An Overview of Wireless Iot Protocol Security in the Smart Home Domain
Total Page:16
File Type:pdf, Size:1020Kb
©2017 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works. The final, published version of this paper is available under: S. Marksteiner, V. J. Exposito´ Jimenez,´ H. Vallant, and H. Zeiner, ”An Overview of Wireless IoT Protocol Security in the Smart Home Domain,” 2017 Joint 13th CTTE and 10th CMI Conference on Internet of Things Business Models, Users, and Networks, Copenhagen, 2017, pp. 1-8. doi: 10.1109/CTTE.2017.8260940. http://ieeexplore.ieee.org/document/8260940/ arXiv:1801.07090v1 [cs.CR] 22 Jan 2018 An Overview of Wireless IoT Protocol Security in the Smart Home Domain Stefan Marksteiner, V´ıctor Juan Exposito´ Jimenez,´ Heribert Vallant, Herwig Zeiner JOANNEUM RESEARCH Forschungsgesellschaft mbH DIGITAL - Institute for Information and Communication Technologies Graz, Austria Email: [email protected] Abstract—While the application of IoT in smart technologies this fact, our research is focused on a security analysis of becomes more and more proliferated, the pandemonium of its the main wireless protocols in the smart home domain. This protocols becomes increasingly confusing. More seriously, severe publication has three main parts. The next section gives an security deficiencies of these protocols become evident, as time- to-market is a key factor, which satisfaction comes at the price overview of the different domains that can be found in the of a less thorough security design and testing. This applies Internet of Things. Section III describes the way in which especially to the smart home domain, where the consumer- the sensors can be connected as well as a brief presentation driven market demands quick and cheap solutions. This paper of the selected wireless protocols. The subsequent Section IV presents an overview of IoT application domains and discusses provides a security analysis of each protocol and Section V, the most important wireless IoT protocols for smart home, which are KNX-RF, EnOcean, Zigbee, Z-Wave and Thread. Finally, it eventually, shows the conclusion and outlook of our research. describes the security features of said protocols and compares them with each other, giving advice on whose protocols are more B. Related Work suitable for a secure smart home. Security and privacy are not simple tasks and include several Index Terms—IoT, Security, Smart Homes, Protocols, KNX- RF, EnOcean, Zigbee, Z-Wave, Thread different issues to carry out in an IoT domain, the article in [4] gives us an overview of the most common challenges in I. INTRODUCTION this field. On the other hand, Granjal et al. [5] present an A. Motivation exhaustive analysis of the security and privacy of each layer of the OSI model according to the existing protocols and their Although wireless sensor connections offer several ways to implication in the general IoT domain. Focusing on the smart increase our productivity in many fields such as smart home, home domain topic, an extended analysis of the security is smart production or smart transportation, it also introduces detailed in [6]. It contains an in-depth report of the main some risks to be aware of. The usage of a wireless physical aspects of this area, such as the most common threats and communication, which allows attackers easier interception good practices as well as a brief protocol analysis and security of communications, together with the Internet of Things implications of using of cloud platform on smart homes. One (IoT) [1] [2] or Web of Things (WoT) [3] also leads to step beyond is given from [7], in which the authors not only unprecedented opportunities for attackers to reveal confidential describe the main security and privacy threads, but introduce information and to manipulate data. It is crucial to find efficient an algorithm to secure each situation. Finally, they test them in and effective methods to counteract such attacks. Otherwise, a real-environment with successful results. Although, it seems all the benefits of the IoT will be forfeit. that these issues only concern researchers, the conclusions In order to address these challenges, first, a deep security of the research [8] present that one of the main problems analysis of the existing technologies is needed to help discover customers find to implement smart home solutions is security the root causes as well as find analysis techniques that allow followed by inflexibility, costs, and poor manageability, which verifying the security of the system. Moreover, other aspects indicates that it is also an important point for customers. also have to be considered to reach a secure environment. Unfortunately, sometimes the theoretical research is not In some cases, there are no resources to implement the enough and a practical research is needed. For example, [9] needed secure methods, for example, on sensor nodes with introduces a study about the Google Nest1 and the Nike+ limited resources that operate in adverse environments in Fuelband2, in which both hardware and software are analyzed. which very efficient methods have to be provided. On the Another interesting approach is given in [10], in which the other hand, security is not only a hardware method. For this security and privacy are tested in different IoT demos, such as reason, software attacks, for example attacks against memory a small light system. It describes detailed analysis and depicts consumption, have to be always in scope to avoid them. An analysis about the security on the IoT would be huge 1https://nest.com/ and it can not be done just in one publication. Because of 2https://www.nike.com/nike-plus the possible risks for each scenario. Moreover, a new kind Smart Home domain and an analysis of the defined security of devices to take into account are the low energy devices measures. in which a security system has to be applied but is con- strained by an extremely low power usage as the article [11] B. Smart Production describes. [12] shows why a smart home scenario cannot be Recent reports [14] [15], describe key issues for the next considered as an isolated system by proving it can be exploited generation of smart production analytic services. Relevant by using an external mobile application. applications are: digital performance management (including a Along with this related work, we have seen numerous data-driven mindset and integration across previously isolated security and privacy threads and also some possible solutions, functions); predictive maintenance (including integration of but not an extended security comparison of the available diverse data sets and using, e.g., advanced self-learning algo- protocols that can be used in the smart home domain, which rithms); yield, energy, and throughput optimization (including is the main focus of this paper. integration of process control with other data); next-level automation (including improvements in sensor technology and II. IOTAPPLICATION DOMAINS demand planning); and digital quality management (including Figure 1 displays an overview of the (smart) IoT application the use of new sensing technologies and semi-automated domains considered in this paper, including the communica- quality control). In Smart Production, wireless sensor networks tion protocols used in each respective area. will play a key role for increasing the flexibility of a data driven production lifecycle. Furthermore, for such a connected environment, it is clear that we should deal with cyber security issues described in this paper. C. Smart Transportation Smart transportation is becoming one of the biggest domains of the IoT. The implementation of the Controller Area Network (CAN) [16], that is commonly used in the automation control together with new protocols and communication technologies such as the 5G [17] or IoT-Narrow Band (IoT-NB) [18], opens new possibilities to exchange information. These new technologies are able to give smart transportation the neces- sary packet delay and data transmission rate. Moreover, new hardware implementations, specifically designed to make the right decision as fast as possible, provide a new key tool for the future of the autonomous vehicles. In this future they will have to be able to not only communicate with other cars or services, but process all information of the environment in real time to make the right choice. In consequence, the protection of all sensible information, as well as communications, has to be a mandatory point to ensure the safety and privacy of users. D. Smart Energy Fig. 1. Venn diagram of IoT application domains and included protocols In the energy domain, several standards are available for different areas ranging from generation, transmission, distribu- tion and distributed energy resources to the customers, which A. Smart Home may be also producers themselves, making them so-called pro- The smart home market is getting more and more dy- sumers. A good overview of these standards is available at the namic and, according a Smart Home Customer Survey of International Electrotechnical Commission Website3. Regard- Deloitte [13], in 2018 one million households could already be ing communication networks, the whole range beginning from smart in Germany. According to that study, the main interests home area networks, located at the customer, over the field in Smart Home are closely linked to more comfort and safety, area networks at the distribution level and wide area networks followed by savings on heating and electricity costs. The at transmission level are represented. That means wireless main barriers for customers are on the one hand the costs standards like 2G/3G/4G, WiMAX, WLAN, WirelessHART, and on the other the concerns regarding data protection and ISA100.11a, ZigBee, Z-Wave, 6LoWPAN, LoraWan, Sigfox, data security.