Due to the active development of the Internet of Things (IoT) technology, more and more systems of interconnected devices and sensors are appearing that collect various data and transmit them through gateways to remote servers. It goes without saying that this data must be protected at all stages. This is especially important for data on the functioning of potentially dangerous objects and devices. Because of the features of devices with limited computing resources, it is impossible to use standard methods of information protection in the gatewaybuilt-in sensor link. The article considers the algorithm of the Internet of Things system using limited devices, which consists of a gateway for receiving data from sensors and transmitting them to servers and limited devices used for data collection and encryption. The proposed algorithm describes the process of data packet generation, key generation, encryption, transmission, and decryption of data received from sensors. The reliability of data encryption transmitted in the gateway-built-in sensor link is ensured by the generation of a truly random sequence - the encryption key, based on the initial measured value on the unconnected and ungrounded analog input of the microcontroller, and a series of arithmetic operations.
The rapid development of the Internet of
Things has led to the creation of a large number of
heterogeneous systems of interconnected
computing devices, built-in sensors that collect
and measure environmental parameters and
transmit them through IoT gateways to a remote
server in the cloud [
The application of encryption methods in computer systems on limited devices creates a limitation in the existing computing resources, which makes it necessary to work out such a method that will employ a minimum of such resources.
After analyzing the algorithms, namely the
required number of calculations and device
memory for organizing these calculations, it was
investigated that for the operation of the RSA
algorithms and the El-Gamal scheme it is
necessary to use an amount of memory that
exceeds the amount available in class 0 and 1
devices [
Thus, a problematic issue arises regarding the development and use of the encryption method in modern objects representing computer systems on limited devices.
The purpose of the article is to increase the level of security of systems in the Internet of Things network by developing a method of data encryption on devices with limited computing resources.
In [
During the study of encryption methods, the
main operations that are used were highlighted:
addition, shuffling, bit shift and binary XOR
operation. Considering the concept of using the
XOR operation in existing encryption methods, it
can be noted that such a task remains a priority
[
In [
The complexity of the topological structures of
wireless sensor networks due to their variability
[
The general model of the IoT system using limited devices (Fig. 1) consists of: A gateway for receiving data from sensors and transferring them to servers. Limited devices used to collect and encrypt data for secure transmission over unsecured channels to the gateway.
The general algorithm of the system functions as follows:
1. Reading data from sensors with a limited device.
2. Generation of a random key, the length of which is equal to the length of the message.
3. Encrypting the message with the Vernam cipher, using the bitwise “exclusive OR” operator.
4. Random selection of one of the predefined keys to encrypt the key itself.
5. Encryption of the key.
6. Sending the message and key to the gateway.
7. Receiving the message by the gateway and sending the encrypted message via secure channels to the company’s servers.
8. Reception of the message by the server and selection of the necessary key to decrypt the key with which important data is encrypted.
9. Data decoding and adding them to special structures for data storage and processing. So, the software implementation of the system consists of three parts, the program running on the limited device is responsible for generating data and encrypting packets for sending. According to the block scheme (Fig. 2), the first step is the generation of the message “M” for further encryption. The prototype uses a temperature and humidity sensor to generate useful values.
After the message generation is completed, the
random key sequence generation function is
called for data encryption. In general, the function
should generate a truly random sequence of
characters equal to the length of the message in
order to ensure absolute cryptoresistance [
Any random number generation function
performs mathematical operations with some
initial value, therefore, to obtain a truly random
sequence, the initial value must be random [
After running these functions, the program has two variables, the first one stores the value of the message, the second, the value of the key to encrypt this message.
The message is as follows:
The generated key looks like this: %⸮9⸮g⸮⸮cV(1p'p9⸮C⸮⸮⸮lȖ⸮gtvgȋ' (⸮⸮⸮n⸮;P=䌕=⸮⸮⸮B⸮r⸮W⸮⸮%⸮N⸮⸮z⸮⸮W; ⸮t⸮⸮3⸮⸮s&Lf⸮⸮|⸮CKIW*/ ⸮M⸮!Z1⸮%⸮l⸮⸮⸮ާ͋⸮⸮⸮⸮⸮⸮Us8⸮⸮⸮
After generating the message and the key, the encryption function is performed. For encryption, a Vernam cipher is used, which uses a bitwise “exclusive OR” operation to create an encrypted message (Fig. 4). For each symbol of the message in bitwise form, an XOR operation is applied with the corresponding key symbol in bitwise form, for example: 0 0 1 1 0 0 0 1 = 1 ⊕ 0 0 1 0 0 1 0 1 = % 0 0 0 1 0 1 0 0 = 4
According to the example, after the bitwise operator XOR was applied to the message character “1,” the character DC4 (Device Control 4) was obtained with the corresponding key character “%” at the output. This operation takes place in a loop, for each pair of key and message values. After the end of the loop, the function returns an encrypted message in the form of a text variable, which is ready for transmission to the gateway.
Upon completion of the encryption function, one of the predefined keys is selected to encrypt the key with which the message was ciphered. The key is chosen randomly. Since two predefined keys were used in the system prototype, the selection algorithm works as follows. The current value is read on the unconnected analog input: • With the received value, the operation of the remainder from division by 2 is performed. • If a 1 is received, then the first key is used, otherwise the second key is used.
Keys for encryption of randomly generated sequences have a fixed length, which is equal to the length of the message and therefore to the length of the key that was generated randomly. Predefined keys must be loaded during flashing of the limited device. The number of such keys may be different depending on the memory of the limited device or the possibility of using additional energy-independent memory in which the keys will be stored. Each limited device must have its own unique keys, so that if one device is compromised, the security of the entire system will not be compromised.
The corresponding keys will be stored on the
enterprise server, which will receive and decrypt
the received data from the gateway. After
choosing a predefined key, the encryption
function is called again, but only to encrypt a
randomly generated key. At the output, two text
variables are obtained, which are the encrypted
message and the encrypted key for decrypting the
message. After that, these variables can be
transferred through any unsecured data
transmission channel. As a prototype,
transmission through the UART interface is used.
In a real system, any standard protocols for
Internet of Things networks can be used: ZigBee,
Thread, Z-Wave, MQTT, LwM2M [
The gateway, in turn, can work according to two scenarios depending on the needs of the system. In the first option, the gateway acts as a simple intermediary between the server and the limited device, that is, it uses standard communication protocols to transmit encrypted data to the company’s servers without changing packets.
In the second option, if there is a need to perform calculations with the received data and adjust the operation of the system, the gateway itself decrypts the data and saves them in a format convenient for calculations. It is possible to allow a mixed version of work, in which part of the data will be decrypted at the gateway, and part will be sent to the server without changes. In this case, it is necessary to use different predefined encryption keys to encrypt the randomly generated keys for the server and for the gateway, so that in the event of a breach of the gateway, the data to be transmitted to the server remains protected.
In any case, the software implementation of
decryption and data storage in a convenient
format will have approximately the same form
(Fig. 6). The algorithm will perform the following
steps:
• Receiving an encrypted message over an
unsecured channel.
• Receiving an encrypted key to decrypt a
message over an unsecured channel.
• Selection of one of the predefined keys for
decryption.
• Decryption of the key.
• Decoding the message.
• Data storage in a convenient form for
calculations option. The CSV format files are
used as a prototype to create a data frame from
the received data [
The algorithm begins its work by receiving data, to which two symbols have been added due to the peculiarity of sending through the UART interface. The data is sent to the server and stored in the form of two arrays of the byte type (Fig. 7).
After receiving the data, the function of selecting a predefined key (Fig. 8) is called to decrypt the key with which the message was encrypted. The function takes three arguments— the first character of the received encrypted message, the first character of the encrypted key and a list of predefined keys.
According to the block diagram, the algorithm iterates all the keys from the array of predefined keys one by one. Two text variables are created to store the first decrypted character. First, the first character of the key is decrypted, but the key was generated on the limited device randomly. Accordingly, it is not possible to verify the validity of the first character of the key, so with the received key character, it is necessary to perform an XOR operation on the first character of the received message.
Since the data is transmitted from the transmitters, then we can expect a certain symbol of the message, which will already be some kind of information. But if the key was chosen incorrectly, then there will be no useful information in the message. So, you can check the first character of the message: if after decryption it represents the expected data, then the function returns the index of the current operation, accordingly, this is the index of the key in the array that needs to decrypt the randomly generated key. After returning the index, the function completes its work so as not to perform unnecessary operations.
If, in the case of packet exchange, the value could not be decrypted, then the function returns a value that is not included in the array index range, and further, the message will not be decrypted, since the key was not matched, and therefore the message did not come from the expected limited device.
After choosing a predefined key, the function for decryption is called (Fig. 9), which accepts two arguments, the text to be decrypted and the key for decrypting the text. The received encrypted key as text and one key from the array of predefined keys whose index was found in the previous step are passed as arguments to the function.
The first step initializes the variable in which the decrypted text will be stored. In this case of the call, the decrypted randomly generated key will be stored in the variable to decrypt the message. Next, in a loop that works for each element in the array of text bytes, except for the last two characters that do not carry information and are the end characters of the string added when sending, a bitwise exclusive OR operation is applied to the corresponding element of the selected key.
After the loop is finished, the function returns the value of the decrypted text, which in this case is the key for the next call to the decryption function. After finding the required key and decrypting the encrypted key, the decryption function is called again, but now as arguments, the encrypted message and the key that was decrypted in the previous step are passed. At the output, the function returns a decrypted message that looks like this:
Thus, the initial values transmitted from the limited device were obtained.
Using the initial measured value for the initialization on the unconnected and ungrounded analog input of the microcontroller and performing several arithmetic operations according to the proposed algorithm, it is possible to generate a truly random sequence of characters, as long as the length of the message, to ensure absolute cryptoresistance.
If there is a need to perform calculations with the received data and adjust the system operation on the gateway of the Internet of Things system model, it is necessary to use different predefined encryption keys to encrypt the randomly generated keys, for the server and for the gateway, so that in the event of a breach of the gateway, the data to be transmitted to server, remained protected.
The developed method makes it possible to eliminate the threat of unauthorized access to data in the gateway-built-in sensor link by encrypting data packets.
Since these algorithms can be used on devices with limited computing resources due to the minimization of calculations, since elementary operations are used for encryption. Encryption reliability in this case is ensured by a unique encryption key for each data packet. To generate random key values, analog noises are used, read from the unconnected input of the microcontroller, so the resulting value is truly random. Preset keys are used to encrypt the keys with which the encrypted message is ciphered. Since message encryption keys are random and unique, encrypting them with preset keys makes it impossible for an attacker to learn the preset key.
In further research, it is necessary to evaluate the reliability of the algorithm for generating random numbers for key generation, in particular, the ability to influence analog noise using electromagnetic radiation and to analyze the developed method of information encryption using the criteria of various performance indicators such as execution time, power consumption, memory requirement for performing calculations.