The Experts below are selected from a list of 912 Experts worldwide ranked by ideXlab platform

Nai-wei Lo - One of the best experts on this subject based on the ideXlab platform.

  • A Secure IoT Firmware Update Framework Based on MQTT Protocol
    Information Systems Architecture and Technology: Proceedings of 40th Anniversary International Conference on Information Systems Architecture and Tech, 2020
    Co-Authors: Nai-wei Lo, Sheng-hsiang Hsu
    Abstract:

    Recently massive Internet of Things have been deployed around the world. With data collected from sensors and functionalities provided by micro-controller based devices, new applications have emerged through big data analytics and autonomous real-time system responses. To support quality of service for deployed IoT devices, Firmware Update is a necessary task for IoT vendors. However, malicious attackers have been penetrated traditional Firmware Update processes and mechanisms to compromise deployed IoT devices, and launch destructive attacks through these controlled devices. In this paper, a secure IoT Firmware Update framework based on MQTT protocol is proposed. We picture a general Firmware Update model with IoT devices, gateway devices, Firmware distribution broker servers, and Firmware deployment servers of IoT vendors. Based on this model, a secure Firmware Update mechanism is developed to help IoT devices authenticate the source of received Firmware and verify the integrity of the received Firmware. MQTT protocol is adopted in the proposed framework to efficiently distribute new versions of Firmware for IoT vendors. Cryptologic primitives such as Elliptic Curve based Diffie-Hellman key exchange and key-hashed message authentication code are used to secure the proposed process and corresponding protocols. Security analysis is conducted to evaluate security strength of the proposed framework.

  • GCCE - Secure and Lightweight Firmware Update Framework for IoT Environment
    2019 IEEE 8th Global Conference on Consumer Electronics (GCCE), 2019
    Co-Authors: Alexander Yohan, Nai-wei Lo, Liem Peter Santoso
    Abstract:

    High market demands on IoT devices give rise to numerous malware attacks in IoT ecosystem. In order to protect IoT devices, device owners are required to keep their device's Firmware up-to-date. However, sometimes the Firmware Update process could be very challenging for technology illiterate device owners. As there are risks of online adversaries to launch attacks to the IoT device during the Firmware Update process. In this paper, a robust and lightweight Firmware Update framework utilizing skipchain technology is proposed to ensure the integrity of distributed Firmware and secure Firmware distribution process. A prototype based on the proposed Firmware Update framework is developed to show the feasibility of the proposed framework design.

  • FOTB: a secure blockchain-based Firmware Update framework for IoT environment
    International Journal of Information Security, 2019
    Co-Authors: Alexander Yohan, Nai-wei Lo
    Abstract:

    Recently, numerous exploitations and attacks in IoT environment occurred all over the world. One of the major attacking channels is utilizing the Firmware of IoT devices as the access interface to compromise the targeted IoT devices. Therefore, it is important for IoT device manufacturers to support secure and efficient Firmware Update functionality for sold or deployed IoT devices. In this paper, a secure and verifiable blockchain-based Firmware Update framework for IoT environment is proposed. The aims of the proposed framework are providing secure peer-to-peer verification mechanism on each new version of Firmware released by corresponding device manufacturer and providing a reliable way to distribute the Updated Firmware to IoT devices in timely manner. Furthermore, the utilization of blockchain technology in the proposed framework ensures the integrity of Firmware during its distribution through Internet. The proposed Firmware Update framework consists of four processes: creation of Firmware Update contract, creation of third-party Firmware Update contract, PUSH Update mechanism and PULL Update mechanism. Six corresponding protocols are derived to support the four processes. The evaluation on performance and security strength of the proposed Firmware Update framework is conducted. Based on the proofs of formal security analysis, the proposed framework supports mutual authentication and defends against major cyber attacks: Firmware modification attack, impersonation attack, man-in-the-middle attack and replay attack.

  • ISAT (1) - A Secure IoT Firmware Update Framework Based on MQTT Protocol
    Advances in Intelligent Systems and Computing, 2019
    Co-Authors: Nai-wei Lo
    Abstract:

    Recently massive Internet of Things have been deployed around the world. With data collected from sensors and functionalities provided by micro-controller based devices, new applications have emerged through big data analytics and autonomous real-time system responses. To support quality of service for deployed IoT devices, Firmware Update is a necessary task for IoT vendors. However, malicious attackers have been penetrated traditional Firmware Update processes and mechanisms to compromise deployed IoT devices, and launch destructive attacks through these controlled devices. In this paper, a secure IoT Firmware Update framework based on MQTT protocol is proposed. We picture a general Firmware Update model with IoT devices, gateway devices, Firmware distribution broker servers, and Firmware deployment servers of IoT vendors. Based on this model, a secure Firmware Update mechanism is developed to help IoT devices authenticate the source of received Firmware and verify the integrity of the received Firmware. MQTT protocol is adopted in the proposed framework to efficiently distribute new versions of Firmware for IoT vendors. Cryptologic primitives such as Elliptic Curve based Diffie-Hellman key exchange and key-hashed message authentication code are used to secure the proposed process and corresponding protocols. Security analysis is conducted to evaluate security strength of the proposed framework.

  • Secure and Lightweight Firmware Update Framework for IoT Environment
    2019 IEEE 8th Global Conference on Consumer Electronics (GCCE), 2019
    Co-Authors: Alexander Yohan, Nai-wei Lo, Liem Peter Santoso
    Abstract:

    High market demands on IoT devices give rise to numerous malware attacks in IoT ecosystem. In order to protect IoT devices, device owners are required to keep their device's Firmware up-to-date. However, sometimes the Firmware Update process could be very challenging for technology illiterate device owners. As there are risks of online adversaries to launch attacks to the IoT device during the Firmware Update process. In this paper, a robust and lightweight Firmware Update framework utilizing skipchain technology is proposed to ensure the integrity of distributed Firmware and secure Firmware distribution process. A prototype based on the proposed Firmware Update framework is developed to show the feasibility of the proposed framework design.

Emmanuel Baccelli - One of the best experts on this subject based on the ideXlab platform.

  • Secure Firmware Updates for Constrained IoT Devices Using Open Standards: A Reality Check
    IEEE Access, 2019
    Co-Authors: Koen Zandberg, Hannes Tschofenig, Kaspar Schleiser, Francisco Acosta, Emmanuel Baccelli
    Abstract:

    While IoT deployments multiply in a wide variety of verticals, most IoT devices lack a built-in secure Firmware Update mechanism. Without such a mechanism, however, critical security vulnerabilities cannot be fixed, and IoT devices can become a permanent liability , as demonstrated by recent large-scale attacks. In this paper, we survey open standards and open source libraries that provide useful building blocks for secure Firmware Updates for constrained IoT devices -- by which we mean low-power, microcontroller-based devices such as networked sensors/actuators with a small amount of memory, among other constraints. We design and implement a prototype that leverages these building blocks and assess the security properties of this prototype. We present experimental results , including first experiments with SUIT, a new IETF standard for secure IoT Firmware Updates. We evaluate the performance of our implementation on a variety of commercial off-the-shelf constrained IoT devices. We conclude that it is possible to create a secure, standards-compliant Firmware Update solution that uses state-of-the-art security for IoT devices with less than 32kB of RAM and 128kB of flash memory.

  • Secure Firmware Updates for Constrained IoT Devices Using Open Standards: A Reality Check
    IEEE Access, 2019
    Co-Authors: Koen Zandberg, Hannes Tschofenig, Kaspar Schleiser, Francisco Acosta, Emmanuel Baccelli
    Abstract:

    While the IoT deployments multiply in a wide variety of verticals, the most IoT devices lack a built-in secure Firmware Update mechanism. Without such a mechanism, however, critical security vulnerabilities cannot be fixed, and the IoT devices can become a permanent liability, as demonstrated by recent large-scale attacks. In this paper, we survey open standards and open source libraries that provide useful building blocks for secure Firmware Updates for the constrained IoT devices-by which we mean low-power, microcontroller-based devices such as networked sensors/actuators with a small amount of memory, among other constraints. We design and implement a prototype that leverages these building blocks and assess the security properties of this prototype. We present experimental results including first experiments with SUIT, a new IETF standard for secure IoT Firmware Updates. We evaluate the performance of our implementation on a variety of commercial off-the-shelf constrained IoT devices. We conclude that it is possible to create a secure, standards-compliant Firmware Update solution that uses the state-of-the-art security for the IoT devices with less than 32 kB of RAM and 128 kB of flash memory.

Hannes Tschofenig - One of the best experts on this subject based on the ideXlab platform.

  • A Firmware Update Architecture for Internet of Things
    2019
    Co-Authors: Brendan Moran, David Brown, Milosch Meriac, Hannes Tschofenig
    Abstract:

    Vulnerabilities with Internet of Things (IoT) devices have raised the need for a solid and secure Firmware Update mechanism that is also suitable for constrained devices. Incorporating such Update mechanism to fix vulnerabilities, to Update configuration settings as well as adding new functionality is recommended by security experts. This document lists requirements and describes an architecture for a Firmware Update mechanism suitable for IoT devices. The architecture is agnostic to the transport of the Firmware images and associated meta-data.

  • Firmware Updates for Internet of Things Devices - An Information Model for Manifests
    2019
    Co-Authors: Brendan Moran, Henk Birkholz, Hannes Tschofenig
    Abstract:

    Vulnerabilities with Internet of Things (IoT) devices have raised the need for a solid and secure Firmware Update mechanism that is also suitable for constrained devices. Incorporating such Update mechanism to fix vulnerabilities, to Update configuration settings as well as adding new functionality is recommended by security experts. One component of such a Firmware Update is the meta-data, or manifest, that describes the Firmware image(s) and offers appropriate protection. This document describes all the information that must be present in the manifest.

  • Secure Firmware Updates for Constrained IoT Devices Using Open Standards: A Reality Check
    IEEE Access, 2019
    Co-Authors: Koen Zandberg, Hannes Tschofenig, Kaspar Schleiser, Francisco Acosta, Emmanuel Baccelli
    Abstract:

    While IoT deployments multiply in a wide variety of verticals, most IoT devices lack a built-in secure Firmware Update mechanism. Without such a mechanism, however, critical security vulnerabilities cannot be fixed, and IoT devices can become a permanent liability , as demonstrated by recent large-scale attacks. In this paper, we survey open standards and open source libraries that provide useful building blocks for secure Firmware Updates for constrained IoT devices -- by which we mean low-power, microcontroller-based devices such as networked sensors/actuators with a small amount of memory, among other constraints. We design and implement a prototype that leverages these building blocks and assess the security properties of this prototype. We present experimental results , including first experiments with SUIT, a new IETF standard for secure IoT Firmware Updates. We evaluate the performance of our implementation on a variety of commercial off-the-shelf constrained IoT devices. We conclude that it is possible to create a secure, standards-compliant Firmware Update solution that uses state-of-the-art security for IoT devices with less than 32kB of RAM and 128kB of flash memory.

  • Secure Firmware Updates for Constrained IoT Devices Using Open Standards: A Reality Check
    IEEE Access, 2019
    Co-Authors: Koen Zandberg, Hannes Tschofenig, Kaspar Schleiser, Francisco Acosta, Emmanuel Baccelli
    Abstract:

    While the IoT deployments multiply in a wide variety of verticals, the most IoT devices lack a built-in secure Firmware Update mechanism. Without such a mechanism, however, critical security vulnerabilities cannot be fixed, and the IoT devices can become a permanent liability, as demonstrated by recent large-scale attacks. In this paper, we survey open standards and open source libraries that provide useful building blocks for secure Firmware Updates for the constrained IoT devices-by which we mean low-power, microcontroller-based devices such as networked sensors/actuators with a small amount of memory, among other constraints. We design and implement a prototype that leverages these building blocks and assess the security properties of this prototype. We present experimental results including first experiments with SUIT, a new IETF standard for secure IoT Firmware Updates. We evaluate the performance of our implementation on a variety of commercial off-the-shelf constrained IoT devices. We conclude that it is possible to create a secure, standards-compliant Firmware Update solution that uses the state-of-the-art security for the IoT devices with less than 32 kB of RAM and 128 kB of flash memory.

  • a Firmware Update architecture for internet of things devices
    2018
    Co-Authors: Brendan Moran, David Brown, Milosch Meriac, Hannes Tschofenig
    Abstract:

    Vulnerabilities with Internet of Things (IoT) devices have raised the need for a solid and secure Firmware Update mechanism that is also suitable for constrained devices. Incorporating such Update mechanism to fix vulnerabilities, to Update configuration settings as well as adding new functionality is recommended by security experts. This document lists requirements and describes an architecture for a Firmware Update mechanism suitable for IoT devices. The architecture is agnostic to the transport of the Firmware images and associated meta-data. This version of the document assumes asymmetric cryptography and a public key infrastructure. Future versions may also describe a symmetric key approach for very constrained devices.

Alexander Yohan - One of the best experts on this subject based on the ideXlab platform.

  • GCCE - Secure and Lightweight Firmware Update Framework for IoT Environment
    2019 IEEE 8th Global Conference on Consumer Electronics (GCCE), 2019
    Co-Authors: Alexander Yohan, Nai-wei Lo, Liem Peter Santoso
    Abstract:

    High market demands on IoT devices give rise to numerous malware attacks in IoT ecosystem. In order to protect IoT devices, device owners are required to keep their device's Firmware up-to-date. However, sometimes the Firmware Update process could be very challenging for technology illiterate device owners. As there are risks of online adversaries to launch attacks to the IoT device during the Firmware Update process. In this paper, a robust and lightweight Firmware Update framework utilizing skipchain technology is proposed to ensure the integrity of distributed Firmware and secure Firmware distribution process. A prototype based on the proposed Firmware Update framework is developed to show the feasibility of the proposed framework design.

  • FOTB: a secure blockchain-based Firmware Update framework for IoT environment
    International Journal of Information Security, 2019
    Co-Authors: Alexander Yohan, Nai-wei Lo
    Abstract:

    Recently, numerous exploitations and attacks in IoT environment occurred all over the world. One of the major attacking channels is utilizing the Firmware of IoT devices as the access interface to compromise the targeted IoT devices. Therefore, it is important for IoT device manufacturers to support secure and efficient Firmware Update functionality for sold or deployed IoT devices. In this paper, a secure and verifiable blockchain-based Firmware Update framework for IoT environment is proposed. The aims of the proposed framework are providing secure peer-to-peer verification mechanism on each new version of Firmware released by corresponding device manufacturer and providing a reliable way to distribute the Updated Firmware to IoT devices in timely manner. Furthermore, the utilization of blockchain technology in the proposed framework ensures the integrity of Firmware during its distribution through Internet. The proposed Firmware Update framework consists of four processes: creation of Firmware Update contract, creation of third-party Firmware Update contract, PUSH Update mechanism and PULL Update mechanism. Six corresponding protocols are derived to support the four processes. The evaluation on performance and security strength of the proposed Firmware Update framework is conducted. Based on the proofs of formal security analysis, the proposed framework supports mutual authentication and defends against major cyber attacks: Firmware modification attack, impersonation attack, man-in-the-middle attack and replay attack.

  • Secure and Lightweight Firmware Update Framework for IoT Environment
    2019 IEEE 8th Global Conference on Consumer Electronics (GCCE), 2019
    Co-Authors: Alexander Yohan, Nai-wei Lo, Liem Peter Santoso
    Abstract:

    High market demands on IoT devices give rise to numerous malware attacks in IoT ecosystem. In order to protect IoT devices, device owners are required to keep their device's Firmware up-to-date. However, sometimes the Firmware Update process could be very challenging for technology illiterate device owners. As there are risks of online adversaries to launch attacks to the IoT device during the Firmware Update process. In this paper, a robust and lightweight Firmware Update framework utilizing skipchain technology is proposed to ensure the integrity of distributed Firmware and secure Firmware distribution process. A prototype based on the proposed Firmware Update framework is developed to show the feasibility of the proposed framework design.

  • DSC - An Over-the-Blockchain Firmware Update Framework for IoT Devices
    2018 IEEE Conference on Dependable and Secure Computing (DSC), 2018
    Co-Authors: Alexander Yohan, Nai-wei Lo
    Abstract:

    Nowadays, a lot of Internet-of-Things devices and its applications are developed to improve the people's quality of life. With the growth of circulating IoT devices in human's community, improper device management and Firmware distribution mechanism could lead to many issues that harm the security and privacy of the device owner. In this paper, a Firmware Update framework for IoT devices based on blockchain technology is proposed. The proposed framework aims to provide secure verification on the Firmware released by the device manufacturer. In addition, the integrity of distributed Firmware to the end-device could be maintained. The proposed Firmware Update framework consists of four processes: the creation of Firmware Update contract, the creation of Firmware replication contract, the direct Firmware Update mechanism and the indirect Firmware Update mechanism.

  • An Over-the-Blockchain Firmware Update Framework for IoT Devices
    2018 IEEE Conference on Dependable and Secure Computing (DSC), 2018
    Co-Authors: Alexander Yohan, Nai-wei Lo
    Abstract:

    Nowadays, a lot of Internet-of-Things devices and its applications are developed to improve the people's quality of life. With the growth of circulating IoT devices in human's community, improper device management and Firmware distribution mechanism could lead to many issues that harm the security and privacy of the device owner. In this paper, a Firmware Update framework for IoT devices based on blockchain technology is proposed. The proposed framework aims to provide secure verification on the Firmware released by the device manufacturer. In addition, the integrity of distributed Firmware to the end-device could be maintained. The proposed Firmware Update framework consists of four processes: the creation of Firmware Update contract, the creation of Firmware replication contract, the direct Firmware Update mechanism and the indirect Firmware Update mechanism.

Koen Zandberg - One of the best experts on this subject based on the ideXlab platform.

  • Secure Firmware Updates for Constrained IoT Devices Using Open Standards: A Reality Check
    IEEE Access, 2019
    Co-Authors: Koen Zandberg, Hannes Tschofenig, Kaspar Schleiser, Francisco Acosta, Emmanuel Baccelli
    Abstract:

    While IoT deployments multiply in a wide variety of verticals, most IoT devices lack a built-in secure Firmware Update mechanism. Without such a mechanism, however, critical security vulnerabilities cannot be fixed, and IoT devices can become a permanent liability , as demonstrated by recent large-scale attacks. In this paper, we survey open standards and open source libraries that provide useful building blocks for secure Firmware Updates for constrained IoT devices -- by which we mean low-power, microcontroller-based devices such as networked sensors/actuators with a small amount of memory, among other constraints. We design and implement a prototype that leverages these building blocks and assess the security properties of this prototype. We present experimental results , including first experiments with SUIT, a new IETF standard for secure IoT Firmware Updates. We evaluate the performance of our implementation on a variety of commercial off-the-shelf constrained IoT devices. We conclude that it is possible to create a secure, standards-compliant Firmware Update solution that uses state-of-the-art security for IoT devices with less than 32kB of RAM and 128kB of flash memory.

  • Secure Firmware Updates for Constrained IoT Devices Using Open Standards: A Reality Check
    IEEE Access, 2019
    Co-Authors: Koen Zandberg, Hannes Tschofenig, Kaspar Schleiser, Francisco Acosta, Emmanuel Baccelli
    Abstract:

    While the IoT deployments multiply in a wide variety of verticals, the most IoT devices lack a built-in secure Firmware Update mechanism. Without such a mechanism, however, critical security vulnerabilities cannot be fixed, and the IoT devices can become a permanent liability, as demonstrated by recent large-scale attacks. In this paper, we survey open standards and open source libraries that provide useful building blocks for secure Firmware Updates for the constrained IoT devices-by which we mean low-power, microcontroller-based devices such as networked sensors/actuators with a small amount of memory, among other constraints. We design and implement a prototype that leverages these building blocks and assess the security properties of this prototype. We present experimental results including first experiments with SUIT, a new IETF standard for secure IoT Firmware Updates. We evaluate the performance of our implementation on a variety of commercial off-the-shelf constrained IoT devices. We conclude that it is possible to create a secure, standards-compliant Firmware Update solution that uses the state-of-the-art security for the IoT devices with less than 32 kB of RAM and 128 kB of flash memory.