IoT Security

IoT devices are ever-present in modern life, with over 70% of homes having at least one device.¹ Unfortunately, these devices are riddled with security vulnerabilities, such as hard-coded credentials and cryptographic key material, poorly encrypted communications, and weak access control. Existing research has focused on correcting implementation flaws in these devices. However, the history of software development suggests that while improvement will occur, it is unlikely that we will ever reach a point where all, or even a majority of developers, properly implement necessary security protections. As such, there is an urgent need to identify and evaluate methods for securing IoT devices without requiring modification of those devices or the services they rely upon.

We propose addressing this need by designing add-on security devices that are inserted into home networks to ensure secure operation from IoT devices on that network. While a similar approach has already been successfully used in industry[2]—for example, using zero-trust networking gateways to enforce strong authentication—research is needed to evaluate this approach’s feasibility, strengths, and weaknesses in resource-constrained home networks. In this research, we will quantify the ability of these devices to (i) ensure properly encrypted network communication, including upgrading plaintext channels, enforcing correct certificate validation, and rejecting unsafe cipher specs; (ii) enforcing strong authentication for IoT devices using a zero-trust model; and (iii) filtering malicious traffic including denial of service attacks. We will also investigate different places these add-on devices can be injected into the network, such as between the IoT device and the router, at the router, or before the router. Additionally, we will conduct user studies of developed systems to ensure that users can adequately configure these devices to provide a secure network. Finally, we will collaborate with computer engineering faculty to engineering these devices to be physically small and have minimal power draw, allowing them to be used in a wide variety of situations.

As the first step in this direction, we have demonstrated that correct TLS certificate validation can be enforced for applications running using a modified Linux kernel.^2,3 We have also built an IoT testbed and demonstrated that correct certificate validation is enforcable by inserting an add-on device between the IoT devices and the router. We are in the process of expanding the functionality of this prototype device and exploring the effectiveness of this technique at other locations in the network.