A New Frontier For Internet of Things Security: Far-Flung Key Generation

物联网（IoT）通过智能家居、互联医疗、智慧城市、制造自动化等令人兴奋的应用，以数字方式改变了我们的日常生活，这些应用依赖于过去十年中连接的数十亿设备。Ofcom估计，英国的物联网设备数量将从2016年的1300万台飙升至2024年的1.56亿台。低功耗广域网（lpwan）是一种新型物联网系统，具有低功耗和宽覆盖（超过几公里）的特点。LPWAN占物联网设备数量和市场的四分之一。Digital Catapult正在建设国家LPWAN，以提高我们的生活质量，并利用LoRaWAN、NB-IoT和SigFox技术促进英国经济发展。沃达丰和Three UK正在为全国范围内基于蜂窝的LPWAN试点NB-IoT。然而，这场数字革命只有在我们能够提供安全的无线连接的情况下才能实现。应在合法设备之间建立一对密钥，以便在传输之前进行加密和解密。虽然传统的密钥分发方案，如椭圆曲线Diffie Hellman （ECDH）算法已经相当成熟，但由于其复杂性高，往往不太适合轻量级物联网应用。在实践中，通常使用预共享密钥（PSK），它在初始配置后可能永远不会刷新密钥。这显然存在安全风险，因为密钥可以被泄露，例如通过侧通道攻击。更糟糕的是，许多用户缺乏意识。英国国家网络安全中心于2019年进行的首次网络调查显示，全球有2320万受害者使用123456作为密码。物联网的漏洞导致了许多严重的安全攻击，这些攻击损害了用户隐私，对经济产生了不利影响，破坏了社会的信任。Gartner报告称，2019年信息安全市场的规模超过1240亿美元。事实上，为低成本物联网设备设计安全且低复杂性的密钥分发是一项挑战。如果需要密钥刷新，则会变得更加困难和繁琐，例如在LPWAN中，物联网设备位于几公里半径范围内的遥远环境中，并且可能没有人参与。这个开放的挑战可以用一种激进的、完全不同的方法来解决，即从无线信道生成密钥，它从无线信道不可预测的特征中自动生成加密密钥，从而避免了传统的密钥分发。虽然密钥生成已被证明可以很好地与WiFi等短距离通信一起工作，但由于更复杂的无线电传播条件和受影响的信道互易性，其与LoRa和NB-IoT等LPWAN技术的探索相当有限。因此，该项目将通过为LPWAN设计可扩展、自动和轻量级密钥生成解决方案来弥合这一差距。该项目将是基于lpwan的密钥生成的第一个系统研究。将采用一种涉及理论建模、算法设计和实验验证的协同方法。该项目的核心方面将包括新的数学信道相关模型和信道分解算法，以及针对LPWAN进行调整和优化的新密钥生成协议。将进行广泛的实地测量来评估我们的算法。该项目的一个独特之处在于为物联网创建可行的安全解决方案，并通过广泛的测量和概念验证原型进行验证。

The Internet of Things (IoT) has digitally transformed our everyday life with exciting applications such as smart home, connected healthcare, smart cities, manufacturing automation, relying on billions of devices that have become connected over the past decade. Ofcom estimated that the number of IoT devices in the UK will soar from 13 million in 2016 to 156 million in 2024. Low power wide area networks (LPWANs) are new IoT systems with features of low power and wide coverage (over several kilometres). LPWAN accounts one-fourth of the number of IoT devices and the market. Digital Catapult is building the national LPWAN to improve the qualities of our lives and boost the UK economy using LoRaWAN, NB-IoT, and SigFox technologies. Vodafone and Three UK are piloting NB-IoT for a nationwide cellular-based LPWAN.However, this digital revolution can only be viable if we can provide secure wireless connections. A pair of keys should be established between legitimate devices for encryption and decryption prior to transmissions. Although conventional key distribution schemes, e.g., elliptic curve Diffie Hellman (ECDH) algorithm, are quite mature, they tend to be less suitable for lightweight IoT applications owing to their high complexity. In practice, the pre-shared key (PSK) is often used, which may never refresh the key after its initial configuration. This obviously presents security risks since the key can be revealed, e.g. by side channel attacks. What is worse, many users lack awareness. The UK's first cyber survey in 2019 by the National Cyber Security Centre revealed numerous weak passwords, e.g., 23.2 million victims worldwide used 123456 as their passwords. The vulnerabilities of IoT have resulted in numerous grave security attacks, which have compromised user privacy, adversely affected the economy and undermined the trust in the society. Gartner reported the information security market exceeded $124 billion in 2019.Indeed, conceiving secure yet low-complexity key distribution for low-cost IoT devices is challenging. It becomes even more difficult and cumbersome if key refreshing is needed, such as in LPWAN where IoT devices are located in a far-flung environment over several kilometres radius and may not be attended. This open challenge can be tackled with a radical and completely different approach, namely key generation from wireless channels, which automatically generates cryptographic keys from unpredictable characteristics of the wireless channel, and thus avoids the conventional key distribution. While key generation has been demonstrated to work well with short-range communications such as WiFi, its exploration with LPWAN technologies such as LoRa and NB-IoT is rather limited, due to the more complicated radio propagation conditions and the affected channel reciprocity. This project hence will bridge this gap by designing scalable, automatic, and lightweight key generation solutions for LPWAN.This project will be the first systematic study for LPWAN-based key generation. A synergistic approach will be adopted which involves theoretical modelling, algorithm design and experimental validation. The core aspects of this project will include novel mathematical channel correlation models and channel decomposition algorithms as well as new key generation protocols tuned and optimised for LPWAN. Extensive field-measurements will be carried out to evaluate our algorithms. A unique feature of this project will be the creation of viable security solutions for IoT validated by extensive measurements and proof-of-concept prototypes.