case of an emergency, immediate actions are required such as issuing local alarms, activating protective shut-downs (e.g., closing valves, halting pumps), initiating a remote recording for first responders and forensic purposes, and eventually may need to trigger evacuations of the plant or even the region.

Such complex settings obviously involve many parties and require a level of robustness which a single uplink to a remote cloud cannot guarantee.

This use case specifically relies on a fast sensor-actuator network including embedded IoT nodes. The harsh industrial environment raises the challenges of mobile, intermittently connected end nodes, network partitioning, and enhanced reliability from safety requirements. Devices often need to connect spontaneously, and a corresponding IoT system cannot reliably establish end-to-end channels in many situations.

Varying connectivity challenges and mobility, as well as external hazardous impacts are much easier mitigated in a replicative environment, where data diffuses hop-wise in an asynchronous fashion. It is easy to build such a compliant networking layer based on NDN primitives .

Typical industrial plants are widespread with sparse net- work coverage, so that mobile workers or machines face intermittent connectivity at scattered gateways. Some sensors and actuators are infrastructure bound, others are independent, battery-powered embedded devices (e.g., body equipment).

Such devices are susceptible to battery drains and can process only a few packets per minute on average. They are easily challenged by various distributed denial-of-service (DDoS) attacks. Hence networking approaches should minimize the DDoS surface and protect the embedded edge components.

Taken from real-world deployment, this study makes the case for a distributed, multi-stakeholder environment and identifies three major objectives for the networking layer: 1) Allow for ubiquitous multiparty data access without pre-established secure data channels or VPNs in the constrained IoT.

2) Provide a robustly secure networking infrastructure that is resilient to varying link conditions and mobility with the ability to recover locally from intermittent impair- ments.

3) Raise the barriers for DDoS attacks of constrained devices and confine the attack surface of unwanted traffic to local links.

We will show in the following, how the NDN approaches to Information Centric Networking can significantly contribute to these goals. We will also assess the shortcomings of current IoT solutions such as MQTT and CoAP .

Iii. Security Contributions Of Ndn

According to our use case, an industrial IoT deployment enhances requirements in the security and safety domain, but on the other hand narrows the utilization of ICN functions down to rather specific settings. In this section, we will discuss the three security aspects derived from our use case and identify certain benefits for NDN from its specific deployment in an industrial setting.

A. Ubiquitous Data Access In The Constrained Iot

Sensor data need to be accessible both in the local con- strained IoT, and in the remote for various stakeholders. Safety and security of the industrial monitoring system indeed largely depend on its availability even under the harsh conditions of local or regional incidents with intermittent connectivity.

As critical industrial facilities are always also susceptible to malicious threats, utmost resilience against (networked) attacks is strongly desirable. Clearly, a centralized cloud-based approach falls short as tampering the cloud has proven to be a pronounced attack vector (cf. the Cloudflare attack 2013).

Ubiquitous caching is the most striking contribution ICN makes to the security and safety of the distributed information system. Configuring the constrained nodes as well as the gateway to replicate and store IoT data for (most of) its life- time will maximize redundancy and minimize unavailability of critical information. It is noteworthy that common IoT data is small and of limited lifetime—archives being a well-localized exception. Furthermore, flash storage in constrained nodes is the least scarce resource and typically can accommodate an ‘infinite’ amount of IoT data.

Local mass storage facilitates the DTN nature of ICN for the IoT. The hop-by-hop transmission of sensor readings and actuator commands increases resilience in the presence of caching. When links re-establish after mobility handovers or

Trusted Channels

(a) Current IoT deployment: Processing and sharing of data via dedicated cloud services of a single operator.

Trusted Channels

(b) Upcoming IoT deployment: Multiple stakeholders share content based on in-network caching in ICN. Fig. 1: Current and future deployment scenarios of the industrial Internet.

failures, the NDN network layer can easily resume the content propagation and will thus provide an efficient self-healing mechanism.

B. Robustly Secure Networking Infrastructure

Sensors and actuators of the constrained IoT are typically challenged by maintaining an authenticated or even encrypted data channel to some remote data repository. In addition, unstable and lossy links in IoT edge networks make it hard to persist a stateful communication relation. Also for these reasons, IoT nodes are commonly deployed behind gateways that execute protocol translations (e.g., DTLS versus TLS) and thereby intercept secured channels. This sacrifices end-to-end transport security and exposes a significant attack surface at the gateway.

By authenticating or encrypting content instead of channels NDN circumvents these operational challenges of the IoT. As each content chunk can be hopwise replicated throughout the network without impairing its security measures, data integrity and confidentiality remain independent of transport or paths. Moreover, there is no requirement of performing synchronous actions between specific endpoints on the Internet which makes the security layer robust against link failures and network disconnects.

C. Ddos Resistance

Constrained nodes on the low power lossy wireless are easy victims of resource exhaustion when receiving too many IP packets. A gateway may commonly shield the IoT nodes from the global Internet and may even perform some (general) rate limiting, but it cannot reasonably track individual resources of nodes nor hinder the communication needs of the application use case. In addition, a malicious member of the IoT stub domain may not only jam radio channels, but utilize IP multihop forwarding to overload remote nodes. Conversely, as has been recently reported from the MIRAI incident, huge multiplicities make IoT nodes an interesting amplification tool for attackers.

A key design objective of ICN had been the reduction of this IP attack surface with respect to distributed denial of service attacks. In NDN this led to designing a request-response communication scheme without node addresses that hinders the plain transmission of unwanted content to a receiver. For a few years, it was the believe that NDN can be DDoS resistant by design, until Interest- and state-based attacks were

Discovered . Subsequent Work , Elaborated The

threats of Interest flooding and overloading FIB and PIT structures by user-generated names and content requests. This has proven difficult to mitigate in general . However, in a specific industrial setting of pure machine-to-machine communication with well known traffic patterns, buffers and PIT tables can be pre-configured according to well-formed communication flows. Hence, Interest flooding can be detected at the first hop and eliminated by the receiving stack (e.g., by hitting PIT limits). State-based attacks can thus be restricted to the local link which can never be protected by a network layer.

Iv. Comparative Assessment

We are now ready to a qualitative security comparison of our ICN solution with the common IP-based protocols MQTT and CoAP. We also evaluate the complexity of content object security that is inherent to ICN, but for a quantitative performance analysis we refer to .

Related Journal Articles & DOI Links

Selected peer-reviewed publications relevant to 12 Lead ECG Acquisition. Click the DOI to access the full paper (may require institutional access).

Why Choose Us?

Bangalore guidance for robotics, Spectre and autonomous systems projects.