Incentivized Delivery Network of IoT Software Updates Based on Trustless Proof-of-Distribution

Abstract

The Internet of Things (IoT) network of connected devices currently contains more than 11 billion devices and is estimated to double in size within the next four years. The prevalence of these devices makes them an ideal target for attackers. To reduce the risk of attacks vendors routinely deliver security updates (patches) for their devices. The delivery of security updates becomes challenging due to the issue of scalability as the number of devices may grow much quicker than vendors' distribution systems. Previous studies have suggested a permissionless and decentralized blockchainbased network in which nodes can host and deliver security updates, thus the addition of new nodes scales out the network. However, these studies do not provide an incentive for nodes to join the network, making it unlikely for nodes to freely contribute their hosting space, bandwidth, and computation resources.In this paper, we propose a novel decentralized IoT software update delivery network in which participating nodes (referred to as distributors) are compensated by vendors with digital currency for delivering updates to devices. Upon the release of a new security update, a vendor will make a commitment to provide digital currency to distributors that deliver the update; the commitment will be made with the use of smart contracts, and hence will be public, binding, and irreversible. The smart contract promises compensation to any distributor that provides proof-of-distribution, which is unforgeable proof that a single update was delivered to a single device. A distributor acquires the proof-of-distribution by exchanging a security update for a device signature using the Zero-Knowledge Contingent Payment (ZKCP) trustless data exchange protocol. Eliminating the need for trust between the security update distributor and the security consumer (IoT device) by providing fair compensation, can significantly increase the number of distributors, thus facilitating rapid scale out.

IoTGuard: Dynamic Enforcement of Security and Safety Policy in Commodity IoT

“…This allows our implementation to insert an app's information such as the app ID and app name (lines 6-8), and obtain an app's events (line 10), actions, numerical-valued attributes, and predicates that guard actions (line 15 and 20). The information is transmitted to IOTGUARD's data collector (line 16 and 24) through a JSON object with additional information obtained from the app's state, event, and device object instances (lines [29][30][31][32][33][34][35][36][37][38][39][40]. The event object in SmartThings allows accessing the event properties [15]; for example, the event type is obtained through evt.value (line 34).…”

“…Most attempts to date in IoT security and privacy aim to improve perimeter defenses that harden the IoT infrastructure against attacks using firewalls [30], intrusion detection [54], access control policies [22], and software patches [32]. Yet, perimeter security measures do not enforce safe behavior of physical processes in IoT systems.…”

Blockchain-based Firmware Update Scheme Tailored for Autonomous Vehicles

“…In the literature, the security of firmware update has been discussed in several contexts, including wireless sensor network [17], [18], IoT [19], [20], vehicular network [21], etc. The existing works can be classified either as centralized (client-server model) or decentralized.…”

“…In [20], the authors proposed software update framework for Internet of Things (IoT) devices. The framework allows other parties to deliver the updates in return for digital currency paid by the vendor.…”

Blockchain based privacy-preserving software updates with proof-of-delivery for Internet of Things

“…They used smart contract and the consensus mechanism of blockchain to preserve the integrity of updates. Recently, Leiba et al [25] proposed decentralized incentivized delivery network for IoT software updates. The participating nodes of delivery network deliver update to IoT devices and the nodes can get the financial incentive from the vendors.…”