Security for Ubiquitous Internet-Connected Smart Objects

Ubiquitous computing, also called the Internet of Things (IoT), is rapidly transforming our lives and our society. The vision of an interconnected world where physical devices are seamlessly integrated into the Internet is becoming a reality. The emergence of low-cost microcontrollers, energy-efficient wireless communications, and embedded sensors and actuators has transformed everyday devices into connected smart objects that can understand and react to their environment. These devices include both resource-constrained battery-operated devices, such as body sensors, and more powerful Internet-connected appliances, such as televisions and cameras. However, the security mechanisms for smart objects are still not ready for wide-scale deployment. There is additionally a concern that the existing solutions are not sufficiently usable for adoption in everyday devices, which often have very limited user interfaces. In this dissertation, we develop new secure deployment and communication methods for connected smart objects that are simple, user-friendly, and also energy efficient. We take into account the entire lifecycle of a smart object. We first build a secure and energy-efficient communication model that uses a proxy to serve data on behalf of sleeping resource-constrained smart objects, thereby allowing them to appear as always-online web servers. Next, we demonstrate how these smart objects can leverage the existing mobile network infrastructure to securely authenticate and communicate with Internet services. Thereafter, we study the deployment challenges of electronic displays. We found that deploying large numbers of ubiquitous displays is cumbersome as they need to be correctly configured to access both the Internet and online servers, despite their minimal input capabilities. In our secure bootstrapping solution, the displays show a bar code which, when scanned by the user, enables automatic configuration of the wireless network along with the online management service and content to be shown. For effortless deployment, we build our solution on standard protocols without requiring changes to the network infrastructure. Finally, we develop a solution for securely pairing mobile devices. Instead of relying on inconvenient user-entered codes, our solution uses an out-of-band (OOB) channel which is secret from anyone that is not physically present. The protocol development was motivated by the invention of a new human source for fuzzy secrets: synchronized drawing with two fingers of the same hand on two touch screens or surfaces. We show the feasibility of each of our proposed solutions with prototype implementation. Where relevant, we also provide experimental results confirming that our solutions incur minimal memory and computational overhead, while also being energy efficient and easy to use. Lastly, we actively contribute the research results to relevant standards bodies.