element14 Community
element14 Community
    Register Log In
  • Site
  • Search
  • Log In Register
  • About Us
  • Community Hub
    Community Hub
    • What's New on element14
    • Feedback and Support
    • Benefits of Membership
    • Personal Blogs
    • Members Area
    • Achievement Levels
  • Learn
    Learn
    • Ask an Expert
    • eBooks
    • element14 presents
    • Learning Center
    • Tech Spotlight
    • STEM Academy
    • Webinars, Training and Events
    • Learning Groups
  • Technologies
    Technologies
    • 3D Printing
    • FPGA
    • Industrial Automation
    • Internet of Things
    • Power & Energy
    • Sensors
    • Technology Groups
  • Challenges & Projects
    Challenges & Projects
    • Design Challenges
    • element14 presents Projects
    • Project14
    • Arduino Projects
    • Raspberry Pi Projects
    • Project Groups
  • Products
    Products
    • Arduino
    • Avnet Boards Community
    • Dev Tools
    • Manufacturers
    • Multicomp Pro
    • Product Groups
    • Raspberry Pi
    • RoadTests & Reviews
  • Store
    Store
    • Visit Your Store
    • Choose another store...
      • Europe
      •  Austria (German)
      •  Belgium (Dutch, French)
      •  Bulgaria (Bulgarian)
      •  Czech Republic (Czech)
      •  Denmark (Danish)
      •  Estonia (Estonian)
      •  Finland (Finnish)
      •  France (French)
      •  Germany (German)
      •  Hungary (Hungarian)
      •  Ireland
      •  Israel
      •  Italy (Italian)
      •  Latvia (Latvian)
      •  
      •  Lithuania (Lithuanian)
      •  Netherlands (Dutch)
      •  Norway (Norwegian)
      •  Poland (Polish)
      •  Portugal (Portuguese)
      •  Romania (Romanian)
      •  Russia (Russian)
      •  Slovakia (Slovak)
      •  Slovenia (Slovenian)
      •  Spain (Spanish)
      •  Sweden (Swedish)
      •  Switzerland(German, French)
      •  Turkey (Turkish)
      •  United Kingdom
      • Asia Pacific
      •  Australia
      •  China
      •  Hong Kong
      •  India
      •  Korea (Korean)
      •  Malaysia
      •  New Zealand
      •  Philippines
      •  Singapore
      •  Taiwan
      •  Thailand (Thai)
      • Americas
      •  Brazil (Portuguese)
      •  Canada
      •  Mexico (Spanish)
      •  United States
      Can't find the country/region you're looking for? Visit our export site or find a local distributor.
  • Translate
  • Profile
  • Settings
Arduino
  • Products
  • More
Arduino
Arduino Forum Internet of Things... Security
  • Blog
  • Forum
  • Documents
  • Quiz
  • Events
  • Polls
  • Files
  • Members
  • Mentions
  • Sub-Groups
  • Tags
  • More
  • Cancel
  • New
Join Arduino to participate - click to join for free!
Actions
  • Share
  • More
  • Cancel
Forum Thread Details
  • Replies 24 replies
  • Subscribers 396 subscribers
  • Views 2022 views
  • Users 0 members are here
  • ethernet
  • internet_of_things
  • iot
  • encryption
  • arduino
Related

Internet of Things... Security

gadget.iom
gadget.iom over 10 years ago

I have recently purchased an ENC28J60 module and started experimenting with ethernet connectivity on my various Arduino boards. As to be expected with the Arduino community there are a good number of resources, on here and the wider web, for support in getting a basic project up and running.

 

I have mainly been experimenting with sending GET requests to a web server and acting upon the responses, and while there is a great deal of guidance about how to achieve this, none of them seem to contemplate the aspect of secure communications. While this may not be so much of an issue on a private LAN, the very nature of 'Internet of Things' would suggest that this communication will take place over a third party network at some point.

 

I have spent some time investigating the process of implementing some basic encryption on these communications and have found the availability of such information to be very weak. Methods I have looked into so far are RC4 and XOR, and some of the examples actually work on the local microcontroller, but fail to encrypt/decrypt successfully in the PHP implementations at the server.

 

Have you implemented any kind of encryption in your microcontroller projects? How successful were they? Do you think there are enough resources for data encryption? Or is there something obvious that I've missed? image

 

Would love to hear your thoughts and opinions.

Paul

  • Sign in to reply
  • Cancel

Top Replies

  • gadget.iom
    gadget.iom over 10 years ago +3
    They say you can't put a price on your health, and for the sake of my mental health I have taken Robert Peter Oakes s advice and ordered one of these bad-boys to experiment with: CC3200-LAUNCHXL - TEXAS…
  • DAB
    DAB over 10 years ago in reply to Robert Peter Oakes +3
    I think the best way to deal with IoT security is to look at the data you are sending. As long as you are just looking at states and raw data, you are pretty safe from anyone making sense of what you are…
  • shabaz
    shabaz over 10 years ago in reply to Robert Peter Oakes +3
    Oh, wow - probably healthcare has some of the highest security requirements - so we should use you to grill all the kickstarter creators we see who totally ignore security : )
  • Robert Peter Oakes
    Robert Peter Oakes over 10 years ago

    One of the issues with security and the Arduino UNO with the ENC or the WizNet chips for Ethernet is that most of the IP stack is handled by the UNO, not the chipset

     

    The Wiznet does more work for you than the ENC but is still remains that if you want SSL which is the normal web security layer applied to protect the message transport from client to host takes more resources than available on the device

     

     

     

    To apply true encryption also is a heavy resource operation as well as the time it takes to perform the encryption

     

     

     

    Most projects move toward a more advanced controller if they want SLL or encryption, for instance the CC3200 from TI has an encryption engine built in hardware on chip so it is relatively easy to use with minimal code, they can also handle SSL natively

     

     

     

    Newer network modules like the recent WIFI modules may be able to handle SLL on behalf of the UNO but that’s because they have a micro-controller of their own offloading the main CPU

     

     

     

    Regards

     

     

     

    Peter

    • Cancel
    • Vote Up +1 Vote Down
    • Sign in to reply
    • Cancel
  • gadget.iom
    gadget.iom over 10 years ago in reply to Robert Peter Oakes

    Thanks Robert Peter Oakes.

     

    I had a feeling this was going to be an issue. Looks like I'm going to ditch the Arduino platform altogether and upgrade to a more powerful (Perhaps 32-bit) processor. I will take a look into the CC3200 chip.

     

    It did cross my mind at one point to use a GSM shield and send all data through the GPRS network. At least the most susceptible end of the link will be encrypted courtesy of the network provider.

    • Cancel
    • Vote Up +1 Vote Down
    • Sign in to reply
    • Cancel
  • DAB
    DAB over 10 years ago

    A lot of the new processor chips now include an encryption circuit.

     

    At the very least, you can do a simple encoding to make sure nobody gets your data unless you want them to.

     

    Security issues are the biggest impediment to the IoT in my opinion.

     

    DAB

    • Cancel
    • Vote Up +1 Vote Down
    • Sign in to reply
    • Cancel
  • gadget.iom
    gadget.iom over 10 years ago in reply to DAB

    Hi DAB

     

    Your opinion is shared with mine. image

    I have seen a fair number of security issues surrounding IOT devices and was keen to avoid falling into the same trap.

    After losing confidence that an encryption approach was going to work I looked into a couple of encoding functions (such as XOR). Strangely the decoded output on the Web Server didn't match the data sent, and trying an online decrypting website offered a third alternative. So I had no point of reference anyway.

    • Cancel
    • Vote Up +1 Vote Down
    • Sign in to reply
    • Cancel
  • gadget.iom
    gadget.iom over 10 years ago

    They say you can't put a price on your health, and for the sake of my mental health I have taken Robert Peter Oakess advice and ordered one of these bad-boys to experiment with: CC3200-LAUNCHXL - TEXAS INSTRUMENTS - LAUNCHPAD CC3200 SIMPLELINK WIFI ON CHIP | Farnell element14

    • Cancel
    • Vote Up +3 Vote Down
    • Sign in to reply
    • Cancel
  • clem57
    clem57 over 10 years ago

    As for internet, look to SSL communication like https!image

    • Cancel
    • Vote Up +1 Vote Down
    • Sign in to reply
    • Cancel
  • gadget.iom
    gadget.iom over 10 years ago in reply to clem57

    Thanks clem57, SSL was the first thing I looked at. Unfortunately I googled "Arduino UNO SSL" and got this:

    image

    • Cancel
    • Vote Up +2 Vote Down
    • Sign in to reply
    • Cancel
  • Robert Peter Oakes
    Robert Peter Oakes over 10 years ago in reply to gadget.iom

    Yup, Arduino UNO and SSL do not mix in any universe but there are options

     

     

     

    For instance, the ESP-01 etc. are sub processors with extensive capability and I believe this includes SSL, also a YUN can offload this task from the basic Arduino, some Launchpad’s (TivaC or CC3200 for instance) have crypto libraries built in and can still be fairly easy to program

     

     

     

    Food for thought

    • Cancel
    • Vote Up 0 Vote Down
    • Sign in to reply
    • Cancel
  • DAB
    DAB over 10 years ago in reply to Robert Peter Oakes

    I think the best way to deal with IoT security is to look at the data you are sending.

    As long as you are just looking at states and raw data, you are pretty safe from anyone making sense of what you are sending.

    If you send messages, then using the old compiler technic of a message ID number instead of a detailed message allows you to customize what IDs mean different events, data or issues.

     

    Security is most needed when you put data together with context.  At that point, you have valuable information and you really should secure it.

     

    The nice thing about a simple code is that it is secure if only you have the ability to put the code into a useable context.

     

    DAB

    • Cancel
    • Vote Up +3 Vote Down
    • Sign in to reply
    • Cancel
  • mcb1
    mcb1 over 10 years ago in reply to DAB

    This was part of a news item in NZ ... mainly about the smart TV's.

    It pointed to this report which reinforces what you're saying DAB.

     

    http://www.ftc.gov/system/files/documents/reports/federal-trade-commission-staff-report-november-2013-workshop-entitled-internet-things-privacy/150127iotrpt.pdf

     

    Mark

    • Cancel
    • Vote Up +1 Vote Down
    • Sign in to reply
    • Cancel
>
element14 Community

element14 is the first online community specifically for engineers. Connect with your peers and get expert answers to your questions.

  • Members
  • Learn
  • Technologies
  • Challenges & Projects
  • Products
  • Store
  • About Us
  • Feedback & Support
  • FAQs
  • Terms of Use
  • Privacy Policy
  • Legal and Copyright Notices
  • Sitemap
  • Cookies

An Avnet Company © 2025 Premier Farnell Limited. All Rights Reserved.

Premier Farnell Ltd, registered in England and Wales (no 00876412), registered office: Farnell House, Forge Lane, Leeds LS12 2NE.

ICP 备案号 10220084.

Follow element14

  • X
  • Facebook
  • linkedin
  • YouTube