INTRODUCTION
The Internet of Things (IoT) devices have become very popular in various critical and non-critical usage fields. Many people have started to use IoT devices realizing their benefits in their lives and scientific research [MSPC12, CGOF13].
Because of the popularity of IoT devices, developers gravitate toward the development of IoT applications. These applications utilize IoT devices that contain various peripherals (e.g, sensors, cables, communication shields) and controller units (e.g, micro-controllers, micro-processors, security modules); they read data from sensors
and then process it in the controller unit. A wide variety of sensors can be used within the IoT context with purposes such as measuring the temperature of a room, detecting movement in a vehicle, and establishing the identity of a user.
The continuous increase of attention to IoT applications has yielded a new ecosystem of platforms and languages [DEDP15, CBS+18]. This ecosystem caused a need for a framework that facilitates secure IoT application development, which unifies a broad range of IoT development environments and languages. Those interested in developing applications for various IoT devices have to learn programming languages and how to operate several development environments. For example, consider someone who wants to develop a temperature measurement system using an
Arduino-based IoT device. To do so, the person needs to know how to program applications written in the C language as well as be acquainted with hardwarerelated concepts regarding the measurement of sensors and the Arduino IoT device. Moreover, if the person wants to transfer their application to run on another IoT device such as a Raspberry Pi, this person will need to port the code into this new devices programming platform by rewriting the application in another programming language (e.g., Python). In addition to the cost of learning a broad range of programming languages and platforms for different IoT devices, over-the-air programming Bluetooth and WiFi data transmission protocols require great attention and an in-depth knowledge of IoT devices. To address these issues, this thesis aims
to design a software suite that facilitates the need to learn so many technologies: it helps to reduce the barrier of entry for secure IoT application development. The software suite solution, PROVIZ+, which is introduced in Chapter 4, is a secure IoT application development software suit that helps users to develop IoT applications without asking for any software or hardware experience. PROVIZ+ supports various IoT development boards including major brands such as Raspberry Pi and Arduino. Moreover, the software suite includes a domain-specific programming language, namely Panther language, which is introduced in Chapter 4, to unify the existing programming languages to simplify the development of IoT applications. In addition to the Panther language, PROVIZ+ has visual programming and scriptbased programming tools which enable users to program IoT devices either by dragging and dropping using the visual programming tool or writing code in the Panther language using the code-based programming tool. PROVIZ+ also supports automated Bluetooth, WiFi, and wired data transmission for Arduino and Raspberry Pi IoT devices. Besides, it provides an easy IoT application and firmware transfer mechanism to supported IoT devices. This firmware upload process can be achieved either over-the-air or through physical communication over the serial data cables.
Since the firmware transfer is a crucial task for different IoT applications, we designed and implemented a novel over-the-air programming feature for PROVIZ+. Also, as existing over-the-air programming protocols for low-powered IoT devices do not include adequate security mechanisms to defend against different malicious attacks, we designed and implemented a secure over-the-air programming framework, named SOTA, which is introduced in Chapter 5.
BACKGROUND INFORMATION
This chapter provides background information about Internet of Things and corresponding or related technologies that are used in the development of PROVIZ+ and the SOTA framework.
2.1 Internet of Things (IoT)
The Internet of Things (IoT) is the network of physical devices that have actuators, sensors, and computation and communication units in order to exchange data with each other over a communication protocol. IoT applications can be created using several types of customized hardware, single board computers, and micro-controllers [PRO, CUB13]. Since Raspberry Pi and Arduino are selected as natively supported IoT devices in PROVIZ+, they are introduced in the following sub-sections.
Raspberry Pi
The Raspberry Pi is a single board computer (SBC) that has a system on chip (SOC) as the central processing unit with an integrated ARM central processing unit (CPU) and a graphics processing unit (GPU). Since it has a GPU and it can
run a desktop environment smoothly, it can be used as a personal computer. In addition to being powerful, Raspberry Pi devices are credit card-sized computers, which means that they are portable and can easily be moved to another location. Pis have multiple purpose I/O pins which enable developers to create IoT sensor applications. Moreover, they support WiFi and Bluetooth connection protocols to support data transmission over wireless networks. Because Raspberry Pis have a powerful microprocessor, developers use them for IoT applications that require high
computation power. In the scope of this thesis, we use Raspberry Pi 3 Model B shown in Figure 2.1 in performance evaluations of the PROVIZ+ software suite. The specifications of the different Raspberry Pi models can be seen in Table 2.1.
Arduino
Arduino is an hardware and software development company that builds single-board computers and micro-controller kits. These kits are distributed as an open-source hardware with large open-source community support.
Because they do not have SOC, they mostly do not support embedded communication protocols unlike Raspberry Pis. Despite having limited capabilities, Arduino devices can perform sophisticated tasks by utilizing sensor and communication shields, which can be added to the board. These shields can be WiFi, Zigbee, or Bluetooth communication shields to support data transmission, and also they can
be sensor shields to increase the capabilities of Arduinos such as measuring temperature, pressure, or humidity. Arduino IoT devices have a low-level I/O operation support; they support Inter-Integrated Circuit (I2C) and Serial Peripheral Interface Bus (SPI) communication ports. Interestingly, a large majority of Arduino IoT device models have the same brand of micro-controller, Atmel [ATW]. Having the same micro-controller makes it possible to develop common solutions for many IoT products without needing to differentiate by the type of Arduino IoT devices. In
addition to wide communication port support, they are also energy-efficient as they employ low power ATMEL micro-controllers. Table 2.2 shows the specifications of the popular Arduino IoT devices. In the scope of this thesis, we use the Arduino Mega 2560 IoT device that is shown in Figure 2.2.
2.2 Over-the-air Programming
Over-the-air programming is a method of programming electronic devices remotely without any physical contact. It can be achieved using Bluetooth or WiFi communication protocols. These protocols carry firmware pieces for target micro-controllers or microprocessors for purposes of updating the firmware due to security concerns or to add new features to it. The majority of Arduino-based IoT devices contain Atmel micro-controllers which utilize the STK500 Bootloader [ATM] to communicate with the remote programmer during the firmware transfer. In the SOTA framework,
the STK500 Bootloader was modified to make a secure over-the-air programming
framework.
2.3 Automatic Code Generation Tools
Automatic code generation tools produce the source code of an application for various devices from templates. These templates carry necessary information that are taken from users to be utilized in the code generation of the target application. In the scope of this thesis, an automatic code generation tool was used to generate the
source code for the IoT devices used in this project by only using a code generation template. As such, users only require filling a code generation template so as to generate the source code for Arduino and Raspberry Pi IoT devices. Specifically, the Apache Freemarker [APA] library was selected to implement the automatic code
generation tool for the PROVIZ+ software suite.
2.4 Parser Generators
Parser generators produce the source code of a parser that are for reading, understanding, and executing binary files or text. Generated parsers are generally used in parsing structured text operations. In the scope of this thesis, a parser generator library is added to the PROVIZ+ software suite in order to parse the Panther language. In PROVIZ+, the generated parser first utilizes the script that is written in the Panther language, then fills the code template to produce the source code for a target device. For this, the ANTLR library [ANT] was selected as a parser generator tool to generate the parser of the Panther language in the PROVIZ+ software suite.
RELATED WORK
In this chapter, the related work in visual IoT sensor application development tools are given and compared with PROVIZ+. We also provide the related work for the SOTA framework in the next section. Finally, we discuss other IoT programming platforms. The PROVIZ+ software suite presented in this work is inspired by the previous software project also titled PROVIZ [RCUB16]. That project was intended to provide a framework to visualize and program wireless sensor networks (WSNs). It allowed the user to develop wireless sensor applications using a scripting language
that could be easily written and reused by any developer [RCUB16]. Although built on the same concept, the new PROVIZ, PROVIZ+, has some crucial differences.
These include:
• PROVIZ+ is built for IoT devices. The first generation of the PROVIZ project was created for WSNs and their sensor nodes such as the MICAz [CRO]. However, PROVIZ supports obsolete sensor devices, which are stale and deprecated. PROVIZ+ works smoothly with a broad range of popular IoT devices. It creates sensor applications by programming IoT boards such as the Arduino and Raspberry Pi devices.
• PROVIZ+ supports over-the-air programming, unlike PROVIZ.
• The PROVIZ+ software suite includes an Android App that enables users to monitor flexibly their IoT devices’ sensor data.
• As opposed to PROVIZ, the graphical user interface of PROVIZ+ was designed with a step-by-step guide that prompts the user for the information needed in a sequential manner. In this way, the user can understand what
occurs on the back end as they program the device.
3.0.1 Visual IoT Sensor Application Development Tools
PROVIZ+ is the first software of its kind to have committed itself to ease and simplicity across platforms for IoT devices. Some visual development tools for wireless sensor networks exist, including Viptos [CLZ06], SensorSim [PSS00], and WISDOM [VIE05]. Viptos is a graphical development tool that programs WSNs in TinyOS [TIN] using diagrams of TinyOS components. This framework integrates the development of WSN applications with hardware visualization to ease the user development process. WISDOM is a modular application development tool. Like PROVIZ+, it has the capacity to program many different sensor platforms within the same network. It uses a modular system to send different programs to different sensors in the network to build the most versatile network. Both these platforms
achieve similar goals to PROVIZ+ in terms of heterogeneous networks, network deployment, and visual development tools. However, they are confined to the traditional WSN realm. PROVIZ+ is the only software to have also achieved the goal of secure programming capabilities of heterogeneous IoT networks. Furthermore, SensorSim aims to develop a simulation environment for sensor networks. The authors of it designed a micro sensor node model that covers radio, power, and battery features of the simulated sensor nodes. Also, SensorSim includes a scripting language that can simply develop virtual sensor nodes in a simulation environment. PROVIZ+ is different from SensorSim because it has the capability of developing physical IoT applications instead of having a simulation environment, and secure
over-the-air programming.
3.0.2 Secure Over-the-Air Programming Frameworks
Secure and wireless code-dissemination has been the focus of several useful studies in the literature [KW05, DHM05, RSUB12]. Especially, given the resource-limited nature of IoT devices, energy-efficient code dissemination is vital. Since most of the sensor applications based on embedded systems are limited regarding energy source, computation power, and usable memory size, energy efficient code dissemination is one of the vital aims of PROVIZ+, and it is also a concern for these related studies, [KW05], [DHM05], [RSUB12]. In [ABB+12], the authors propose a new framework
called SenSeOp for a selective and secure over-the-air programming protocol for WSNs. In their study, they used asymmetric encryption with Elliptic Curve Cryptography to protect the firmware against cybersecurity attacks. In addition to the asymmetric cryptography used in this work, [LK] uses hash functions instead of public key cryptography to provide a secure sensor network programming method. According to authors, the signature-based public key infrastructure (PKI) might produce an overhead for embedded devices and wireless sensor nodes. In this study,
SHA or MD5 supported hash chains are used to provide security. Also, in [HST08], the work aims to offer over-the-air programming techniques using rateless codes. In [RL03], the authors aim to distribute the firmware wirelessly to wireless sensors by only sending the changed part of the firmware (i.e., delta) to sensor nodes. Another
useful study [LGN06] classifies and compares network reprogramming protocols in terms of security, survivability, and performance metrics. Most of the attacks mentioned in this work [LGN06] are directly related to the packet routing-related attacks and the solution provided in the work also utilizes a symmetric key cryptography as in SOTA. In a different study [KW03], the authors present attacks on secure routing and its countermeasures in order to mitigate possible damage. Besides these studies, there is a more cloud-based IoT device programming work [NSV+13]. This
work introduces the PatRICIA [NSV+13] framework as a high level, end-to-end, cloud-based IoT programming framework. It has a data persistence layer as well as a cloud run-time layer. Since data persistence requires extensive memory and high input-output traffic, this approach is more suitable for advanced IoT devices that have more memory and computational power than low-cost Arduino-based IoT boards. Furthermore, the topic of secure over-the-air programming has become popular in the vehicular networks domain. In the [NL08] study, the authors used symmetric
encryption to offer secure firmware updates over the air. Their solution aims to provide data integrity, authentication, confidentiality, and freshness. Also in this study [NSN08], the same authors proposed a solution for self-verification of downloaded firmware to detect any modification of firmware during the flashing and downloading phases. Finally, another study [ISR+11] proposes a secure firmware update protocol that can be used with not only hard-wired, but also over-the-air data transmission. Our proposed solution in this thesis, the SOTA framework, is different from
the aforementioned studies as firstly, it focuses on providing an over-the-air programming solution to IoT devices; secondly, it proposes an open-source configurable implementation of over-the-air programming framework to IoT devices that have low-power, tiny micro-controllers such as the Atmel chipsets; and thirdly, it provides a comprehensive security services, including confidentiality, authentication, and integrity.
Source: A Simplified Secure Programming Platform for Internet of Things Devices
