MeDI: Measurement-based Device Identification Framework for Internet of Things

IoT systems may provide information from different sensors that may reveal potentially confidential data, such as a person's presence or not. The primary question to address is how we can identify the sensors and other devices in a reliable way before receiving data from them and using or sharing it. In other words, we need to verify the identity of sensors and devices. A malicious device could claim that it is the legitimate sensor and trigger security problems. For instance, it might send false data about the environment, harmfully affecting the outputs and behavior of the system. For this purpose, using only primary identity values such as IP address, MAC address, and even the public-key cryptography key pair is not enough since IPs can be dynamic, MACs can be spoofed, and cryptography key pairs can be stolen. Therefore, the server requires supplementary security considerations such as contextual features to verify the device identity. This paper presents a measurement-based method to detect and alert false data reports during the reception process by means of sensor behavior. As a proof of concept, we develop a classification-based methodology for device identification, which can be implemented in a real IoT scenario.