The Internet of Things,

Characteristics and
Applications
 Contents
WHAT IS INTERNET OF BENEFITS AND
THINGS CHALLENGES OF IOT

CHARACTERISTICS OF IOT APPLICATIONS OF IOT

 THE INTERNET
THE INTERNET OF THINGS
Evolutionary Phases of Internet
 What is Internet of Things?
Connecting everyday things embedded with electronics, software and
sensors to the Internet enabling them to collect and exchange data
A "Thing“ is an entity or physical object that has a Unique
identifier, an embedded system and the ability to transfer data
over a network.
• Heart monitoring implants
• Biochip transponders on farm animals
• Automobiles with built-in sensors
• DNA analysis devices & Other Wearbles etc.
These devices collect useful data with the help of various
existing technologies and then autonomously flow the data
between other devices.
 How IoT Works

COLLECTION COMMUNICATION ANALYSIS ACT

 Characteristics
Grouping
Auto-configuration

Function and management capabilities separation

IoT System Characteristics Highly distributed systems

Network communication

Network management and operation

Real-time capability
 Characteristics
Content-Awareness
IoT Service Characteristics Location-Awareness
Time-Awareness
Compatibility
Discoverability
Modularity
IoT Component Characteristics
Network connectivity
Shareability
Unique identification
Heterogenous
Interoperability
 Other Characteristics
Legacy support
Compatibility
Well defined components
Flexibility
Usability
Manageability
Accuracy
Robustness Reliability
Resilience
Availability
Confidentiality
Security
Integrity
Safety
Protection of Personally
Privacy
Identifiable Information
 Benefits of IoT

Efficient Resource Saves Time

Utilization

Minimizing Human Development of AI

Effort through IoT
 Challenges of IoT
•Scalability
•Technological Standards
•Interoperability
•Data volumes
•Software Complexity
•Security
•Power supply and battery life
•Privacy
 Applications of IoT
Smart Homes Smart Smart Buildings
Transportation

Manufacturing Agriculture Healthcare

 Weather Temperature &
Humidity Sensor DHT11
Monitoring
1
Station using IoT

Cayenne 4 2 Raspberry
Cloud Pi 3
• 40 General
Purpose Input
Output (GPIO) Pins
3
VNC Viewer
 IoT Products in Market
Google Nest GreenIQ Controller Fitbit Bands

Philips Hue Bulbs Withings Smart Baby Monitors

 IoT Working Groups
OCF IoTSF
Open Connectivity Foundation IoT Security Foundation

03 04
IETF
IoTivity Internet Engineering Task
02 05 Force

IEEE IIC
Institute of Electrical and 01 06 Industrial Internet
Electronics Engineers Consortium
THANK YOU
History and Architecture of IoT
 Wearable computer with
History of eyeglass mounted display to
IoT aid in lip reading
First wearable computer inside a
shoe

Head Mounted Display

1945: Norman Joseph Woodland invented Bar code.

He obtained his idea when he drew four lines in the
sand at a beach in Miami
 History of IoT
RFID TAGS Kevin Ashton

Late 1990s
Mario Cardullo receives
Connected objects
1973

the first patent for

developing RFID tag together using RFID
which revolutionizes technology at the Auto ID
retailing Centre at MIT

Major publications to the

Early 1980s

Coke vending Machine potential of IoT such as

2004
to monitor number of configuring home lights &
bottles switches, home healthcare &
shipping monitoring
Coke Vending Machines Research in IoT
The Main Elements of the one M2M IoT Architecture
Four Layers of IoT Architecture
Application Layer

Application Support Layer

Network Layer

Sensing Layer
 IoT Users
(Include Human, Devices/HMI)
Security and Privacy

Operation & Application Resource &

Network
Management Service Interchange
System System System Peer
Systems
IoT Gateway
(local services and
data)

IoT Devices
(Include sensors, actuators, and tags)

Physical Entity, including human Tags

 Sensing Layer
•Provides an user interface for using IoT
•Different applications for various sectors like
transportation, agriculture, healthcare etc
•Devices and sensors used are
• GPS
• Gyroscope
• Accelerometer
• WiFi
• Ethernet
• Bluetooth
 Network Layer
•Robust and High Performance Network Infrastructure
•Supports the communication requirements for latency,
bandwidth or security
•Allows multiple organizations to share and use the
same network independently

•Encryption, signal processing, LTE, WiFi, GSM,

Microcontroller, Embedded OS are used in Network Layer
 Application Service Layer
•Capturing of periodic sensory data

•Data Analytics

•Streaming Analytics

•Ensures security and privacy of data

 Application Layer
•Lowest abstraction layer

•Various smart applications

•Collects and processes real time applications

•Interconnects the real and physical world

 Building Blocks of IoT

End Device/Node/
Cloud
Sensors/ Hardware

Gateways/ Local Processing Software

Nodes (OS & Protocols)

Connectivity & Communication

Thank You
 • IEEE 802.15.4 is a Standard for wireless
communication that defines the physical and
CoAP MAC layers

UDP • It is Standardized by IEEE, just like IEEE 802.3 is

for Ethernet and IEEE 802.11 is for WiFi
IPv6/RPL
• 802.15 group of standards specifies a variety of
6LoWPAN
wireless personal area networks like 802.15.1 is
IEEE 802.15.4 MAC Bluetooth.

IEEE 802.15.4 PHY • IEEE 802.15.4 focuses on communication

between devices in constrained environment with
low memory, low power and low bandwidth
IoT: IEEE Standardized Protocol Stack
Internet Stack IoT Stack

Internet & Routing Layer

IPv6/RPL (How information is relayed in the IoT network)
IPv4/IPv6/IPSec
Adaptation Layer
6LoWPAN (Compress, fragment and reassemble IPv6
data packets adapted to IoT constraints)

IEEE 802.15.4 MAC Link Layer

Ethernet, Wi-Fi (How to share medium and send
IEEE 802.15.4 PHY communications in the network)
 CoAP

UDP • Since an IPv6 packet is too large to fit in an IEEE

802.15.4 frame, the adaptation layer compresses
IPv6/RPL and fragments the IPv6 packet to make it suitable
6LoWPAN for link layer which supports smaller sized
frames
IEEE 802.15.4 MAC

IEEE 802.15.4 PHY

IoT: IEEE Standardized Protocol Stack
Internet Stack IoT Stack

Transport Layer
TCP/UDP UDP (Provide the communication services
directly to the application)

Internet & Routing Layer

IPv6/RPL (How information is relayed in the IoT network)
IPv4/IPv6/IPSec
Adaptation Layer
6LoWPAN (Compress, fragment and reassemble IPv6
data packets adapted to IoT constraints)

IEEE 802.15.4 MAC Link Layer

Ethernet, Wi-Fi (How to share medium and send
IEEE 802.15.4 PHY communications in the network)
 CoAP TCP
UDP • Incurs a lot of energy overhead due to its reliable
and connection-oriented nature
IPv6/RPL

6LoWPAN UDP
IEEE 802.15.4 MAC • Unreliable, connectionless and lighter protocol
IEEE 802.15.4 PHY
IoT: IEEE Standardized Protocol Stack
Internet Stack IoT Stack
Application Layer
HTTP CoAP (Data formatting and
presentation for web transfer)

Transport Layer
TCP/UDP UDP (Provide the communication services
directly to the application)

Internet & Routing Layer

IPv6/RPL (How information is relayed in the IoT network)
IPv4/IPv6/IPSec
Adaptation Layer
6LoWPAN (Compress, fragment and reassemble IPv6
data packets adapted to IoT constraints)

IEEE 802.15.4 MAC Link Layer

Ethernet, Wi-Fi (How to share medium and send
IEEE 802.15.4 PHY communications in the network)
 CoAP

UDP
• CoAP is a specialized web transfer protocol in
IPv6/RPL IoT with smaller header sizes compared to HTTP.
6LoWPAN
IEEE 802.15.4 MAC

IEEE 802.15.4 PHY

6 IPv6 over

L Low A networking technology of the adaptation layer that allows IPv6

packets to be carried efficiently within small link layer frames,

O Power such as IEEE 802.15.4

W Wireless
P Personal
6LoWPAN was developed by the IETF in 2007 to work on
specifications for transmitting IPv6 over IEEE 802.15.4 networks
and is now an open standard defined in RFC 6282

A Area
N Network
 MTU - Maximum Transmission Unit

1280

MTU Size (Bytes)

576

IPv4 IPv6
 Ethernet, Wi-Fi

IEEE 802.15.4
Frame Length
127 bytes
Extremely large for IEEE 802.15.4 link layer
 IEEE 802.15.4 networks

Low Throughput (250 kbps)

Limited Buffering

IEEE 802.15.4 Frame (127 Bytes) ≈ 1/10th IPv6 minimum MTU (1280 Bytes)

Requires the network layer to be adaptive and responsive at the same time
low power and efficient
 6LoWPAN Overview
IPv6 Datagram
IPv6 Dispatch IPv6 Header Payload COMPRESSION
• 6LoWPAN compresses the IPv6 header to reduce the
6LoWPAN Header
packet size by assuming the usage of common fields
Compression
Compressed IPv6 Datagram
FRAGMENTATION
IPHC Dispatch IPHC Header Payload
• 6LoWPAN fragments the IPv6 packet and sends it
through multiple smaller size packets that can fit in an
6LoWPAN
802.15.4 frame.
Fragmentation
• On the other end, it reassembles the fragmented packets
Compressed and Fragmented IPv6 Datagram to re-create the IPv6 packet.
Fragment Header IPHC Dispatch IPHC Header Payload • For this purpose, an additional fragment header is used
to reassemble the packets in the correct sequence.
Reassembly • When data packets are re-assembled, the additional
header is removed and the packets are restored to their
IPHC Dispatch IPHC Header Payload initial IPv6 format.
 6LoWPAN Network Architecture

• Data exchange between

Internet 6LoWPAN devices and the
Internet 2
1

• Local data exchange between aaaa::2 aaaa::1

devices inside the 6LoWPAN CoAP
• The generation and maintenance
UDP
of the 6LoWPAN network 7 6
3 IPv6, RPL, ICMPv6
aaaa::7 aaaa::6
6LoWPAN Edge Router aaaa::3 6LoWPAN
Router IEEE 802.15.4
4 5
aaaa::4 aaaa::5
Sensor Nodes
Mobile
6LoWPAN Network
IP Network Application Layer
Application Layer
Edge Router Transport Layer
Transport Layer IPv6 Network Layer
PC Server
Network Layer Ethernet MAC Adaptation Layer LoWPAN Adaptation
MAC Layer Ethernet PHY 802.15.4 MAC MAC Layer
PHY Layer MAC Layer 802.15.4 PHY PHY Layer

Dual Stack in Edge Router

 Advantages of 6LoWPAN

Compatible Supports Leaf nodes Adapted and

with open IP Offers end- self-healing, Offers one- can sleep used over a
standards to-end IP robust and to-many & for a long variety of
like TCP, addressable scalable many-to- duration of other link
UDP, nodes mesh one routing time. layer
HTTP, and routing technologies
COAP
 Current 6LoWPAN specification only discusses general security
threats and requirements

No specific security mechanisms have been adopted so far for

the 6LoWPAN
Challenges in
6LoWPAN
Implementation Susceptible to packet fragmentation attacks

Does not propose any specific key management solution

6LoWPAN is a key enabler of the IoT revolution.
It bridges the gap between diverse devices,
paving the way for a seamlessly connected
world.
 MOOC on
Internet of Things: Design Concepts and Use Cases
Unit 2
Communication
Protocols in the
Internet of Things
Part - II

Dr. Kamaldeep
What is Routing?

Routing is the ability to send a data

packet from one device to another
device, sometimes over multiple hops.
 Depending on what layer the
routing mechanism is
located, two categories of
routing are defined
• Uses the link layer or the MAC

ROUTE-OVER
MESH-UNDER

• Uses the network layer or the IP

address to forward data packets
addresses
• Routing of data happens transparently,
hence mesh-under networks are
vs • Routing takes place at the IP level
considered to be one IP subnet • Compatible with standard TCP/IP
protocol stack today
• Best suited for smaller and local
networks
R IPv6 Routing
It is an Adaptive Routing Protocol for IoT and the most widely

P
used for route-over 6LoWPAN networks
Protocol for
RPL is defined by the IETF in RFC 6550

L Low-Power and
Lossy Networks
Main Features of RPL

Energy-Efficient Routing
01 Optimizes routing for low-power devices, reducing
energy consumption by carefully managing data
transmission and device wake-ups

Adaptive Topology
Topology accommodates the dynamic nature of IoT
networks, allowing devices to join or leave without
disrupting the overall connectivity
02
Mechanism to support
03 Multipoint-to-point traffic and point to-multipoint traffic
Need for a New Routing Protocol in IoT

LLN routers
1  Constraints on processing, memory, and energy
2
 Couldn’t use conventional routing protocols like
OSPF, RIP, AODV, DSR, etc.
7 6
3  Interconnected by lossy links
 Traffic patterns were not simply point-to-point, but
4 5
in many cases point-to-multipoint or even
multipoint-to-point

Low Power and Lossy Network

Routing Strategy in RPL Destination Oriented Directed
Acyclic Graph i.e. DODAG
DAG root

Directed Acyclic Graph (DAG):

DAG root DAG is a directed graph having the property that all edges are
oriented in such a way that no cycles exist

DAG root:
A DAG root is a node within the DAG that has no outgoing edge

Destination-Oriented DAG (DODAG):

DAG rooted at a single destination, i.e., at a single DAG root
which is the DODAG root with no outgoing edges

Destination-Oriented DAG (DODAG)

 RPL Terminology
Up Down
Up refers to the direction from leaf nodes Down refers to the direction from DODAG
towards DODAG root roots towards leaf nodes

DODAG Root DODAG Root

Root Node

Sensor Node

Transmission/
Reception range
Routing Path
RPL Terminology (contd..)

Objective Function
Defines what metrics or constraints to use for finding
minimum cost paths in a given RPL instance like
minimize energy, latency etc.
 RPL Terminology (contd..)

Rank DODAG Root

Rank = k
 Rank is a scalar representation of the
node location within a DODAG Rank = k + 1
1st Hop
instance
Rank = k + 2
 The rank MUST decrease on each 2nd Hop

path towards the root Rank = k + n

nth Hop
 It should be Computed based on
routing metrics established by an
Objective Function Root Node

Sensor Node

Transmission/
Reception range
Routing Path
 RPL Terminology (contd..)
DODAG Root
DODAG Root
RPL Instance
An RPL Instance may include one or more
DODAGs and a node may belong to
multiple RPL instances
RPL Instance

DODAG Root
DODAG Root
DODAG Version
1
It is the current version of the DODAG and
2
1 2

every time a new DODAG is computed with the 3 4 5

3 4

same root, its version is incremented. 6

5
Version N Version N + 1

DODAG Version
 DODAG Root
Nodes in sub-DODAG:
RPL Modes of Operation
1, 2, 3, 4, 5, 6
Nodes in sub-
DODAG: 3, 6 1 2 Nodes in sub-DODAG: 4, 5

Storing Mode
Data Data

Nodes in sub-
DODAG: 6 3 4 5 Nodes in sub-
Nodes in sub- DODAG: Nil
Nodes in sub- 6 DODAG: Nil Nodes keep routing tables for sub-DODAG
DODAG: Nil
Storing Mode
Node 4 → Node 2 → Node 5
Each node knows about nodes in sub-DODAG. Thus, Node 2 itself routes data from node 4 to node 5

DODAG Root Nodes in sub-DODAG: 1, 2, 3, 4, 5, 6

Data

1
Data
2 Non-Storing Mode
Data Data

3 4 5 Nodes know only parent and do not keep a

6
routing table
Non-Storing Mode
Node 4 → Node 2 → Root → Node 2 →Node 5
Nodes only know about parent node and thus, data is sent to the immediate parent only, finally
reaching the root node which forwards data to destination node (here, Node 5)
 RPL Communication with
control messages
155

• RPL communication takes place using

Type Code Checksum
ICMPv6
Base

• The RPL control message is an

Options(s)
ICMPv6 information message with a
type of 155 RPL Control Message
(an ICMPv6 Message)

• RPL control message is identified by a

code
 RPL Control Messages

DODAG Root

DIO
1. DODAG Information Object (DIO)
DIO

1 2
DIO Carries information that allows a node to:
DIO DIO
DIO
• Discover a RPL instance
DIO 3 4 5
• Learn its configuration parameters
6
• Select a DODAG parent set
• Maintain the DODAG
DIO: Downward RPL instance multicasts
 RPL Control Messages
(contd..)
DODAG Root
2. DODAG Information Solicitation DIO

(DIS)
DIO

1 2

• DIS messages are used to solicit a DIO

DIO DIO

DIO from a RPL node DIO 3 4 5

• Its use is analogous to that of a 6

DIS
DIS
Router Solicitation of IPv6 Neighbor DIS 7

Discovery New Node

 RPL Control
Messages(contd..)
DODAG Root
3. Destination Advertisement
Object (DAO)
DAO DAO

DIO DIO
1 2
DAO
DIO
DAO
DAO DAO messages are used to propagate
destination information upward along the
DIO DIO

4 5
DODAG
3
DAO

DIO
DIS
DIS
6
• In storing mode, the DAO message is unicast by
DIS
7 the child to the selected parent (s).
New Node
• In non-storing mode, the DAO message is unicast
to the DODAG root.
 RPL Control Messages
(contd..)
4. Destination Advertisement
DODAG Root

DAO DAO

Object (DAO ACK) DIO DIO

1 2 DAO-ACK
DAO-ACK message is sent as a unicast DAO
DIO
DAO

DIO DIO
DAO

packet by a DAO recipient which could be 3 4 5

a DAO parent or DODAG root in response

DAO

DIO
DIS

to a unicast DAO message 6

DIS
DIS

7
New Node
 It is an IPv6 compliant distance vector routing protocol

R IPv6 Routing
An RPL instance consists of one or more DODAGs

DIO are broadcast downward

P Protocol for DAOs are requests to join upward

L Low-Power and DIS are DIO solicitations

Lossy Networks DAO-ack are responses to DAO

Non-storing nodes do not keep any routing table and send

everything upwards toward the root
 Other than the secure versions of the routing control messages and
the security modes, no further security mechanisms are designed

Research efforts required on the definition of threat models for

RPL
Limitations in
conventional
RPL security Mechanisms to protect RPL communications and operations
from internal attackers are needed

Susceptible to number of conventional routing attacks and other attacks

typical to its operation like rank attack, version number attack etc.
 C o A P
Constrained Application Protocol

CoAP is a specialized web transfer protocol for use with constrained nodes and networks in the IoT

It is designed and developed by the Constrained RESTful Environments i.e. CoRE working group of
the IETF specifically for machine-to-machine (M2M) and IoT applications like smart homes, building
automaton etc.
Evolution of CoAP: A Product of the CoRE Working Group
CoRE WG aimed at realizing the REST architecture in a suitable form for the constrained nodes and networks

Designed CoAP as an application layer protocol which is very similar to HTTP protocol of the conventional
Internet and follows the same request-response pattern used by HTTP

REST

Client

HTTP HTTP CoAP

CoAP

Server Server Proxy CoAP CoAP

Server Clients
The Internet
CoAP Environment
Evolution of CoAP: A Product of the CoRE Working Group
REST

Client

HTTP HTTP CoAP

CoAP

Server Server Proxy CoAP CoAP

Server Clients
The Internet
CoAP Environment

Uses familiar HTTP terms like GET, PUT, POST, and DELETE Methods, status codes, URIs etc.

COAP is equivalent of HTTP REST for Constrained environments with low memory, low power, low
bandwidth, and higher rate of packet failure

The specifications of CoAP core protocol are specified in RFC 7252

 Core Design Principles of CoAP

 CoAP aims to keep message overhead small, thus limiting the need for
01 Smaller Message fragmentation and minimizing the communication overhead
Overhead  CoAP achieves this goal by using a minimal header size, compressing
HTTP and efficient message serialization, making it an ideal choice for
resource-constrained environments

02  CoAP does not blindly compress HTTP but rather realizes a subset of REST
Subset of REST common with HTTP to optimize it for IoT applications
 CoAP easily translates to HTTP for integration with the existing Web
 Core Design Principles of CoAP

03 Uses UDP  Instead of a complex transport stack, CoAP uses UDP on IP

04  A 4 byte fixed header and a compact encoding of options enables small

Fixed Header messages that cause no or little fragmentation on the link layer

4 Byte Fixed Header

0 2 4 8 16 31

Version Type Token Length Code Message ID

Token (if any, TKL bytes) …….

Options (if any) ……

Payload (if any) ………

CoAP Message Format

 Architecture of CoAP

Used to deal with UDP and the Application

Message asynchronous nature of the
Layer interactions
Request/Response Layer
CoAP

CoAP
Message Layer
In charge of mapping requests to
Request/
responses and their interactions
Response using Method and Response Codes
Layer Transport - UDP
 CoAP Methods

Methods indicate the type of interaction a client wants to have with a resource on the server

GET POST PUT DELETE OBSERVE

Used to retrieve the Used to submit data to Used to update or Used to request the Used to monitor the state
current state or value the server for create a resource on removal of a resource of a resource over time
of a resource from the processing. the server with the from the server. and enables clients to
server. provided data. observe resources with a
defined query, i.e., to
retrieve a representation
It is a safe method that It can be used to create a It replaces the current It signifies the intent of a resource
doesn't cause any new resource or trigger a state of the resource to remove the
modification on the specific action on the with the new data. specified resource This method is not
server. server. present in HTTP but
only in CoAP
 Types of CoAP
messages

CON NON ACK RST

Confirmable Message Non- Confirmable Message Acknowledgement Reset
Used for reliable communication, Used for faster communication Sent in response to CON messages Sent to cancel a pending CON
ensuring that the recipient sends without requiring acknowledgment to acknowledge their receipt. message that hasn't yet been
an acknowledgment. acknowledged.
 CoAP Request Response Example

CoAP Server 1
(Thermostat in Living Room)

CoAP client
Requests the resource CoAP Server 2
(Thermostat in Bedroom)

Name of the
protocol

coap://myhome.in:5683/nest_livingroom/temp
 CoAP Request Response Example

CoAP Server 1
(Thermostat in Living Room)

CoAP client
Requests the resource CoAP Server 2
(Thermostat in Bedroom)

Domain

coap://myhome.in:5683/nest_livingroom/temp
 Security
and
Privacy Concerns In IoT

 Unlock

Lock 
 Devices are collecting large amounts of data
that can capture your actions and location
throughout the day often we don't exactly know
all that is being collected or how this
information is being used
SECURITY ISSUES IN IoT
 SECURITY ISSUES IN IoT
• As per reports of OWASP(Open Web application Security
Project), IoT Security is challenged by
– Constrained Resources
– Limited Computational Power
– Usage of insecure Operating System
– Insufficient Authentication and authorization
– Lack of Transport encryption etc.
12/29/2023 NITTTR CHANDIGARH 5
 • Currently, there are over 23 billion IoT
1. Insufficient testing and connected devices worldwide. This number
updating will further rise up to reach 30 billion by 2020
2. Brute-forcing and the issue of and over 60 billion by the end of 2025.
default passwords • In fact, one of the main problems with tech
3. IoT malware and ransomware companies building these devices is that they
4. IoT botnets aiming at are too careless when it comes to handling of
cryptocurrency device-related security risks.
5. Data security and privacy concerns
(mobile, web, cloud) • Most of these devices and IoT products don’t
6. Small IoT attacks that evade get enough updates while, some don’t get
detection updates at all.
7. AI and automation • This means that a device that was once
8. Home Invasions thought of as secure when the customers first
9. Remote vehicle access bought it becomes insecure and eventually
10. Untrustworthy communication
prone to hackers and other security issues.
1. Insufficient testing and
updating • IoT manufacturers, however, are more eager to
2. Brute-forcing and the issue of produce and deliver their devices as fast as they
default passwords can, without giving security too much of a thought.
3. IoT malware and ransomware
4. IoT botnets aiming at • Unfortunately, most manufacturers offer firmware
cryptocurrency updates only for a short period of time, only to stop
5. Data security and privacy concerns the moment they start working on the next headline-
(mobile, web, cloud) grabbing gadget. Even worse, they use unsupported
6. Small IoT attacks that evade legacy Linux kernels
detection
7. AI and automation
8. Home Invasions
9. Remote vehicle access
10. Untrustworthy communication
1. Insufficient testing and updating
2. Brute-forcing and the
issue of default passwords
3. IoT malware and ransomware • The Mirai botnet, used in some of the largest
4. IoT botnets aiming at and most disruptive DDoS attacks is perhaps
cryptocurrency one of the best examples of the issues that
5. Data security and privacy concerns come with shipping devices with default
(mobile, web, cloud) passwords and not telling consumers to
6. Small IoT attacks that evade change them as soon as they receive them.
detection
7. AI and automation
8. Home Invasions
9. Remote vehicle access
10. Untrustworthy communication
1. Insufficient testing and
updating • There are some government reports that advise
2. Brute-forcing and the manufacturers against selling IoT devices that
issue of default come with default (read, hackable) credentials
passwords such as using “admin” as username and/or
3. IoT malware and ransomware passwords.
4. IoT botnets aiming at
cryptocurrency • These are nothing more than guidelines now,
5. Data security and privacy and there aren’t any legal repercussions to
concerns (mobile, web, cloud) incentivize manufacturers to abandon this
6. Small IoT attacks that evade dangerous practice.
detection
7. AI and automation • Weak credentials and login details leave nearly
8. Home Invasions
all IoT devices vulnerable to password hacking
9. Remote vehicle access
10. Untrustworthy communication and brute-forcing in particular.
1. Insufficient testing and updating
2. Brute-forcing and the
issue of default passwords • The only reason why Mirai malware was so
3. IoT malware and ransomware successful is that it identified vulnerable IoT devices
4. IoT botnets aiming at and used default usernames and passwords to log in
cryptocurrency and infect them.
5. Data security and privacy concerns
(mobile, web, cloud) • Therefore, any company that used factory default
6. Small IoT attacks that evade credentials on their devices is placing both their
detection business and its assets and the customers and their
7. AI and automation valuable information at risk of being susceptible to a
8. Home Invasions brute-force attack.
9. Remote vehicle access
10. Untrustworthy communication
1. Insufficient testing and updating
2. Brute-forcing and the issue of
default passwords
3. IoT malware and • As the number of IoT connected devices
ransomware continues to rise in the following years, so
4. IoT botnets aiming at will the number of malware and ransomware
cryptocurrency used to exploit them.
5. Data security and privacy concerns
(mobile, web, cloud)
6. Small IoT attacks that evade
detection
7. AI and automation
8. Home Invasions
9. Remote vehicle access
10. Untrustworthy communication
1. Insufficient testing and updating
• While the traditional ransomware relies on
2. Brute-forcing and the issue of
encryption to completely lock out users out of
default passwords
different devices and platforms, there’s an ongoing
3. IoT malware and hybridization of both malware and ransomware
ransomware strains that aims to merge the different types of
4. IoT botnets aiming at attack.
cryptocurrency
5. Data security and privacy concerns • The ransomware attacks could potentially focus on
(mobile, web, cloud) limiting and/or disabling device functionality and
6. Small IoT attacks that evade stealing user data at the same time.
detection
7. AI and automation • For example, a simple IP camera is ideal for
8. Home Invasions capturing sensitive information using a wide range
9. Remote vehicle access of locations, including your home, work office or
10. Untrustworthy communication even the local gas station.
1. Insufficient testing and updating
2. Brute-forcing and the issue of
default passwords • The webcam can then be locked and footage
3. IoT malware and funneled to an infected web address which
ransomware could extract sensitive data using the malware
4. IoT botnets aiming at access point and demand ransom to unlock
cryptocurrency the device and return the data.
5. Data security and privacy concerns
(mobile, web, cloud) • The ever-increasing number of IoT devices will
6. Small IoT attacks that evade
give birth to unpredictability in regards to
detection
future attack permutations.
7. AI and automation
8. Home Invasions
9. Remote vehicle access
10. Untrustworthy communication
1. Insufficient testing and updating
2. Brute-forcing and the issue of
default passwords
3. IoT malware and ransomware
4. IoT botnets aiming at
cryptocurrency
5. Data security and privacy concerns • The heated mining competition, coupled with
(mobile, web, cloud)
the recent rise of cryptocurrency valuations is
6. Small IoT attacks that evade
detection proving too enticing for hackers trying to cash
7. AI and automation in on the crypto-craze.
8. Home Invasions
9. Remote vehicle access
10. Untrustworthy communication
1. Insufficient testing and updating
2. Brute-forcing and the issue of • While most find blockchain resistant to hacking, the
default passwords number of attacks in the blockchain sectors seems
3. IoT malware and ransomware to be increasing.
4. IoT botnets aiming at
• The main vulnerability isn’t the blockchain itself, but
cryptocurrency rather the blockchain app development running on it.
5. Data security and privacy concerns
(mobile, web, cloud)
• Social engineering is already being used to extract
6. Small IoT attacks that evade
usernames, passwords, and the private keys and
detection
we’ll see it being used more often in the future to
7. AI and automation
hack blockchain-based apps.
8. Home Invasions
9. Remote vehicle access
10. Untrustworthy communication
1. Insufficient testing and updating
• The open-source cryptocurrency Monero is one of
2. Brute-forcing and the issue of
the many digital currencies currently being mined
default passwords
with IoT devices. Some of the hackers have even
3. IoT malware and ransomware
repurposed IP and video cameras to mine crypto.
4. IoT botnets aiming at
cryptocurrency • Blockchain breaches, IoT botnet miners and
5. Data security and privacy concerns manipulation of data integrity pose a huge risk for
(mobile, web, cloud) flooding the open crypto-market and disrupting
6. Small IoT attacks that evade already volatile value and structure of
detection cryptocurrencies.
7. AI and automation
8. Home Invasions • IoT applications, structures, and platforms relying on
9. Remote vehicle access blockchain technology need to become regulated
10. Untrustworthy communication and constantly monitored and updated if it were to
prevent any future cryptocurrency exploits.
1. Insufficient testing and updating
2. Brute-forcing and the issue of
default passwords
3. IoT malware and ransomware
4. IoT botnets aiming at
cryptocurrency
5. Data security and privacy
concerns (mobile, web, • Data privacy and security continues to be the
single largest issues in today’s interconnected
cloud) world.
6. Small IoT attacks that evade
detection
7. AI and automation
8. Home Invasions
9. Remote vehicle access
10. Untrustworthy communication
1. Insufficient testing and updating
2. Brute-forcing and the issue of
default passwords
3. IoT malware and ransomware • Data is constantly being harnessed, transmitted,
4. IoT botnets aiming at stored and processed by large companies using a
cryptocurrency wide array of IoT devices, such as smart TVs,
speakers and lighting systems, connected printers,
5. Data security and privacy HVAC systems, and smart thermostats.
concerns (mobile, web,
cloud) • Commonly, all this user-data is shared between or
6. Small IoT attacks that evade even sold to various companies, violating our rights
detection for privacy and data security and further driving
7. AI and automation public distrust.
8. Home Invasions
9. Remote vehicle access
10. Untrustworthy communication
1. Insufficient testing and updating
2. Brute-forcing and the issue of
default passwords • We need to set dedicated compliance and privacy
3. IoT malware and ransomware rules that redact and anonymize sensitive data
4. IoT botnets aiming at before storing and disassociating IoT data payloads
cryptocurrency from information that can be used to personally
5. Data security and privacy identify us.
concerns (mobile, web, • Cached and no longer needed data should then be
cloud) disposed of securely.
6. Small IoT attacks that evade
detection • If the data is stored, then the largest challenge is in
7. AI and automation compliance with various legal and regulatory
8. Home Invasions structures
9. Remote vehicle access
10. Untrustworthy communication
1. Insufficient testing and updating
2. Brute-forcing and the issue of
default passwords
3. IoT malware and ransomware
4. IoT botnets aiming at
cryptocurrency
5. Data security and privacy concerns
(mobile, web, cloud)
6. Small IoT attacks that • The largest IoT-based botnet two years ago
was the Mirai botnet. In 2017, it was the
evade detection Reaper, a significantly more dangerous botnet
7. AI and automation
than the famed Mirai.
8. Home Invasions
9. Remote vehicle access
10. Untrustworthy communication
1. Insufficient testing and updating
2. Brute-forcing and the issue of
default passwords • As important as large-scale attacks can be, what we
3. IoT malware and ransomware should be fearing in 2018 are the small-scale
4. IoT botnets aiming at attacks that evade out detection.
cryptocurrency
5. Data security and privacy concerns • We are guaranteed to see more and more micro-
(mobile, web, cloud) breaches slipping through the security net in the
6. Small IoT attacks that next couple of years.
evade detection • Instead of using the big guns, hackers will most
7. AI and automation likely be using subtle attack small enough to let the
8. Home Invasions information leak out instead of just grabbing
9. Remote vehicle access millions and millions of records at once.
10. Untrustworthy communication
1. Insufficient testing and updating
2. Brute-forcing and the issue of
default passwords
3. IoT malware and ransomware
4. IoT botnets aiming at
cryptocurrency
5. Data security and privacy concerns
(mobile, web, cloud)
6. Small IoT attacks that evade • As IoT devices continue to invade our
detection
everyday lives, enterprises will eventually have
7. AI and automation to deal with hundreds of thousands, if not
8. Home Invasions millions of IoT devices.
9. Remote vehicle access
10. Untrustworthy communication
 • This amount of user-data can be quite difficult to
1. Insufficient testing and updating
manage from a data collection and networking
2. Brute-forcing and the issue of
perspective.
default passwords
3. IoT malware and ransomware
• AI tools and automation are already being used to
4. IoT botnets aiming at
sift through massive amounts of data and could one
cryptocurrency
day help IoT administrators and network security
5. Data security and privacy concerns
officers enforce data-specific rules and detect
(mobile, web, cloud)
anomalous data and traffic patterns.
6. Small IoT attacks that evade
detection
• However, using autonomous systems to make
7. AI and automation autonomous decisions that affect millions of
8. Home Invasions functions across large infrastructures such as
9. Remote vehicle access healthcare, power and transportation might be too
10. Untrustworthy communication risky, especially once you consider that it only takes
a single error in the code or a misbehaving
algorithm to bring down the entire infrastructure.
1. Insufficient testing and updating
2. Brute-forcing and the issue of • These are just some of the most pressing IoT
default passwords security challenges we need to consider while we
3. IoT malware and ransomware build an app based on IoT in the following years.
4. IoT botnets aiming at
cryptocurrency • As you can see, most of them revolve around two
5. Data security and privacy concerns things, keeping IoT secure against attacks and
(mobile, web, cloud) keeping the user-data secure against theft.
6. Small IoT attacks that evade
detection • Both of these challenges can be resolved with strict
7. AI and automation legal and regulatory frameworks aimed at
8. Home Invasions manufacturers, with large fines and working
9. Remote vehicle access constriction used for those who do not follow said
10. Untrustworthy communication frameworks.
 • Perhaps one of the scariest threats that IoT can
1. Insufficient testing and updating possess is of the home invasion. Nowadays, IoT
2. Brute-forcing and the issue of devices are used in a large number at homes and
default passwords offices which has given rise to the home
3. IoT malware and ransomware automation.
4. IoT botnets aiming at
cryptocurrency • The security of these IoT devices is a huge matter of
5. Data security and privacy concerns concern as it can expose your IP address that can
(mobile, web, cloud) pinpoint to your residential address.
6. Small IoT attacks that evade
detection • This vital information can be sold by the hackers to
7. AI and automation the underground websites which are havens for
criminal outfits.
8. Home Invasions
9. Remote vehicle access • Moreover, if you’re using IoT devices in your
10. Untrustworthy communication security systems, then there is a possibility that
they might compromise as well as leave your house
at a huge potential threat.
1. Insufficient testing and updating
2. Brute-forcing and the issue of
default passwords
3. IoT malware and ransomware
4. IoT botnets aiming at
cryptocurrency
5. Data security and privacy concerns
(mobile, web, cloud)
6. Small IoT attacks that evade
detection • Apart from home invasion, hijack of your car is
7. AI and automation also one of the threat possessed by the IoT.
8. Home Invasions
9. Remote vehicle access
10. Untrustworthy communication
1. Insufficient testing and updating
2. Brute-forcing and the issue of
default passwords
• Smart cars are on the verge of becoming reality with
3. IoT malware and ransomware
the help of connected IoT devices. However, due its
4. IoT botnets aiming at
IoT association, it also possesses a greater risk of a
cryptocurrency
car hijack.
5. Data security and privacy concerns
(mobile, web, cloud)
• A skilled hacker might hijack by getting the access
6. Small IoT attacks that evade
of your smart car through the remote access. This
detection
will be scary situation as anyone can have control
7. AI and automation
over your car and it can leave you vulnerable to
8. Home Invasions
lethal crimes.
9. Remote vehicle access
10. Untrustworthy communication
 • There are many IoT devices which send messages
1. Insufficient testing and updating
to the network without any encryption. This is one
2. Brute-forcing and the issue of
of the biggest IoT security challenge which exists
default passwords
out there.
3. IoT malware and ransomware
4. IoT botnets aiming at
• It’s high time that all the companies ensure
cryptocurrency
encryption of the highest level among their cloud
5. Data security and privacy concerns
services and devices.
(mobile, web, cloud)
6. Small IoT attacks that evade
• To avoid this threat, the best way to do is to use
detection
transport encryption and standards like TLS.
7. AI and automation
Another way is to use different networks that
8. Home Invasions
isolates different devices.
9. Remote vehicle access
10. Untrustworthy • You can also use private communication which
communication ensures that the data transmitted is secure and
confidential.
1. Insufficient testing and updating • However, lack of basic security awareness among
2. Brute-forcing and the issue of staff as well as state-of-the-art cybersecurity
default passwords solutions has made the healthcare industry a
3. IoT malware and ransomware favourite target for hackers.
4. IoT botnets aiming at
cryptocurrency • A 2016 report from cybersecurity firm
5. Data security and privacy concerns SecurityScorecard found that healthcare is the fifth
(mobile, web, cloud) highest in ransomware counts among all industries,
6. Small IoT attacks that evade and more than 77 per cent of the entire healthcare
detection industry has been infected with malware since
7. AI and automation August 2015.
8. Home Invasions
9. Remote vehicle access • Among them was the notorious WannaCry
10. Untrustworthy ransomware attack in 2016 which affected over
300,000 machines across 150,000 countries,
communication including the UK's National Health Service (NHS).
Effective Ways to build security in IoT Apps

01
Automatic Application Scanning

02
Implement Already Vetted Architectures

03
Always Encrypt Sensitive Data
 • They provide instant feedback to the developer about
the security vulnerabilities that might be introduced
Automatic into the app due to a certain line of code they’re
writing.
Application • Implementing these tools from the start of the
Scanning development cycle means security testing isn’t left for
the end of the development phase; it becomes an
iterative process.
• However, these tools should be seen more as aids,
than as solutions because there’re many security
vulnerabilities they are not equipped to identify.
• Some popular source code analysis tools include
OWASP SWAAT Project, IBM Security AppScan
Source, VeraCode etc.
12/29/2023 NITTTR CHANDIGARH 31
 Implement • If you’re aiming to build a complete mobile
solution, then it’ll need to access real time data
Already Vetted on-the-go and perform different transactions.
• This will require strong and safe integration to
Architectures the cloud and other onsite systems. In short,
you’ll need to make sure your server-side
controls are fool-proof and efficient.
• So, how can you ensure the security of these
gateways? By using and implementing 3rd party
architecture (middleware) that have perfected
their art, instead of building your own custom
mobile gateways.
12/29/2023 NITTTR CHANDIGARH 32
 • Turning your sensitive data into an unreadable,
Always Encrypt protected, format seems like a no-brainer, but sadly as
highlighted by NowSecure in its report, 35% of all
mobile applications don’t encrypt the sensitive data
Sensitive Data they send over the network.

• Add another layer of security by building the habit of

never saving your sensitive data like credit card
numbers in the app or the mobile device itself. OWASP
has deemed insecure data storage as the second
biggest security risk for mobile devices and apps.
• Including data purging algorithms into your apps which
deletes the user’s sensitive data automatically, goes a
long way to maintaining the app’s security.

12/29/2023 NITTTR CHANDIGARH 33

Case Studies
Mirai Botnet, 2016 (aka Dyn Attack)
• Largest DDoS attack on Service Provider, Dyn using an IoT
Botnet

• Lead to huge portions of the internet going down, including

Twitter, the Guardian, Netflix, Reddit, and CNN.

• This IoT botnet was made possible by malware called Mirai.

• Once infected with Mirai, computers continually search the

internet for vulnerable IoT devices and then use known
default usernames and passwords to log in, infecting them
with malware. These devices were things like digital cameras
and DVR players.

IoT Malware Attacks Rise 217% From 2017

 JEEP CHEROKEE HACKING
• It was the summer of 2015, and Wired reporter Andy Greenberg was
driving a Jeep Cherokee in downtown St. Louis.
• A zero day exploit which allowed them to send instructions to the vehicle
through its entertainment system.
• The vents started blasting cold air at the maximum setting, the radio was
blaring Skee-lo at full volume, and the windshield wipers turned on. Unlike
the last time his car started acting up, the hackers weren't cackling in the
backseat, but 10 miles away.
• Fiat Chrysler recalled 1.4 million Jeep Cherokees and
issued a patch closing that vulnerability.
The Hackable Cardiac Devices from
St. Jude
• St. Jude Medical’s implantable cardiac devices have
vulnerabilities that could allow a hacker to access a
device. Once in, they could deplete the battery or
administer incorrect pacing or shocks, the FDA said.

• The devices, like pacemakers and defibrillators, are used

to monitor and control patients’ heart functions and
prevent heart attacks.

• The vulnerability occurred in the transmitter that reads

the device’s data and remotely shares it with physicians.
The FDA said hackers could control a device by
accessing its transmitter.
Thank you
Sensors and Actuators
 What is a sensor?
• A sensor senses and measures some physical quantity
and converts that measurement into digital value. That
digital value is passed to another device for
transformation into useful data that can be consumed
by intelligent devices or humans.
• Sensors provide superhuman sensory capabilities. In
fact, they are able to provide an extremely wide
spectrum of rich and diverse measurement data with
far greater precision than human senses
 Categories of sensors
• Active or Passive
• Invasive or non invasive
• Contact or no contact
• Absolute or Relative
• Areas of Applications
 Sensor Types
Sensor types Description Examples
Position A position sensor measures the position of an object, in Potentiometer, proximity
absolute scale or relative scale. sensor
Occupancy and Occupancy sensors detect the presence of people and animals. Electric eye, radar
motion Motion sensors detect movement of people and objects.
Velocity and Velocity sensors measures how fast an object moves along a Accelerometer, gyroscope
acceleration straight line or how fast it rotates.
Acceleration sensors measure changes in velocity.
Force Force sensors detect whether a physical force is applied or not Viscometer, tactile
and the magnitude of Force sensor (touch sensor)
Pressure Pressure sensors are related to force sensors, measuring force Barometer, Piezometer
applied by liquids or gases.
Humidity and Measures humidity and temperature of a place Hygrometer, humistor, soil
Temperature moisture sensor,
Thermometer, calorimeter,
Temperature gauge
Biosensors Biosensors detect various biological elements, such as Blood glucose biosensor,
organisms, tissues, cells, enzymes pulse oximetry
 What is a Actuators?
• Actuators, receive some type of control signal
(commonly an electric signal or digital
command) that triggers a physical effect,
usually some type of motion, force, and so on.
 Classification of Actuators
• Type of motion: Actuators can be classified based on the type of
motion they produce (for example, linear, rotary, one/two/three-
axes)
• Power: Actuators can be classified based on their power output
(for example, high power, low power, micro power
• Binary or continuous: Actuators can be classified based on the
number of stable-state outputs.
• Area of application: Actuators can be classified based on the
specific industry or vertical where they are used.
• Type of energy: Actuators can be classified based on their energy
type.
 Examples of Actuators
Type Examples

Mechanical actuators Lever, screw jack, hand crank

Electrical actuators Thyristor, biopolar transistor, diode

Electromechanical actuators AC motor, DC motor, step motor

Electromagnetic actuators Electromagnet, linear solenoid

Hydraulic and pneumatic actuators Hydraulic cylinder, pneumatic cylinder,

piston, pressure control valves, air motors

Smart material actuators Shape memory alloy (SMA), ion exchange

fluid, magnetorestrictive material, bimetallic
Strip
Micro- and nanoactuators Electrostatic motor, microvalve, comb drive
 Difference between Sensors and Actuators
Sr.
Sensor Actuator
No.
Actuator converts electrical signals
Sensor converts physical quantities and characteristics into
1 into physical action such as force
electrical signals.
and motion.

It acts as an output device in a

It acts as an input device in any control system and placed in
2 control system and placed in
input port
output port

Sensor takes input from environment and senses surroundings Actuator takes input from output
3
condition. signal conditioning unit of system.

It gives output to environment and

Sensor gives output to input signal conditioning unit of system to
4 makes impact on load to control
convert into electrical form.
parameters.

It gives information to the system about environment condition It accepts command from system to
5
to monitor and control. deliver physical action.
 Different Types of Sensors
•Temperature Sensor
•Proximity Sensor
•Accelerometer
•IR Sensor (Infrared Sensor)
•Pressure Sensor
•Light Sensor
•Ultrasonic Sensor
•Smoke, Gas and Alcohol Sensor
•Touch Sensor
•Color Sensor
•Humidity Sensor
•Position Sensor
•Magnetic Sensor (Hall Effect Sensor)
•Microphone (Sound Sensor)
Different Types of Sensors
Different Types of Actuators
Thank you