Report from the Internet of Things Software Update (IoTSU) Workshop 2016

Farrell, Stephen; Tschofenig, Hannes

doi:10.17487/rfc8240

Cited by 9 publications

(7 citation statements)

References 5 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The Internet-of-Things (IoT) promises a plethora of devices that must be updated due to security concerns and changing requirements. Updating such IoT devices is an open problem, and DSU will be unavoidable [44]. Non-Volatile Memory (NVM) makes all program state transparently persistent.…”

Section: Challenges Of Stateful Upgradesmentioning

confidence: 99%

Mvedsua

Pina

Andronidis

Hicks

et al. 2019

Proceedings of the Twenty-Fourth International Conference on Architectural Support for Programming Languages and Operating Syst

View full text Add to dashboard Cite

Dynamic Software Updating (DSU) is a technique for patching stateful software without shutting it down, which enables both timely updates and non-stop service. Unfortunately, bugs in the update itself-whether in the changed code or in the way the change is introduced dynamically-may cause the updated software to crash or misbehave. Furthermore, the time taken to dynamically apply the update may be unacceptable if it introduces a long delay in service. This paper makes the key observation that both problems can be addressed by employing Multi-Version Execution (MVE). To avoid delay in service, the update is applied to a forked copy while the original system continues to operate. * This work was done while Luís was a researcher at Imperial College London 1 Mvedsua ("MVE" + "DSU") is pronounced "Medusa".

show abstract

Section: Challenges Of Stateful Upgradesmentioning

confidence: 99%

Mvedsua

Pina

Andronidis

Hicks

et al. 2019

Proceedings of the Twenty-Fourth International Conference on Architectural Support for Programming Languages and Operating Syst

View full text Add to dashboard Cite

show abstract

“…Not only because those low-cost IoT devices are lacking of computing resources and I/O peripherals, but also due to the IoT vendors' lax on implementing secure softwares. Many manufacturers are busy rolling out products with novel features while leaving security flaws unpatched for years [23], [56], [51], [46]. Given IoT devices' actuality of insecurity, it is reasonable to have the assumption of access-to-attack, with which any attacker that has direct access to the IoT device's open port is supposed being able to take down the device.…”

Section: Introductionmentioning

confidence: 99%

Towards Efficient Integration of Blockchain for IoT Security: The Case Study of IoT Remote Access

Fu,

Zeng,

2019

Preprint

View full text Add to dashboard Cite

The booming Internet of Things (IoT) market has drawn tremendous interest from cyber attackers. The centralized cloud-based IoT service architecture has serious limitations in terms of security, availability, and scalability, and is subject to single points of failure (SPOF). Recently, accommodating IoT services on blockchains has become a trend for better security, privacy, and reliability. However, blockchain's shortcomings of high cost, low throughput and long latency make it unsuitable for IoT applications. In this paper, we take a retrospection of existing blockchain-based IoT solutions and propose a framework for efficient blockchain and IoT integration. Following the framework, we design a novel blockchain-assisted decentralized IoT remote accessing system, RS-IOT, which has the advantage of defending IoT devices against zero-day attacks without relying on any trusted third-party. By introducing incentives and penalties enforced by smart contracts, our work enables "an economic approach to cybersecurity," thwarting the majority of attackers who aim to achieve monetary gains. Our work presents an example of how blockchain can be used to ensure the fairness of service trading in a decentralized environment and punish misbehaviors objectively. We show the security of RS-IoT via detailed security analyses. Finally, we demonstrate its scalability, efficiency, and usability through a proof-of-concept implementation on the Ethereum testnet blockchain. 1

show abstract

“…Another vital part of IoT security is software updates. Software updates fix features that are not performing as intended, add software enhancements, and most importantly, address security issues [94].…”

Section: Software Updatementioning

confidence: 99%

“…Over-the-air (refer OTA in Chapter 2 on page 10) is used to provide software updates for IoT devices. In a report on a software update workshop for IoT devices, Tschofenig et al [94] discussed the challenges faced for software and firmware updates, and proposed solutions for IoT devices. The main goal of this workshop was to explore methods for secure software updates for constrained devices [13].…”

Section: Software Updatementioning

confidence: 99%

“…In general, studies [82] [90] [29] [94] have found large numbers of software vulnerabilities in IoT devices, which illustrates the need for a mechanism for an automatic secure software update. We have demonstrated, with the help of our model and a prototype implementation, the viability of using public-key algorithms for one Class IV IoT device (Arduino ATMega2560 8-bit microcontroller with a 16MHz clock) by providing a practical instantiation, which has been tested for onboarding and software updates.…”

Section: Future Work and Conclusionmentioning

confidence: 99%

See 1 more Smart Citation

Onboarding and Software Update Architecture for IoT Devices

Gupta¹,

Paúl²

View full text Add to dashboard Cite

There has been a continuous growth in the usage of IoT devices. These devices are subject to an increasing number of attacks which exploit their software vulnerabilities. We need a secure architectural design for managing and using cryptographic keys involved in both initial configuration (onboarding) and secure automatic updates of IoT devices to perform authenticated key management and digital signature. Low-level IoT devices (8-bit) have low computational capabilities and a small memory size and are challenged to carry out desktop and server-type public-key cryptographic operations, as needed for key establishment and authentication of software updates. We have designed and implemented a prototype to provide secure onboarding and update architecture and associated protocols for low-level IoT devices (8-bit). It uses elliptic curve cryptography (Curve25519), authenticated key establishment, and a known continuity-based key-locking mechanism that uses a public key embedded in a current software image to verify the signature on the software update. The design addresses the scenario of transfer of update authority, e.g., when a manufacturer or update provider ceases to provide ongoing software updates upon going out of business. i First and foremost, I would like to thank my supervisor Dr. Paul van Oorschot of Carleton University for his support, helpful guidance, insight and feedback on my research, which acted as a true encouragement for me throughout my thesis journey. Without his guidance, this thesis would not have been possible. I would also like to thank Dr. Anil Somayaji of Carleton University for his continuous help guidance and valuable comments. I would also like to thank members of the Carleton Computer Security Lab (CCSL), notably Christopher Bellman and Reza Samanfar, who helped a great deal by providing valuable feedback on my research.

show abstract

Report from the Internet of Things Software Update (IoTSU) Workshop 2016

Cited by 9 publications

References 5 publications

Mvedsua

Mvedsua

Towards Efficient Integration of Blockchain for IoT Security: The Case Study of IoT Remote Access

Onboarding and Software Update Architecture for IoT Devices

Contact Info

Product

Resources

About