MS in Engineering in Computer Science

Seminar of

Web Security
and
Privacy
BLOCkCHAIN
Prof. Alberto Marchetti-Spaccamela FOR
INTERnET OF THINGS
a.y. 2016/2017
 hello!
We are Biagio Botticelli and Luca Marchetti
You can find us at:
botticelli.1212666@studenti.uniroma1.it
marchetti.1475046@studenti.uniroma.it
 Seminar outline

1. Internet of Things
2. Security and Privacy in IoT = Open Problems!
3. BlockChain
4. BlockChain in IoT: Smart Home Approach
5. Conclusions
 1.
Internet of Things
Internet of things: a Definitio
n
The Internet of Things describes
the vision where objects become
part of the Internet: where every
object is uniquely identified, and
accessible to the network, its
position and status known, where
services and intelligence are added
to this expanded Internet, fusing
the digital and physical world into
a single one.
example of Iot devices
There is a very large variety of
smart IoT devices that are being
introduced at each layer of IT.
Each device has a precise purpose
and specific characteristics.
But there is a common feature:

Human is not the center of

the system… but a part of it!
Iot: a growing trend
IoT has been called the next
Industrial Revolution
and it will impact the way all
businesses, governments, and
consumers interact with the
physical world.

With the rise of IoT, the number

and diversity of connected
devices is expected to increase
exponentially
6.4 devices per person !

Connected devices
outnumbered
world population !
More than ...

per year by 2025 !!!

iot architecture
IoT architecture can be represented by four building blocks:
1. Things: uniquely identifiable nodes, primarily sensors
that communicate without human interaction using
different connectivity methods.

2. Gateways: they act as intermediaries between things

and the cloud to provide the needed connectivity,
security, and manageability.

3. Network Infrastructure: set of devices that control

and secure data flow (routers, aggregators, gateways,
repeaters).

4. Cloud infrastructure: pools of virtualized servers and

storage that are networked together with computing
and analytical capabilities.
 Which is your
first idea of Iot
application in
real life ?
Our idea is…
 2.
Security &
privacy in iot:
Open Problems!
Smart home: dream or nightma
re ?
Smart Homes collect and analyze a lot of sensible user data.
Every new connected appliance generates more data about the user’s
patterns and behaviour creating digital trail of personal details.
This data could easily fall into the wrong hands.
Increased connectivity exponential increase in the threat surface.
The more smart technology we add, the more likely the chance it’s
going to be abused and infringe on our most basic privacy needs with
breaches in the sanctity of our own homes.

The dream might just become a terrible nightmare!

The path to privacy and user awareness is a long and winding road and
certainly a very complicated problem to face for the adoption of the IoT.
an example…
A case in point is the recent spate of hacks into home networks via Internet
of Things connected devices installed in the home.
Weakly secured IoT devices allow hackers undetected free access to their
victims’ lives. Aside from this invasion of privacy, devices that transmit
location data (for example over social media) could enable
easy tracking of the location of the owner’s home.
The ability to remotely view home data could be used to
monitor user presence in the home as part of a burglary
attempt by “smart” thieves.
Real Example: the robbery to Ian Wright’s home in London
whilst he was commentating in Brazil during the world cup.
Another example… Mirai
20th September 2016 : KrebsOnSecurity.com was targeted by an extremely
large and unusual Distributed Denial-of-Service (DDoS) attack of over 660
Gbps of traffic.
The most interesting aspect of this attack is that it was not performed by
using traditional reflection/amplification DDoS, but with direct traffic
generated by a botnet (or zombie network) of hacked IoT devices.
The IoT devices were infected by a malware
called mirai using Telnet connection and very
simple dictionary attacks.
Once the device has become infected, it’s
made part of the Mirai botnet that will be
used to make the DDoS attack.
Main problems...
Conventional security and privacy approaches are inapplicable for IoT.
Since IoT framework has:
× decentralized topology
× Resource constraints of devices
× communication performances
× privacy issues
× Lack of security standards
IoT devices are appealing ideal targets for various cyber attacks !
Two sides of the same coin...

So, if on one hand, the Internet of Things

offers data which can be used to offer
personalized services which provides
utility to the users, on the other one, the
embedded information, if not properly
protected, it can be used to obtain a
virtual biography of our activities,
revealing private behavior patterns.
Is there a solution
to ensure security
and privacy in iot ?
Blockchain
is the way!
 3.
blockchain
What is a Blockchain?
A blockchain is a distributed database
that maintains a continuously growing
list of records, called blocks.

It’s a an open distributed ledger that can record transactions between

parties efficiently in a verifiable permanent way (no master host that
holds the entire chain).
Blockchains are secure by design from tampering and revision: once
recorded, the data in a block cannot be altered.
It offers a decentralized identity management (a user can register in the
blockchain all by himself).
What is a Blockchain?
Through the use of a peer-to-peer network and a distributed
timestamping server, a BC database is managed autonomously.
A blockchain consists of two types of elements:

1. Transactions; the actions

created by the users in the
system.
2. Blocks: record of valid
transactions in the correct
sequence that are hashed and
encoded into a Merkle tree.
Blockchain: miner
Any node in the peer-to-peer network of BC can choose to be a miner.
A miner is an entity that is responsible for mining (adding) new blocks to
BC by solving a resource-intensive cryptographic puzzle called Proof Of
Work (POW) and appending new blocks to BC.
When a new transaction occurs, it is broadcasted to the entire network.
All miners who receive the new transaction verify it by validating the
signatures contained within the transaction.
Each miner appends the verified transaction to its own pending block of
transactions that are waiting to be mined.
Blockchain: an example
Each block contains a timestamp, a nonce (Proof Of Work) and the hash
value of the previous block. The linked blocks form a chain.

Each transaction is digitally

signed and each user can
verify its validity.
Proof of work
To add a new block, the miner has to find a nonce such that:

where:
= good and computationally hard hash function ;
= subset of the hash function output ;
= hashed value of the i-th transaction of the block .
The first who find the POW, can propose the block as the next block in
the Blockchain and receive fees as incentive.
The chain with the most cumulative Proof-Of-Work is always considered
the valid chain by the network.
 Blockchain: advantages
The blockchain has some interesting advantages. It’s:
Public : every user can see the blocks and the transactions stored in them.
This does not mean everyone can see the actual content of your
transaction, indeed its content is protected by your private key.
Decentralized : there is no single authority that approves the transactions.
This means that there's trust in BC, since all the participants in the
network have to reach a consensus to accept transactions.
Secure: the existing database can only be extended and previous records
cannot be changed (or rather, there's a very high cost if someone wants
to tamper previous records).
 4.
Solution?
blockchain in
iot
Blockchain in iot is the solution
!
Some features of BC make it an attractive technology for addressing the
security and privacy challenges in IoT:
● Decentralization: the lack of central control ensures scalability and
robustness by using resources of all participating nodes and eliminating
many-to-one traffic flows. This also decreases delay and overcomes the
problem of a single point of failure.
● Anonymity: the inherent anonymity afforded is well-suited for most IoT
use cases where the identity of the users must be kept private.
● Security: BC realizes a secure network over untrusted parties which is
desirable in IoT with numerous and heterogeneous devices.
 But it has also problems to fac
e…
Adopting the BC in IoT is not straightforward and it leads to the following flaws:

× Processing power and time: IoT networks are

formed by devices that have very different
computing capabilities and not all of them will be
capable of running the same encryption
algorithms at the desired speed.
Mining is computationally intensive and the
majority of IoT would not to be able to manage it.
Furthermore, mining of blocks is time consuming
while in the most of IoT applications low latency
is desirable.
But it has also problems to fac
e…
× Scalability: BC scales poorly as the number of nodes in the network
increases. But, IoT networks may contain a large number of nodes.

× Storage: the BC ledger has to be stored on the

nodes themselves and it will increase in size as
time passes. That is beyond the capabilities of a
wide range of smart devices such as sensors,
which have very low storage capacity.
× Traffic overhead: the underlying BC protocols
create significant overhead traffic which may be
undesirable for bandwidth-limited IoT devices.
 Proposed solution: design
The proposed solution is a novel instantiation of BC which eliminates the
concept of POW and the need for coins.
The framework relies on hierarchical structure and distributed trust to
maintain the BC security and privacy while making it more suitable for the
specific requirement of IoT.
The architecture is composed by 3 tiers:

1. Smart Home: 2. Overlay Network 3. Cloud Storage

a. Devices
b. Local blockchain
c. Local storage
 1. smart home
The smart home is formed from three components:

a. Devices: all devices located in the Smart Home.

The devices are managed by transactions. All transactions to or from the
smart home are stored in a local private BlockChain (BC).
b. Local blockchain: a secure and private BC that is mined and stored by one
(or more) device(s), which is always online.
The local BC is centrally managed by its owner.
c. Local storagE: storing device used by devices to store data locally.
The storage can be either integrated with the miner or it can be a
separate device.
A. Device; transactions
Communications between local devices and/or overlay nodes are known as
transactions.
All transactions use a shared key (generated by a generalized Diffie-Hellman
algorithm) to secure the communication.
Each transaction is designed for a specific function:
a. Store: generated by devices to store data.
b. Access: generated by a Service Provider or the homeowner to access the
cloud storage.
c. monitor: generated by the homeowner or SPs to periodically monitoring
a device information.
d. Genesis: generated to add a new device to the smart home.
e. Remove: generated to remove a device from the smart home.
A. Device; transactions
Lightweight hashing is employed to detect any change in transactions’
content during transmission.
Smart devices may communicate directly with each other or with
entities external to the smart home.
To achieve User Control over transactions, a Shared Key should be
allocated by the miner to devices.
To allocate the Key, the miner asks for permission (Policy Header) and
distributes the Shared Key between devices.
After receiving the Shared Key, devices can communicate directly as
long as the key is valid.
To deny a permission, the miner marks the distributed key as invalid.
A. Device; transactions
Add: to add a new device a genesis transaction is created.
When a new device is added, it’s fundamental to update the Policy Header in
order to allow all the communication.
Access
Local: the device make a request to the miner that checks the permission
and take the data from the local storage and send it back to the
requester.
Cloud: the miner either requests the data from the cloud storage and
sends it back to the requester, or it sends back the last block number
and hash of requested data to the requester.
Monitor: the miner send the current data of the requested device to the
requester. If the requester is allowed to receive data periodically, then the
miner sends data periodically to it.
A. Device; transactions
Store Data
Local: it requires that the device is authenticated to the local storage.
The device send a request to the miner, that checks if the device has
storing permission; then the miner generate a shared key that sends
both to the device and to the local storage.
By receiving the shared key, the local storage generates a starting point
that contains the shared key and having the shared key, the device can
store data directly in the local storage.
Cloud; cloud storage data are stored in identical blocks associated with
unique number. Block number and hash of stored data are used by the
user for authentication : the user sends data and request to the miner
that authorize the storing. The block number and the hash is returned to
the miner.
B. Local blockchain
In each smart home, there is a local private BC that keeps track of
transactions and has a Policy Header to enforce users’ policy for
incoming and outgoing transactions.
Each block contains two headers :
Block Header: it contains the hash of the previous block to keep the
local blockchain immutable ;
Policy Header: it’s used to authorize devices and to enforce owner’s
control policy over the Smart Home. It has four parameters:
I. Requester: it refers to the requester Public Key;
II. Requested Action: one action between store, access and monitor ;
III. ID: identifier of the device in the Smart Home;
IV. Action Flag: to allow or deny to execute the requested action.
B. Local blockchain
Besides the headers, each block contains a number of transactions.
For each transaction, five parameters are stored in the Local Blockchain :
i. Previous Transaction
ii. Transaction number
iii. Device ID
} Used to chain transactions of the same device and
to identify each transaction uniquely in the BC

iv. Transaction Type: genesis, access, store and monitor.

v. Corresponding Multisig Transaction: stored if the transaction comes from
the overlay network, otherwise it’s left blank.
The Local Blockchain is maintained and managed by the home miner.
B. Home miner
The miner is the device that centrally processes
incoming and outgoing transactions to and
from the Smart Home.
It authenticates, authorizes and audits
transactions, creates genesis transactions,
distribute and updates keys, change the
transaction structure, form/manage the
cluster.
To provide additional capacity, the miner
manages a local storage.
The Miner collects all the transactions in a block
and append that block to the BC.
C. local storage
Local storage is a storing device (e.g. backup drive) that is used by
Smart Home devices to store data locally.

It can be integrated with the miner or it can be a separate device.

It uses a First-in-First-Out (FIFO)

method to store data.

The data of a specific device is

stored as a ledger chained to the
device’s starting point.
Summarizing
with clear
figures …
Monitor transaction
access transaction
store transaction
2. Overlay network
The Overlay Network is act a Peer-To-Peer Network (P2P ).
In order to get Anonymity at IP-Layer, each node uses TOR.
To decrease network overhead and delay, the network is divided in Clusters in
which a Cluster Head (CH ) is elected among the nodes.
If a node delay is not tolerant, the node could change cluster.
Anyway, nodes in clusters can elect a new CH at any time.
Each CH contains:
Public Keys of Requesters: allow to access data for the Smart Home;
Public Keys of Requestees: allow to access the SHs connected to the cluster;
Forward List: transactions sent for other CHs in the network.
Each CH independently decides whether to keep a new block or discard it.
There is no requirement for the Blockchains to be reconciled …
so the synchronization overheads are reduced.
3. Cloud storage
Devices in the Smart Home may wish to store their data in the cloud
storage, so that a third party Service Provider (SP ) can access the stored
data and provide certain smart services.
The cloud storage groups user’s data in identical blocks associated with a
unique block-number. Block-number and hash of stored data are used
by the user for authentication.
After storing data, the new block-number is encrypted using a shared
key derived from generalized Diffie-Hellman algorithm.
Whoever owns the key is the only one who knows the block-number !
Since hash values are collision-resistant and only the true user knows
the block-number, we can guarantee that nobody except the true user
can access the data and add new data to an existing ledger.
 5.
conclusions
 Main threats
The main classes of threats to Smart Home are:
× Threat to accessibility: the goal of the adversary is to prevent the
legitimate user from getting access to data or services.
× Threat to authentication and access control: the adversary tries to
authenticate as a legitimate user in order to gain access to data.
× Threat to anonymity: the goal of the
attacker is to find the real world identity
of the user by analyzing the anonymous
transactions and other publicly available
information.
 Main attacks
Accessibility - Distributed Denial of Service ( DDoS ) : The attacker uses a huge number of infected IoT
devices to overwhelm a particular target node with fake traffic.
The protection against DDoS is composed by two levels of defence:
1. The attacker cannot directly install the malware since these devices are not directly
accessible and since all the transactions have to be checked by the miner.
2. The outgoing traffic has to be authorized by the miner by examining the policy header.
Anonymity - Linking attack : The attacker establish a link between multiple transactions or data
ledgers with the same Public Key in order to find the real world ID of an anonymous user.
The protection is guaranteed : the data of each device is shared and stored using a unique key.
Furthermore, for each device, the miner creates a unique ledger of data in the cloud storage
using a different Public Key.
From the overlay point of view, the miner should use a unique key for each transaction.
authentication & access control attack : The attacker aims to hack into existing devices in the SH.
The protection is guaranteed : all devices should be predefined by the user and a starting
transaction should be mined in the Local Blockchain.
Security requirement evaluation
requirement Employed safeguard

confidentiality Achieved using Symmetric Key Encryption.

integrity Achieved employing Hashing.

availability Achieved by limiting acceptable transactions by devices and miner.

User control Achieved by logging transactions in the Local Blockchain.

authorization Achieved by using the Policy Header and the Shared Keys.

Distributed trust: in the overlay network each Cluster Head maintains a trust rating for other CHs,
which relies on direct and indirect evidence.
direct: CH A has direct evidence about CH B if it verifies a block mined by B.
Indirect: If A receives B’s block from CH C, then it has indirect evidence about B.
Experiments: time overhead
The BC-based design consumes more
time to process packets compared to
the base method in which encryption
and hashing operations are applied.

worst case
For the query-based store transaction
the additional overhead introduced by
our method is 20ms …

tolerable !!!
Experiments: energy consumptio
n
The energy consumption by CPU
increased roughly 0.002(mj) due to
encryption and hashing.

Transmitting longer data packets

doubled the transmission energy
consumption of SH compared to
the base method.

tolerable !!!
Experiments: packet overhead

Using encryption and hashing increases the packets payload size;

however, the increase in the data payload is relatively …

tolerable !!!

… in conclusion
 The guaranteed
security and privacy
benefits introduced,
significantly outweigh
the low overheads !!!
references
× A. Dorri, S. S. Kanhere, R. Jurdak and P. Gauravara:
Blockchain for IoT Security and Privacy: The Case Study of a Smart Home
× A. Dorri, S. S. Kanhere and R. Jurdak:
Blockchain in Internet of Things: Challanges and Solutions
× A. Banafa:
IoT and Blockchain Convergence: Benefits and Challenges
× K. Prabhu and K. Prabhu:
Converging blockchain technology with the Internet Of Things
× S. Huh, S. Cho and S. Kim:
Managing IoT devices using blockchain platform
× A. Dorri, S. S. Kanhere and R. Jurdak:
Towards an Optimized BlockChain for IoT
Contacts
Biagio Botticelli
LinkedIn Profile
botticelli.1212666@studenti.uniroma1.it
Luca Marchetti
LinkedIn Profile
marchetti.1475046@studenti.uniroma.it

This presentation is also available on SlideShare.