A New Frontier For Internet of Things Security: Far-Flung Key Generation

物联网（IoT）通过智能家居、互联医疗、智能城市、制造自动化等令人兴奋的应用，以数字化方式改变了我们的日常生活，这些应用依赖于过去十年中连接起来的数十亿台设备。Ofcom估计，英国物联网设备的数量将从2016年的1300万飙升至2024年的1.56亿。低功耗广域网（LPWAN）是一种新型的物联网系统，具有低功耗和宽覆盖（超过几公里）的特点。LPWAN占物联网设备数量和市场的四分之一。Digital Catapult正在建设国家LPWAN，以改善我们的生活质量，并使用LoRaWAN，NB-IoT和SigFox技术促进英国经济。沃达丰和Three UK正在为全国范围内基于蜂窝的LPWAN试点NB-IoT。然而，只有我们能够提供安全的无线连接，这场数字革命才是可行的。合法设备之间应建立一对密钥，以便在传输之前进行加密和解密。虽然传统的密钥分发方案，例如，椭圆曲线Diffie Hellman（ECDH）算法已经相当成熟，但由于其高复杂度，它们往往不太适合轻量级物联网应用。在实践中，通常使用预共享密钥（PSK），其在初始配置之后可能永远不会刷新密钥。这显然存在安全风险，因为密钥可能被泄露，例如通过侧信道攻击。更糟糕的是，许多用户缺乏意识。英国国家网络安全中心在2019年进行的第一次网络调查显示，英国存在许多弱密码，例如，23.2全球有100万受害者使用123456作为密码。物联网的漏洞导致了许多严重的安全攻击，这些攻击损害了用户隐私，对经济产生了不利影响，并破坏了社会的信任。Gartner报告称，2019年信息安全市场超过1240亿美元。事实上，为低成本物联网设备构思安全但低复杂性的密钥分发是具有挑战性的。如果需要密钥刷新，则会变得更加困难和繁琐，例如在LPWAN中，物联网设备位于几公里半径的遥远环境中，并且可能无人值守。这种开放的挑战可以用一种根本的和完全不同的方法来解决，即从无线信道生成密钥，该方法根据无线信道的不可预测特性自动生成加密密钥，从而避免了传统的密钥分发。虽然密钥生成已被证明可以很好地用于WiFi等短距离通信，但由于更复杂的无线电传播条件和受影响的信道互易性，其对LoRa和NB-IoT等LPWAN技术的探索相当有限。因此，本项目将通过为LPWAN设计可扩展的、自动的和轻量级的密钥生成解决方案来弥补这一差距。本项目将是第一个基于LPWAN的密钥生成的系统研究。将采用一种协同方法，其中包括理论建模，算法设计和实验验证。该项目的核心方面将包括新颖的数学信道相关模型和信道分解算法，以及为LPWAN调整和优化的新密钥生成协议。将进行广泛的实地测量，以评估我们的算法。该项目的一个独特之处是为物联网创建可行的安全解决方案，并通过广泛的测量和概念验证原型进行验证。

The Internet of Things (IoT) has digitally transformed our everyday life with exciting applications such as smart home, connected healthcare, smart cities, manufacturing automation, relying on billions of devices that have become connected over the past decade. Ofcom estimated that the number of IoT devices in the UK will soar from 13 million in 2016 to 156 million in 2024. Low power wide area networks (LPWANs) are new IoT systems with features of low power and wide coverage (over several kilometres). LPWAN accounts one-fourth of the number of IoT devices and the market. Digital Catapult is building the national LPWAN to improve the qualities of our lives and boost the UK economy using LoRaWAN, NB-IoT, and SigFox technologies. Vodafone and Three UK are piloting NB-IoT for a nationwide cellular-based LPWAN.However, this digital revolution can only be viable if we can provide secure wireless connections. A pair of keys should be established between legitimate devices for encryption and decryption prior to transmissions. Although conventional key distribution schemes, e.g., elliptic curve Diffie Hellman (ECDH) algorithm, are quite mature, they tend to be less suitable for lightweight IoT applications owing to their high complexity. In practice, the pre-shared key (PSK) is often used, which may never refresh the key after its initial configuration. This obviously presents security risks since the key can be revealed, e.g. by side channel attacks. What is worse, many users lack awareness. The UK's first cyber survey in 2019 by the National Cyber Security Centre revealed numerous weak passwords, e.g., 23.2 million victims worldwide used 123456 as their passwords. The vulnerabilities of IoT have resulted in numerous grave security attacks, which have compromised user privacy, adversely affected the economy and undermined the trust in the society. Gartner reported the information security market exceeded $124 billion in 2019.Indeed, conceiving secure yet low-complexity key distribution for low-cost IoT devices is challenging. It becomes even more difficult and cumbersome if key refreshing is needed, such as in LPWAN where IoT devices are located in a far-flung environment over several kilometres radius and may not be attended. This open challenge can be tackled with a radical and completely different approach, namely key generation from wireless channels, which automatically generates cryptographic keys from unpredictable characteristics of the wireless channel, and thus avoids the conventional key distribution. While key generation has been demonstrated to work well with short-range communications such as WiFi, its exploration with LPWAN technologies such as LoRa and NB-IoT is rather limited, due to the more complicated radio propagation conditions and the affected channel reciprocity. This project hence will bridge this gap by designing scalable, automatic, and lightweight key generation solutions for LPWAN.This project will be the first systematic study for LPWAN-based key generation. A synergistic approach will be adopted which involves theoretical modelling, algorithm design and experimental validation. The core aspects of this project will include novel mathematical channel correlation models and channel decomposition algorithms as well as new key generation protocols tuned and optimised for LPWAN. Extensive field-measurements will be carried out to evaluate our algorithms. A unique feature of this project will be the creation of viable security solutions for IoT validated by extensive measurements and proof-of-concept prototypes.