Secure smart agriculture monitoring technique

through isolation
George Suciu, Cristiana-Ioana Istrate, Maria-Cristina Dițu
R&D Department
Beia Consult International
Bucharest, Romania
[email protected], [email protected], [email protected]

Abstract—In recent years, agriculture has become increasingly

data-driven and data-enabled due to the use of different II. RELATED WORK
technologies such as greenhouse and aquaculture technologies. This section presents an overview of some existing
With the development of agriculture, new technology is required, monitoring systems for agricultural crops, and as well, a
and the focus is facing towards the smartest technological
review of earlier and parallel work.
investment. The increasing demand for the quality and the
quantity in the food sector raised the need to intensify and ThingWorx [3] is an IoT platform that offers the needed
industrialize the agriculture sector. The current work provides security and scalability when managing transactions associated
empirical measurement results from an Internet of Things (IoT) with a connected world. It gives the opportunity to build and
platform based on remote telemetry applications for agriculture. gain value from smart, connected operations. It offers rapid
This paper aims to demonstrate how the processing of Big Data development tools and support for on-premise or cloud
and the concept of decentralized cloud operation can answer the deployments. This platform can provide the user with the
demands of IoT applications in agriculture and how smart required means to deploy smart IoT agriculture solutions with
farming will help farmers operate more efficiently and more
a minimum effort.
secured. The architecture is based on ADCON Remote Telemetry
Units (RTUs), Software as a Service (SaaS), a Platform as a Fuse [4] is one of the solutions used in precision
Service (PaaS) represented by Grafana and influxDB database. agriculture where the farmers can gain access to relevant data
Keywords—smart agriculture, isolation, security, telemetry, to make informed decisions, leading to the enhancement of
IoT their business’s productivity and profitability. This solution is
designed for the entire process of the crop cycle starting with
I. INTRODUCTION enterprise planning up to planting, harvesting and storing.
Generally, the agriculture telemonitoring domain does not The Smart Agriculture solution from Hexagon [5]
contain all necessary hardware and software parts, such as addresses the entire lifecycle of the agriculture process and
sensors, remote telemetry units, data collection gateway, a assists in crop management through digital workflows created
server with Disease Management and Irrigation Management from geo-enabled data.
software extensions, secure actuating. Communication within Kaa [6] is an IoT open-source platform that allows working
the network, as well as with the outside world, is based on safely into the agriculture field, used for solutions like
heterogeneous protocols that are not entirely Internet-based so resource mapping, smart metering devices, failure prediction
that cooperation between different stakeholders involved in systems, and livestock trackers. It is developed on a modular
agriculture management and precision farming is not micro-service architecture that allows the user to apply any
straightforward. necessary modifications, extensions, or integrations.
The use of Information Communication Technology (ICT), In [7] is presented a farm management technique which
and in particular the Internet of Things (IoT), is essential for benefits from the new features that are offered by the “Future
smart agriculture [1] in order to address the challenges during Internet”, a programme which addresses the shortcomings in
the electronic monitoring of agricultural products. IoT the current Internet. These benefits include generic software
solutions have a great potential in ensuring the safety and modules which may be used to produce farming related
quality of crops. specific modules. The farm’s management system functional
Remote monitoring and control (M&C) systems [2] architecture is specified, depending mostly on a particular
combine both wireless and cabled sensors for data gathering module located in the cloud.
and data transport. At the same time, information management In [8] are presented the design, tests, and evaluation of an
systems are designed to store and process the collected data. IoT based device that can analyze the transmitted data. This
The current work provides empirical measurement results device, which may be implemented within the agricultural
from an IoT platform based on remote telemetry applications domain for security purposes, can be monitored and controlled
for agriculture. from distance. This work proposes methods to solve issues
The paper is organized as follows: Section II analyzes related to crops threats by delivering real-time notifications
related work; Section III details the proposed system and, based on the received data, to address these issues without
architecture, while Section IV discusses implementation and human intervention.
experiments. Section V draws the conclusions.

978-1-7281-2171-0/19/$31.00 ©2019 IEEE

 Python scripts have been used to integrate the sensors of (Software as a Service - SaaS) and the Presentation Service
this device. Test cases have been performed with a success (Platform as a Service - PaaS) as presented in Fig. 2.
rate of 84.8%.
What brings an advantage to our solution, beyond the
decentralized cloud operations, is the security by isolation
concept that allows users, and also the system itself, to operate
more securely.
III. SYSTEM ARCHITECTURE
The System Under Analysis (SUA) is an Agro-
Meteorology system for Viticulture Disease Warning [9], an
IoT platform for precision agriculture, in particular for crops
disease management, alerts, and notifications. As shown in
Fig. 1, SUA collects data from the vineyard and presents it to
users through Web services. The users of SUA can be vineyard
owners or public authorities. Fig. 2. The system architecture.
● Vineyard owners: remotely read sensor data for We propose the implementation of several virtual
observing the status of the vineyard and issue
machines (VM) APIs, which will execute ADCON URL
commands to the actuator for performing some
Programming Interface or addUPI. ADCON [11] is a remote
farming activity, for instance, irrigation;
telemetry station that allows communication with sensors over
● Public authorities: collect sensor data from multiple
vineyards in an area to perform long-term agriculture this addUPI, an XML/JSON protocol. addUPI [12] allows
planning or management. applications to iterate sensors and nodes - platforms containing
SUA comprises two subsystems, namely the Telemetry multiple sensors, and also gathering sensor data. addUPI
sub-system and the Server subsystem. The telemetry defines the communication protocol between various TCP/IP
subsystem monitors the vineyard using wireless or cabled capable components of Adcon Telemetry’s addNET telemetry
sensor for data gathering and controls specific mechanical system. The server usually stores the data in a PostgreSQL
systems in the vineyard using wireless or cabled actuators, for database, but because the data is needed to be displayed in
example, turning on or off the irrigation process. The server time-series, it will be transmitted to the influxDB database
subsystem transmits sensor data to the server and user instead.
commands to the actuators through the Internet, processes the IV. IMPLEMENTATION AND EXPERIMENTS
collected data and stores them for further research.
In the telemetry subsystem, the communication links In order to illustrate the concept of secured connections,
between sensor/actuator and Remote Terminal Unit (RTU) we have used strongSwan [13] on a Raspberry Pi to tunnel the
may be achieved through a variety of technologies [10]. Only Internet connection through an IKEv2 virtual private network
the generic cases have been considered, i.e. either wired or (VPN), implemented by a Common Criteria (CC) [14]
wireless communication links, and general threats to such compliant Lancom device for connecting to the internal DMZ
links. To deepen the generic threats, a more detailed analysis (demilitarized zone). The Lancom CC offers high-security
can be conducted by considering particularities of the levels in data communications, using CC EAL4+. This
communication technologies when specific information on the evaluation level is the highest certification level a commercial
telemetry subsystem are available. network infrastructure can reach. Extensive VPN capacities
enable remote websites to access the organization’s network
securely. The Lancom router uses the IPSec system with an
IKE Authentication. Therefore, we needed a solution for
Raspbian (OS of the Raspberry Pi) compatible with IPSec and
IKE parameters. Raspbian system is based on Debian.
Tests have been performed with the IKEV2C_PEN16 VPN
on Raspberry Pi 3B+ running Raspbian Stretch Lite (version
4.14).
Isolation between different execution environments and
cloud services is done using Docker containers within SaaS
Fig. 1. Architecture of SUA.
and PasS services. Furthermore, role and device management
The system architecture is based on four main components, are performed using secure configuration channels (SSH, SCP,
namely the RTU, the Gateway, the Application Service VPN, HTTPS) for mapping Message Queuing Telemetry
Transport MQTT [15] broker topics to the keys in the time
series databases (Graphite/Carbon or influxDB) for the After entering the Python code and running the script, a
Application Service (SaaS). Finally, authentication and access dashboard can be configured in Grafana using the same topic.
control based on token verification mechanism (JSON API Data displayed in Grafana can be seen in Fig. 5.
addUPI) are performed in Grafana [16] for the Presentation
Service (PaaS).
In order to use this interface, a transmission channel is
necessary between Grafana and the transmitted data.
Therefore, the MQTT protocol [15] will be used. This protocol
allows the user to send and receive data as a client. It can be
used in cases where a low-bandwidth is required. This protocol
is based on a publish and subscribe system that allows a device
to be subscribed to a topic or to publish a certain information
on it. This information can be data gathered from a sensor for
example or a command. The topic is basically a string Fig. 5. Data displayed in Grafana.
separated by a slash and it shows how the information is
published and the interest over a future message. Another Authentication and access control using Grafana can be
important concept when using the MQTT protocol is the demonstrated by developing two organizations entitled Beia
broker who will receive, filter and forward the message to the and ODSI [17] as shown in Fig. 6. Initially, the latter has only
right subscribed client. one available dashboard, and then the new one is imported in
Data such as memory usage from Raspberry Pi 3B+ was JSON format, from the organization named Beia.
sent using MQTT protocol over a VPN that will enable a
secure connection. These data will be displayed in Grafana
that will allow the user to visualize and interpret it. Fig. 3
shows how this process of sending data works.

Fig. 3. Sending data from Raspberry to Grafana.

Data regarding the memory usage can be seen by creating a Fig. 6. Organizations from Beia and ODSI.
python script that will display those data in mqtt-spy. For this,
a topic must be created by using the same words as the one Roles within an organization can be modified by
that was used in the script. administrators, who can control user access. Other possible
roles are Edit and View, as seen in Fig. 7, which have different
A python script was written to connect to MQTT and to
and limited permissions within the organization. Also, the
make the user able to view data in Grafana.
permissions for each dashboard can be changed according to
Data displayed in MQTT can be seen in Fig. 4.
user roles, as shown in Fig. 8. Thus, it is possible to isolate
work environments within a single organization.

Fig. 7. Users with different roles within ODSI organization.

Fig. 4. Data displayed in MQTT.

 attacks to limit data transmission between RTUs and the
server, and as well, to prevent a legitimate user, a farmer,
accessing their data from the server.
ACKNOWLEDGMENT
This work has been supported in part by UEFISCDI
Romania and MCI through projects ODSI, CitiSiM,
SmartAgro project (subsidiary contract no. 8592/08.05.2018,
Fig. 8. Changement of dashboard permissions related to the role/user. from the NETIO project ID: P_40_270, MySmis Code:
105976), PARFAIT, funded in part by European Union’s
From the hardware working environment point of view, it Horizon 2020 research and innovation program under grant
consists in using two different data transmitting Raspberry PIs agreement No. 777996 (SealedGRID project) and No. 787002
in isolated conditions, as presented in Fig. 9. (SAFECARE project). The authors would like to thank Ioana
Marcu for constructive criticism of the manuscript.

REFERENCES
[1] N. Ahmed, D. De and I. Hussain, “Internet of Things (IoT) for
Smart Precision Agriculture and Farming in Rural Areas”, IEEE
Internet of Things Journal, vol. 5, no. 6, pp. 4890-4899, 2018.
Available: 10.1109/jiot.2018.2879579.
[2] Z. Yang and T. Nakajima, “Connecting Smart Objects in IoT
Architectures by Screen Remote Monitoring and Control”,
Computers, vol. 7, no. 4, p. 47, 2018. Available:
10.3390/computers7040047.
[3] “Developer Portal | Developer Portal: ThingWorx”,
Fig. 9. Raspberry PI data are available in different dashboards. Developer.thingworx.com, 2019. [Online]. Available:
https://developer.thingworx.com/en. [Accessed: 14- Jan- 2019].
V. CONCLUSION [4] “Fuse® Smart Farming. Synchronized. | Fuse”, Fuse, 2019.
[Online]. Available: https://www.fusesmartfarming.com/.
This article is centered on the farming domain and its need [Accessed: 14- Jan- 2019].
for the latest technologies in smart farming. Using fixed and
[5] “Solutions”, 2019. [Online]. Available:
mobile sensors, together with mobile devices such as https://hexagonagriculture.com/solutions. [Accessed: 14- Jan-
smartphones and tablets, the farmers gather data in various 2019].
formats regarding mainly the crops, soil, and weather allowing [6] “The most flexible IoT platform for your business”, 2019.
them to effortlessly access their data and monitor their crops. [Online]. Available: https://www.kaaproject.org/. [Accessed: 14-
The collected data are sent to a core cloud platform where they Jan- 2019].
are processed and analyzed using specific algorithms. The [7] A. Kaloxylos et al., “Farm management systems and the Future
results are sent back to the farmers to improve the agricultural Internet era”, Computers and Electronics in Agriculture, vol. 89,
process, also allowing remote actuating of the irrigation pp. 130-144, 2012.
systems. The same devices, sensors, and actuators will also be [8] T. Baranwal, P. K. Pateriya, “Development of IoT based smart
used by other stakeholders, such as disaster early warning security and monitoring devices for agriculture” In Cloud
systems [18], for efficient real-time management, and System and Big Data Engineering (Confluence), 2016 6th
therefore, security must be carefully controlled. International Conference, pp. 597-602, January 2016.
Several sensors and gateways have been integrated into an
Agro-Meteorology M2M system for precision agriculture, in [9] G. Suciu, O. Fratu, A. Vulpe, C. Butca, and V. Suciu, “IoT agro-
meteorology for viticulture disease warning,” 2016 IEEE
particular for crops disease management, alerts, and International Black Sea Conference on Communications and
notifications. As shown in Fig. 2, the system collects data from Networking (BlackSeaCom), 2016.
vineyards and presents it to users through Web services. The
[10] P. Jayaraman, A. Yavari, D. Georgakopoulos, A. Morshed and
users of the vineyard can be a vineyard owner or a public A. Zaslavsky, “Internet of Things Platform for Smart Farming:
authority. The designed system encompasses two subsystems, Experiences and Lessons Learnt”, Sensors, vol. 16, no. 11, p.
namely the Telemetry subsystem and the Server subsystem. 1884, 2016.
We are using ADCON RTUs to transmit data, which are, [11] “adcon.com”, Adcon.com, 2019. [Online]. Available:
in the end, displayed in Grafana dashboards. However, by this https://www.adcon.com/. [Accessed: 29- Jan- 2019].
paper, we wanted to likewise demonstrate the security through [12] “ADCON addVANTAGE 6.x”, Adcon.com, 2019. [Online].
isolation concept via the experiments we have undertaken. Available: https://www.adcon.com/products/software-
As future work we envision testing the system for denial of 285/adcon-addvantage-6x-1485/. [Accessed: 29- Jan- 2019].
service (DoS) attacks. We will focus on implementing DoS
[13] H. Redzovic, A. Smiljanic and B. Savic, “Performance
evaluation of software routers with VPN features”, Telfor
Journal, vol. 9, no. 2, pp. 74-79, 2017. Available:
10.5937/telfor1702074r.
[14] L. GmbH, “High-security site connectivity”, LANCOM
Systems, 2019. [Online]. Available: https://www.lancom-
systems.com/solutions/network-connectivity/high-security-site-
connectivity/. [Accessed: 29- Jan- 2019].
[15] V. V., R. I. and S. C., “IoT Embedded System for Data
Acquisition using MQTT Protocol”, International Journal of
Computer Applications, vol. 182, no. 11, pp. 1-4, 2018.
Available: 10.5120/ijca2018917736.
[16] “Grafana - The open platform for analytics and monitoring”,
Grafana Labs, 2019. [Online]. Available: https://grafana.com/.
[Accessed: 14- Jan- 2019].
[17] G. Suciu, C. Istrate, A. Petrache, D. Schlachet, and T. Buteau,
“On demand secure isolation using security models for different
system management platforms,” Advanced Topics in
Optoelectronics, Microelectronics, and Nanotechnologies IX,
2018.
[18] P. Stefanic, G. Suciu, D. Kimovski, and V. Stankovski, “Non-
functional requirements optimisation for multi-tier cloud
applications: An early warning system case study,” 2017 IEEE
SmartWorld, Ubiquitous Intelligence & Computing, Advanced
& Trusted Computed, Scalable Computing & Communications,
Cloud & Big Data Computing, Internet of People and Smart City
Innovation
(SmartWorld/SCALCOM/UIC/ATC/CBDCom/IOP/SCI), 2017.