As the internet of things moves into increasingly sensitive domains, connected devices need to be secured against data manipulation and counterfeiting. Where the underlying business processes involve multiple independent parties, a blockchain platform can provide a common source of truth. If changes to the common state depend on IoT devices, the authenticity and integrity of the IoT input must be ensured. Employing a blockchain platform for authenticating devices makes the process independent of the device manufacturer. This paper shows how cryptographic keys derived from a device’s physical fingerprint can be employed in a zero-knowledge protocol to authenticate a device. As the keys are regenerated at boot time rather than stored, the approach does not need an expensive secure element. An efficient implementation enables even lightweight devices to prove their identity and sign messages. Experimental results demonstrate the robustness of the approach.

PUF-derived IoT identities in a zero-knowledge protocol for blockchain

Non-fungible tokens (NFTs) are widely used in blockchain to represent unique and non-interchangeable assets. Current NFTs allow representing assets by a unique identifier, as a possession of an owner. The novelty introduced in this paper is the proposal of smart NFTs to represent IoT devices, which are physical smart assets. Hence, they are also identified as the utility of a user, they have a blockchain account (BCA) address to participate actively in the blockchain transactions, they can establish secure communication channels with owners and users, and they operate dynamically with several modes associated with their token states. A smart NFT is physically bound to its IoT device thanks to the use of a physical unclonable function (PUF) that allows recovering its private key and, then, its BCA address. The link between tokens and devices is difficult to break and can be traced during their lifetime, because devices execute a secure boot and carry out mutual authentication processes with new owners and users that could add new software. Hence, devices prove their trusted hardware and software. A whole demonstration of the proposal developed with ESP32-based IoT devices and Ethereum blockchain is presented, using the SRAM of the ESP32 microcontroller as the PUF.

/pdf/secure-combination-of-iot-and-blockchain-by-physically-1zy6eeu682.pdf

Secure Combination of IoT and Blockchain by Physically Binding IoT Devices to Smart Non-Fungible Tokens Using PUFs.

NFT marketing: How marketers can use nonfungible tokens in their campaigns

Remote user authentication for Internet of Things (IoT) devices is critical to IoT security, as it helps prevent unauthorized access to IoT networks. Biometrics is an appealing authentication technique due to its advantages over traditional password-based authentication. However, the protection of biometric data itself is also important, as original biometric data cannot be replaced or reissued if compromised. In this paper, we propose a cancelable iris- and steganography-based user authentication system to provide user authentication and secure the original iris data. Most of the existing cancelable iris biometric systems need a user-specific key to guide feature transformation, e.g., permutation or random projection, which is also known as key-dependent transformation. One issue associated with key-dependent transformations is that if the user-specific key is compromised, some useful information can be leaked and exploited by adversaries to restore the original iris feature data. To mitigate this risk, the proposed scheme enhances system security by integrating an effective information-hiding technique—steganography. By concealing the user-specific key, the threat of key exposure-related attacks, e.g., attacks via record multiplicity, can be defused, thus heightening the overall system security and complementing the protection offered by cancelable biometric techniques.

/pdf/a-cancelable-iris-and-steganography-based-user-4a83cbt4yc.pdf

A Cancelable Iris- and Steganography-Based User Authentication System for the Internet of Things.

The last few decades have seen a large proliferation in the prevalence of cyber-physical systems. This has been especially highlighted by the explosive growth in the number of Internet of Things (IoT) devices. Unfortunately, the increasing prevalence of these devices has begun to draw the attention of malicious entities which exploit them for their own gain. What makes these devices especially attractive is the various resource constraints present in these devices that make it difficult to add standard security features. Therefore, one intriguing research direction is creating security solutions out of already present components such as sensors. Physically Unclonable Functions (PUFs) are one potential solution that use intrinsic variations of the device manufacturing process for provisioning security. In this work, we propose a novel weak PUF design using thermistor temperature sensors. Our design uses the differences in resistance variation between thermistors in response to temperature change. To generate a PUF that is reliable across a range of temperatures, we use a response-generation algorithm that helps mitigate the effects of temperature variation on the thermistors. We tested the performance of our proposed design across a range of environmental operating conditions. From this we were able to evaluate the reliability of the proposed PUF with respect to variations in temperature and humidity. We also evaluated the PUF’s uniqueness using Monte Carlo simulations.

Use of Thermistor Temperature Sensors for Cyber-Physical System Security

One of the most extended applications of blockchain technologies for the IoT ecosystem is the traceability of the data and operations generated and performed, respectively, by IoT devices. In this work, we propose a solution for secure management of IoT devices that participate in the blockchain with their own blockchain accounts (BCAs) so that the IoT devices themselves can sign transactions. Any blockchain participant (including IoT devices) can obtain and verify information not only about the actions or data they are taking but also about their manufacturers, managers (owners and approved), and users. Non Fungible Tokens (NFTs) based on the ERC-721 standard are proposed to manage IoT devices as unique and indivisible. The BCA of an IoT device, which is defined as an NFT attribute, is associated with the physical device since the secret seed from which the BCA is generated is not stored anywhere but a Physical Unclonable Function (PUF) inside the hardware of the device reconstructs it. The proposed solution is demonstrated and evaluated with a low-cost IoT device based on a Pycom Wipy 3.0 board, which uses the internal SRAM of the microcontroller ESP-32 as PUF. The operations it performs to reconstruct its BCA in Ethereum and to carry out transactions take a few tens of milliseconds. The smart contract programmed in Solidity and simulated in Remix requires low gas consumption.

Secure Management of IoT Devices Based on Blockchain Non-fungible Tokens and Physical Unclonable Functions.

Security is essential in sensor nodes which acquire and transmit sensitive data However, the constraints of processing, memory and power consumption are very high in these nodes Cryptographic algorithms based on symmetric key are very suitable for them The drawback is that secure storage of secret keys is required In this work, a low-cost solution is presented to obfuscate secret keys with Physically Unclonable Functions (PUFs), which exploit the hardware identity of the node In addition, a lightweight fingerprint recognition solution is proposed, which can be implemented in low-cost sensor nodes Since biometric data of individuals are sensitive, they are also obfuscated with PUFs Both solutions allow authenticating the origin of the sensed data with a proposed dual-factor authentication protocol One factor is the unique physical identity of the trusted sensor node that measures them The other factor is the physical presence of the legitimate individual in charge of authorizing their transmission Experimental results are included to prove how the proposed PUF-based solution can be implemented with the SRAMs of commercial Bluetooth Low Energy (BLE) chips which belong to the communication module of the sensor node Implementation results show how the proposed fingerprint recognition based on the novel texture-based feature named QFingerMap16 (QFM) can be implemented fully inside a low-cost sensor node Robustness, security and privacy issues at the proposed sensor nodes are discussed and analyzed with experimental results from PUFs and fingerprints taken from public and standard databases

/pdf/a-puf-and-biometric-based-lightweight-hardware-solution-to-bichsxg5qx.pdf

A PUF-and biometric-based lightweight hardware solution to increase security at sensor nodes

This work was supported in part by TEC2014-57971-R and TEC2017-83557-R projects from Ministerio de Ciencia, Innovacion y Universidades of the Spanish Government (with support from the PO FEDER-FSE) and 201750E010 (HW-SEEDS) project from CSIC. The work of Rosario Arjona was supported by a Post-Doc Fellowship from the Spanish National Cybersecurity Institute (INCIBE). The work of Miguel A. Prada-Delgado was supported by V Plan Propio de Investigacion through the University of Seville.

/pdf/trusted-cameras-on-mobile-devices-based-on-sram-physically-2ccaut5cmh.pdf

Trusted Cameras on Mobile Devices Based on SRAM Physically Unclonable Functions.

Due to the expansion of the Internet of Things (IoT), there is an increasing number of interconnected devices around us Integrity, authentication and non-repudiation of data exchanged between them is becoming a must This can be achieved by means of digital signatures In recent years, the eXtended Merkle Signature Scheme (XMSS) has gained popularity in embedded systems because of its simple implementation, post-quantum security, and minimal security assumptions From a hardware point of view, the security of digital signatures strongly depends on how the private keys are generated and stored In this work, we propose the use of SRAMs as True Random Generators (TRNGs) and Physically Unclonable Functions (PUFs) to generate and reconstruct XMSS keys in a trusted way We achieve a low-cost solution that only adds lightweight operations to the signature itself, such as repetition decoding and XORing, and does not require additional hardware (like secure non-volatile memories) since the manufacturing variations of the SRAM inside the IoT device are exploited As a proof of concept, the solution was implemented in an IoT board based on the ESP32 microcontroller

Javier Arcenegui

Papers

Secure Combination of IoT and Blockchain by Physically Binding IoT Devices to Smart Non-Fungible Tokens Using PUFs.

Secure Management of IoT Devices Based on Blockchain Non-fungible Tokens and Physical Unclonable Functions.

A PUF-and biometric-based lightweight hardware solution to increase security at sensor nodes

Trusted Cameras on Mobile Devices Based on SRAM Physically Unclonable Functions.

Hardware Security for eXtended Merkle Signature Scheme Using SRAM-based PUFs and TRNGs