UNIT -1

4) Zigbee Architecture
ZigBee is an open, global, packet-based protocol designed to provide an easy-
to-use architecture for secure, reliable, low power wireless networks. ZigBee
is a standard that addresses the need for very low-cost implementation of
Low power devices with Low data rates for short-range wireless
communications.
ZigBee Devices:
 Zigbee Coordinator Device: It communicates with routers. This device is
used for connecting the devices.
 Zigbee Router: It is used for passing the data between devices.
 Zigbee End Device: It is the device that is going to be controlled.

Zigbee protocol architecture consists of a stack of various layers this protocol

is completed by accumulating Zigbee’s own network and application layers.
Physical Layer: The Physical layer is closest to the hardware and directly
controls and communicates with the Zigbee radio. The physical layer
translates the data packets in the over-the-air bits for transmission and vice-
versa during the reception.
MAC Layer: The layer is responsible for the interface between the physical
and network layer. The MAC layer is also responsible for providing PAN ID and
also network discovery through beacon requests.
Network Layer: This layer takes care of all network-related operations such as
network setup, end device connection, and disconnection to network,
routing, device configurations, etc.
Application Support Sub-Layer: This layer enables the services necessary for
Zigbee device objects and application objects to interface with the network
layers for data managing services. This layer is responsible for matching two
devices according to their services and needs.
Application Framework: It provides two types of data services as key-value
pair and generic message services. The generic message is a developer-
defined structure, whereas the key-value pair is used for getting attributes
within the application objects. ZDO provides an interface between
application objects and the APS layer in Zigbee devices. It is responsible for
detecting, initiating, and binding other devices to the network.
https://www.geeksforgeeks.org/introduction-of-zigbee/

5) Explain different IP based protocols.

MQTT
Developed in 1999 and first known as Message Queuing Telemetry Transport,
it's now just MQTT. There is no longer any message queueing in this protocol.
MQTT uses a publish-subscribe architecture to enable M2M communication.
Its simple messaging protocol works with constrained devices and enables
communication between multiple devices. It was designed to work in low-
bandwidth situations, such as for sensors and mobile devices on unreliable
networks. That capability makes it a commonly preferred option for
connecting devices with a small code footprint, as well as for wireless
networks with varying levels of latency stemming from bandwidth
constraints or unreliable connections. MQTT, which started as a proprietary
protocol, is now the leading open source protocol for connecting IoT
and industrial IoT devices.
2. LoRa
Since its inception in 2015, LoRa WAN is a low-power, wide-area networking
(LPWAN) protocol based on LoRa technology and is used as wide-area
network technology. Long-range, battery powered wireless IoT devices are
the focus of the Long-Range Wide Area Network. It works well in regional,
national, and international networks. It's noted for its ability to communicate
over great distances with minimal power usage and identify signals in a wide
variety of signal levels.
It's been built to provide low-cost mobile secure communication in IoT, smart
city, and industrial applications, as well as millions of devices.
Advantages of LoRa
1. Long-range
2. Bi-directional communication with high security
3. Seamless go-to-market
3.6LoWPAN - 6LoWPAN is an abbreviation for IPv6 over Low Power
Wireless Personal Area Networks. It is an IPv6 adaption layer for
IEEE802.15.4 links. This protocol operates only at 2.4 GHz with a transfer
rate of 250 kbps.
4. UDP (User Datagram Protocol) - A simple OSI transport layer protocol
based on Internet Protocol for client/server network applications (IP).
UDP, the primary alternative to TCP, is one of the oldest network protocols
in use, having been introduced in 1980. UDP is frequently used in
applications that are specifically designed for real-time performance.
5.Datagram Transport Layer Security (DTLS) - For datagram protocols, the
DTLS protocol enables communications privacy. The protocol lets
client/server applications interact in a secure manner that protects against
eavesdropping, manipulation, and message forgery. The DTLS protocol is
based on the Transport Layer Security (TLS) standard and offers the same
level of security.
 6. ZigBee
For IoT networks, ZigBee is an excellent communication standard. It can
support a large number of nodes and has a range of up to 900 feet. Low
power consumption, excellent scalability, strong security, and durability
are all advantages of ZigBee. It also uses destination-based routing to
create a robust mesh network. The IEEE 802.15.4 standard protocol is well-
suited to home automation as well as large-scale industrial installations
such as Bluetooth. There are various ZigBee certified home automation
solutions available, as well as a large user base generating ZigBee
compliant items.
Advantages of ZigBee
1. Better scalability
2. Randomization
3. Long battery life
7. Content-Centric Networking (CCN) - It works on the principle that a
communication network should allow users to focus on the data, rather
than having to reference a specific, physical location from where the data
is to be retrieved. CCN enables content caching to reduce congestion and
improve delivery speed, a simpler configuration of network devices, and
security built into the network at the data level.
6) Explain protocol standardization for IOT.
Protocol standardization for IoT (Internet of Things) is a critical aspect of
ensuring interoperability, security, and scalability within IoT ecosystems.
Standardization involves the development and adoption of common
protocols, communication interfaces, and data formats that allow different
IoT devices and systems to work together seamlessly. This standardization
process is essential for realizing the full potential of IoT by enabling devices
and platforms from different vendors to communicate and cooperate
effectively. Here are some key elements of protocol standardization for IoT
1. Interoperability:
 Common protocols ensure that IoT devices and systems from
different manufacturers can communicate and understand each
 other. This promotes device interoperability, allowing devices to
exchange data and commands reliably.
 Standardized protocols help reduce integration challenges and
make it easier for organizations to deploy and manage diverse
IoT devices in their networks.
2. Scalability:
 As the number of IoT devices grows, it's crucial to have scalable
and efficient protocols. Standardized protocols should be
designed to handle large-scale deployments, providing a
foundation for the IoT ecosystem's growth.
 Scalability in IoT protocols allows organizations to expand their
IoT deployments without worrying about the limitations of the
communication infrastructure.
3. Security:
 Security is a paramount concern in IoT. Standardized protocols
should include security features to protect IoT data, devices, and
networks from threats and vulnerabilities.
 Security standards should cover areas such as authentication,
encryption, access control, and secure bootstrapping.

4. Efficiency:
 IoT devices often operate on limited power and processing
resources. Standardized protocols should be designed with
efficiency in mind to minimize data transmission overhead,
conserve energy, and optimize network utilization.
 Efficient protocols help extend the battery life of IoT devices and
reduce the cost of data transmission.
5. Cross-Industry Collaboration:
 Protocol standardization often involves collaboration among
industry groups, standards bodies, and consortia. For example,
the development of IoT standards may include contributions
from organizations like the Industrial Internet Consortium (IIC),
 the IoT Consortium, and the Open Connectivity Foundation
(OCF).
 Cross-industry collaboration helps ensure that IoT standards are
applicable to a wide range of use cases and industries.
6. Evolvability:
 IoT is a rapidly evolving field. Protocol standardization efforts
should allow for updates and revisions to accommodate
emerging technologies and changing requirements.
 Standardization bodies may establish mechanisms for updating
protocols to keep pace with industry advancements.
7. Education and Adoption:
 Once standards are defined, industry organizations and
governments play a role in promoting awareness, education, and
adoption of these standards. This includes encouraging
manufacturers to build compliant devices and helping
organizations implement them effectively.

UNIT – 2
1)Explain layered attacker’s model with architecture.
A layered attacker's model for IoT (Internet of Things) involves considering
security threats and potential attackers at multiple levels within an IoT
system, from the physical layer to the network layer to the application layer.
Here's a detailed explanation of the layered attacker's model for each of
these layers in IoT:
1. Physical Layer:
  Attacker's Focus: Physical attacks at this layer typically involve attempts
to physically manipulate or compromise IoT devices, sensors, or
equipment. Attackers may try to gain physical access to devices or
interfere with the hardware directly.
 Threats and Vulnerabilities:
 Tampering: Attackers may open IoT device enclosures to gain
access to internal components and tamper with hardware or
firmware.
 Device Theft: The theft of devices could lead to data exposure
and misuse.
 Eavesdropping: Attackers may attempt to eavesdrop on
communication between devices or intercept data through
physical means.
 Security Measures:
 Physical Security: Implement physical security measures to
protect IoT devices from unauthorized access or tampering,
including locks, enclosures, and tamper-evident seals.
 Secure Boot: Enable secure boot processes to ensure that only
authenticated and unaltered firmware can run on devices.
 Device Tracking: Use mechanisms like device tracking and
geolocation to prevent or recover from device theft.

2. Network Layer:
 Attacker's Focus: At the network layer, attackers aim to exploit
vulnerabilities in network communication, potentially compromising
data integrity and confidentiality or disrupting communication.
 Threats and Vulnerabilities:
 Unauthorized Access: Attackers may attempt to infiltrate the
network by exploiting weak authentication, access control, or
unpatched vulnerabilities.
  Data Interception: Intercepting and eavesdropping on data in
transit is a common attack, compromising data confidentiality.
 Denial of Service (DoS): Attackers may flood the network with
traffic to disrupt services or render IoT devices inoperative.
 Security Measures:
 Firewalls and Intrusion Detection/Prevention Systems (IDS/IPS):
Deploy these security measures to protect against unauthorized
access and detect suspicious network activity.
 Encryption: Use end-to-end encryption to secure data in transit
and prevent data interception.
 Access Control: Implement robust access control mechanisms to
restrict network access to authorized entities.
3. Application Layer:
 Attacker's Focus: At the application layer, attackers aim to exploit
vulnerabilities in IoT applications, services, and user interfaces,
potentially compromising data integrity, availability, and user privacy.
 Threats and Vulnerabilities:
 Injection Attacks: Attackers may inject malicious code or
commands through user inputs or data feeds.
 Data Manipulation: Unauthorized users may manipulate data,
leading to incorrect actions or responses from the IoT system.
 Access Control Bypass: Attackers might attempt to bypass access
control mechanisms to gain unauthorized access to sensitive
functions or data.
 Security Measures:
 Secure Coding Practices: Follow secure coding practices to
prevent injection attacks and other application-layer
vulnerabilities.
 User Authentication: Implement strong user authentication and
authorization to restrict access to authorized users.
  Data Validation: Validate and sanitize data inputs to prevent
injection and data manipulation attacks.
 Security Testing: Regularly conduct security testing, including
penetration testing and code reviews, to identify and address
application-level vulnerabilities.

2) Explain how to carry out threat modeling in IOT.

Threat modeling is a systematic process for identifying, evaluating, and
mitigating potential security threats and vulnerabilities in an IoT (Internet of
Things) system. It helps organizations understand the security risks and make
informed decisions to protect their IoT deployments. Here's a detailed step-
by-step guide on how to carry out threat modeling in IoT:
1. Define the Scope:
 Identify the IoT System: Clearly define the boundaries of the IoT
system under consideration. Determine which devices, networks,
applications, and data are in scope for the threat modelling
exercise.
2. Gather Information:
 Inventory IoT Components: List all the IoT devices, sensors,
gateways, communication protocols, cloud services, and
applications that are part of the IoT ecosystem.
 Data Flow Diagram: Create a data flow diagram that illustrates
how data moves between components in the IoT system. This
diagram will be instrumental in identifying potential attack
vectors.
3. Identify Assets:
 Identify Valuable Assets: Determine what data and resources are
most valuable within the IoT system. This includes sensitive data,
proprietary algorithms, control over devices, and other critical
assets.
4. Identify Threats:
  Brainstorm Threats: Conduct a brainstorming session to identify
potential threats and attack vectors that could impact the IoT
system. Consider both common and IoT-specific threats.
Common threats may include data breaches, unauthorized
access, and malware, while IoT-specific threats could involve
device tampering, sensor spoofing, and network-based attacks.
 Use Threat Libraries: Leverage threat libraries, standards, and
industry-specific threat models, such as OWASP IoT Top Ten, to
help identify common threats and vulnerabilities.
5. Risk Assessment:
 Assess Threat Impact: Evaluate the impact of each threat on the
IoT system. Consider the potential consequences of a successful
attack, including data loss, system disruption, privacy breaches,
and financial impacts.
 Determine Likelihood: Assess the likelihood of each threat
occurring. Factors may include the attacker's motivation, the
system's exposure to the threat, and the existing security
controls in place.
6. Risk Prioritization:
 Risk Matrix: Create a risk matrix to prioritize threats based on
their impact and likelihood. This matrix helps identify high-
priority threats that require immediate attention.

7. Mitigation Strategies:
 Security Controls: Develop a list of security controls and
countermeasures to mitigate each high-priority threat. These
controls may include authentication, encryption, access control,
intrusion detection, and security patch management.
 Defense-in-Depth: Implement a defense-in-depth strategy, where
multiple security measures are layered to protect against a
variety of threats.
  Secure Design Practices: Incorporate secure design practices from
the beginning of the IoT system development, including secure
boot, secure firmware updates, and secure communication
protocols.
 Security Testing: Plan for security testing, including vulnerability
scanning, penetration testing, and code reviews to identify and
address vulnerabilities.
8. Documentation and Reporting:
 Document the threat modeling process, including the identified
threats, their associated risks, and the recommended mitigation
strategies. This documentation is essential for reference,
communication, and accountability.
9. Iterative Process:
 Threat modeling is not a one-time activity. As the IoT system
evolves and new threats emerge, the threat model should be
reviewed and updated periodically to ensure ongoing security.
10.Education and Training:
 Ensure that the development and operations teams are trained
in security best practices and understand the threat model. This
knowledge empowers them to implement security controls
effectively.

3) Explain various IOT security protocols.

1. MQTT
MQTT is one of the most common security protocols used in internet of
things security. It was invented by Dr Andy Stanford-Clark and Arlen Nipper
in 1999. MQTT stands for Message Queuing Telemetry Transport and is a
client-server communicating messaging transport protocol. The MQTT runs
over TCP/IP or over other conventions that provide requested, lossless, two-
way associations.
Features of MQTT
•It’s a simple and extremely lightweight protocol with easy and fast data
transmission.
•MQTT is designed for constrained devices as well as low-bandwidth,
unreliable or high-latency networks.
•Minimum use of data packets ensures less network usage.
•Optimal power consumption saves the battery of the connected devices,
making it perfect for mobile phones and wearables where battery
consumption needs to be minimal.
•It’s based on the messaging technique and so, is extremely fast and reliable.
•It’s ideal for IoT applications.
How does MQTT secure internet of things applications?
Security in MQTT is divided into multiple layers: network, transport, and
application levels. Each layer prevents a specific type of attack. As MQTT is a
lightweight protocol, it specifies only a few security mechanisms. MQTT
implementations commonly use other security standards like SSL/TLS for
transport encryption, VPN at network level for a physically secure network,
and use of username/password. A client identifier to authenticate devices on
the application level is passed with data packets.
2.CoAP
CoAP (Constraint Application Protocol) is a web transfer protocol designed for
constrained devices (like microcontrollers) and the constrained network
called low power or lossy networks. It is also one of the most popular
protocols to secure internet of things applications.
Features of CoAP
•Similar to HTTP, CoAP is based on the REST model. Clients access the
resources made available by servers under URLs using methods like GET, PUT,
POST, and DELETE.
•CoAP is designed to work on microcontrollers, which makes it perfect for the
internet of things as it requires millions of inexpensive nodes.
•CoAP uses minimal resources, both on the device and on the network.
Instead of a complex transport stack, it gets by with UDP on IP.
How does CoAP secure internet of things applications?
CoAP uses UDP (User Datagram Model) to transport information and
therefore relies on UDP security aspects to protect the information. CoAP
uses Datagram TLS over UDP.
CoAP has been designed to have a simple and user-friendly interface with
HTTP for integration with the Web and supports functions such as multicast
support and low overhead issues, thus contributing to security in the internet
of things.
3. DTLS
The DTLS (Datagram transport layer security) is an internet of things security
protocol designed to protect data communication between data-gram-based
applications. It is based on TLS (transport layer security) protocol and
provides the same level of security.
Objective of DTLS
The main objective of DTLS is to make slight adjustments to TLS to solve
issues like reordering and data loss. The semantics of the underlying
transport layer remain unchanged using the DTLS protocol. Therefore, no
delays occur due to associated stream protocols; however, the application
needs to deal with loss of datagram, packet reordering, and data larger than
the size of a datagram network packet.

Uses of DTLS
DTLS is used in applications such as live video feeds, video streaming, gaming,
VoIP, and instant messaging where loss of data is comparatively less
important than latency.
4.6LoWPAN
6LoWPAN (IPv6 over Low Power Wireless Personal Area Networks) is a
protocol for low-power networks like IoT systems and wireless sensor
networks.
Features of 6LoWPAN
•6LoWPAN is used to carry data packets in the form of IPv6 over various
networks.
•provides end-to-end IPv6 and hence provides direct connectivity to a wide
variety of networks including direct connectivity to the Internet.
•6LoWPAN is used for protecting the communications from the end-users to
the sensor network.
Uses of 6LoWPAN
6LoWPAN plays a key role in domains like smart home automation, industrial
monitoring, smart grids, general automation, etc.
5. ZigBee
ZigBee is believed to be a state-of-the-art protocol to provide security for
internet of things devices and applications. It provides efficient machine-to-
machine communication from 10–100 meters away in low-powered
embedded devices like radio systems. It is a cost effective open-source
wireless technology.
ZigBee supports two security models:
The Centralized Security Network
The Distributed Security Network
Features/Advantages of IoT with ZigBee
•ZigBee provides standardization at all layers, which enables compatibility
between products from different manufacturers.
•Due to its mesh architecture, devices tend to connect with every device in
the vicinity. This helps in expanding the network and making it more flexible.
•ZigBee uses “Green Power” that facilitates lower energy consumption and
cost.
•ZigBee helps in the scalability of networks as it supports a high number
(about 6,550) of devices.

UNIT – 3
1) Explain different IOT development boards with features
Arduino Boards:
 Arduino is a well-known open-source platform for IoT and embedded
system development.
 Key Features:
 Various models, including the Arduino Uno, Arduino Nano, and
Arduino Mega, suitable for different applications.
 User-friendly development environment with an integrated
development environment (IDE).
 A wide range of shields (add-on modules) and libraries to extend
functionality.
 Capable of reading sensors, controlling actuators, and connecting
to the internet.
 Community support and extensive online resources for
beginners.
Raspberry Pi Boards:
 Raspberry Pi is a versatile single-board computer for IoT, robotics, and
general-purpose computing.
 Key Features:
 Powerful processors (e.g., Raspberry Pi 4) with multiple cores
and generous RAM.
 Running a full-fledged operating system (e.g., Raspberry Pi OS,
based on Linux).
 HDMI output for displays and USB ports for peripherals.
  GPIO (General Purpose Input/Output) pins for hardware
interfacing.
 Extensive community and third-party software support.
NodeMCU Boards:
 NodeMCU is based on the ESP8266 module and is specifically designed
for IoT and Wi-Fi connectivity.
 Key Features:
 Built-in Wi-Fi connectivity with an ESP8266 microcontroller.
 Lua-based firmware, simplifying IoT application development.
 GPIO pins for sensor and actuator connections.
 Ideal for IoT projects involving cloud connectivity.
ESP32/ESP8266 Boards:
 ESP32 and ESP8266 are low-cost, low-power Wi-Fi and Bluetooth
modules for IoT development.
 Key Features:
 Wi-Fi and Bluetooth connectivity.
 Dual-core processors (ESP32) or single-core (ESP8266).
 GPIO pins for hardware interfacing.
 Arduino IDE support and extensive libraries.
 Suitable for low-power, battery-operated IoT devices.
BeagleBone Boards:
 BeagleBone is a family of single-board computers for IoT, robotics, and
industrial applications.
 Key Features:
 Different models, such as the BeagleBone Black and BeagleBone
AI.
 High-performance processors, with various interfaces like USB,
Ethernet, HDMI, and GPIO pins.
  Capable of running various Linux distributions.
 Suitable for more complex IoT applications and robotics projects.
Intel Galileo:
 Intel Galileo was an IoT development board based on the Intel Quark
X1000 SoC (System-on-Chip).
 Key Features (Note: Intel has discontinued the Galileo platform):
 x86 architecture, making it capable of running Windows or Linux.
 GPIO pins for hardware interfacing.
 Onboard Ethernet and USB ports.
 Integration with Intel's IoT development tools.

2) What is an IOT prototyping and why it is required?

IoT prototyping is the process of creating a working model or prototype of an
Internet of Things (IoT) system or device before fully developing and
deploying it. The primary purpose of IoT prototyping is to evaluate and
validate the feasibility of an IoT project, test its functionality, and identify
potential issues, thereby helping stakeholders make informed decisions
before committing to a full-scale implementation. Here's a detailed
explanation of IoT prototyping and why it is required:
1. Feasibility Assessment:
 IoT prototyping allows organizations to assess the feasibility of their
IoT project. It helps answer questions like:
 Can the desired functionality be achieved with the available
hardware and software components?
 Is the project technically and financially viable?
2. Risk Mitigation:
 Prototyping helps identify potential risks and challenges early in the
development process. By testing the concept on a smaller scale,
organizations can uncover and address issues before they become
costly problems in a full-scale deployment.
3. Proof of Concept (PoC):
 IoT prototypes serve as PoCs that demonstrate the practicality and
value of an IoT project to stakeholders, including investors, clients, and
end users.
4. Functionality Validation:
 Prototyping allows for the validation of the IoT system's core
functionality. It helps ensure that the device or system can perform its
intended tasks and meet user requirements.
5. User Feedback and Iteration:
 Prototyping provides the opportunity to gather user feedback and
iterate on the design and functionality based on this feedback. This
ensures that the final product aligns better with user expectations and
needs.
6. Hardware and Software Integration:
 IoT systems involve a combination of hardware and software
components. Prototyping allows organizations to test the integration
between these components and identify compatibility issues.
7. Performance Testing:
 Performance testing on a prototype can reveal potential bottlenecks,
delays, or resource limitations. This information is vital for optimizing
the system's performance in the production version.
8. Security and Privacy Assessment:
 IoT prototypes help organizations identify and address security and
privacy concerns early in the development process. This includes
assessing vulnerabilities and potential data breaches.
9. Cost Analysis:
 Building a prototype provides insights into the actual costs associated
with hardware, software, and other resources. This helps in creating
accurate budgets and financial plans.
10. Scalability Considerations: - IoT prototypes can reveal potential scalability
challenges when moving from a small-scale prototype to a larger, real-world
deployment. Identifying these challenges early can inform the development
strategy.
11. Regulatory and Compliance Checks: - Prototyping can help identify
regulatory and compliance requirements that need to be addressed, such as
data protection regulations and industry-specific standards.
12. Time-to-Market Optimization: - Through prototyping, organizations can
optimize their IoT project's development timeline by identifying and
eliminating inefficiencies and obstacles that may slow down deployment.

3) Explain software libraries for internet connectivity devices.

Software libraries for internet connectivity devices in IoT play a vital role in
simplifying the development and management of IoT (Internet of Things)
devices and their interactions with cloud-based services. These libraries
provide pre-built functions, APIs (Application Programming Interfaces), and
tools that enable IoT devices to connect, communicate, and exchange data
with other devices and the internet. Here's an explanation of these libraries
and their key functions:
1. IoT Device SDKs (Software Development Kits):
 These are comprehensive sets of libraries and tools provided by
IoT platform providers or device manufacturers. They enable IoT
devices to connect to cloud platforms and include features for
secure communication, device management, and data
synchronization.
2. Communication Protocols Libraries:
 IoT devices use various communication protocols to exchange
data with other devices and the cloud. These libraries help in
implementing protocols like MQTT, CoAP, HTTP, and WebSocket,
making it easier for devices to send and receive data.
3. Security Libraries:
 Security libraries provide cryptographic functions, secure
communication protocols (e.g., TLS/SSL), and authentication
 mechanisms. They are essential for protecting IoT data in transit
and at rest, ensuring data integrity, confidentiality, and
authentication.
4. Device Management Libraries:
 These libraries assist with device provisioning, registration, and
management. They enable remote configuration, firmware
updates, and monitoring of IoT devices. Device management
libraries simplify the tasks of onboarding, tracking, and
maintaining devices.
5. Data Processing and Analytics Libraries:
 IoT devices often need to process and analyze data. Libraries for
data processing, analytics, and machine learning enable devices
to perform tasks like real-time data filtering, pattern recognition,
and predictive analytics.
6. Edge Computing Libraries:
 Edge computing libraries allow IoT devices to perform local data
processing and decision-making. This reduces the need for
transmitting all data to the cloud, leading to lower latency and
more efficient use of bandwidth.
7. IoT Prototyping and Development Frameworks:
 These broader frameworks offer tools for hardware abstraction,
communication, and application development. They assist in the
development of IoT devices from concept to deployment,
simplifying the development process.