This document describes the WP3 project on IoT security, privacy, and trust. It lists the 12 partner organizations involved and their countries. The main areas of the project are integration, interoperability, discovery, knowledge-based search, dynamic services, security, privacy, and pattern creation for IoT resources like sensors and actuators. It discusses security over different levels, standardization trends around securely communicating heterogeneous IoT entities, and use cases that will test the distributed IoT framework like smart cities, smart energy, and industry 4.0.

1. WP3 – IoT Security, Privacy and Trust
UMU - OdinS
www.iotcrawler.eu

2. Partners
Participant organisation name Short name Country
Universidad de Murcia UMU Spain
University of Surrey UniS United Kingdom
University of Applied Sciences
Osnabrück
UASO Germany
Aarhus University AU Denmark
Siemens AG Österreich SIEMENS Austria
NEC Corporation NEC United Kingdom
AGT Group (R&D) GmbH AGT Germany
digital worx DW Germany
Odin Solutions S.L. OdinS Spain
City of Aarhus AAR Denmark

3. Main areas
• Integration
• Interoperability
• Discovery
• Knowledge-based search
• Dynamic services
• Security and Privacy
• Pattern creation and abstraction
Security,Privacy&Trust
IoT Resources: sensors and actuators
Use cases
Machine initiated semantic sear ch
IoT discovery
Context management
Monitoring & fault recovery
Multi-criteria ranking
Adaptive indexing
Edge
broker
Edge
broker
Edge
broker
Cloud
broker
Distributed
IoT framework
Dynamic
crawling
Search
Dataanalysis
API
Smart city Social IoT
Smart
energy
Industry
4.0

4. Security and Privacy over the different
levels

5. Security protocols in the IETF
Authentication
Authorization
Network Access
Key
Distribution
-
KDC
Channel
Protection
Key
Agreement
EAP
PANA
CoAP-EAP
AAA
...
HIP-DEX
IKEv2
DTLS(Handshake)
EDHOC
...
Kerberos
OAuth
...
IPsec
DTLS (record)
OSCORE

6. Standarization Trends
● Need to securely communicate heterogeneous IoT entities
○ Managing a great number of devices
○ Enabling mechanisms to control exchanged data access
○ Preserve entities’ privacy
Work currently on:
● Redefining current standards
○ Separation between DTLS handshake and DTLS Record in an standardized way
○ Object Security using DTLS (assumed in IoT devices) instead of using new
protocols
○ Extensions to use AAA in LPWAN
● Designing and testing new protocols
○ CoAP-EAP. A lightweight EAP lower layer for IoT
○ Implementing and testing the EDHOC draft in IoT devices
○ Data access control based on CP-ABE schemes
○ Identity and Privacy in blockchain

7. Enablers for a Decentralised and
Secure IoT Crawler Platform
• Objective:
• Security enablers for managing security and access control
• Approach
• Combine blockchain technology with policy monitors and policy enforcement
points.
• Making use of a privacy preserving identity management for authentication.
IdMix
• Link access rights to NGSI model
• Fine-grained access control mechanism. XACML
• Outcomes:
• Generic enablers for security at platform and data/service level.
• Distributed Based Access Control (DCapBAC)
• D3.1 and D3.2

8. Security and Privacy at Context Information
● Quality of Information enrichment for Context Information
● Security also considered as a QoI property
○ Authorization purposes
○ Security properties’ description

9. Owner & ACL extensions
921.09.2018

10. Security Properties
10

11. Use Cases raised for the project
● Aging @ Home
● Dimentia
● Healthcare
● Find My Lost Child
● Pulse of Aarhus
● Smart Agriculture
● Smart Energy
● Smart Parking
● Automatic wearable and sensor
deployment at professional
events
● Industry 4.0 – Condition
Monitoring and Process
Optimization
● Supply Chain Management (DLT)
11

12. Healthcare
Combining physiological and environment sensors for monitoring purposes
Narrative
● In a multi-source IoT data stream environment, a user (human or
machine agent) is interested in finding patterns and correlations
between the patterns and the agent also would like to subscribe to
receive notification when certain events or patterns occur.
● It is important to be able to create effective pattern and abstraction
models and then develop indexing and discovery mechanisms that
allow discovery and access to these patterns in distributed and multi-
source environments
12

13. Aging@Home
Discover and integrate health related sensors at home in order to save integration costs and offer more flexibility to use a wide
range of vendors for offering health related services to elderly people. Here: automatic discovery of a blood pressure sensor to get
an instant analytical insights for an elderly person.
Narrative
● Emma, 67, supports active lifestyle and wants to keep on living to the full further. Suffering from a few minor medical
conditions and living alone, she is using an AI bot supporting her in her daily routines.
● She is interfacing the bot via smart voice-speaker, her conversational interface to interact with the bot on a daily basis. She
recently learned that she has blood pressure instability and her doctor told her that she buy a blood pressure monitoring
device and check her measurements regularly to prevent falling and hospitalization. Emma’s daughter and caregiver that
visits her on a as per need basis also have the desire to monitor Emma’s health state.
● One morning Emma wakes up and feels dizzy. She realizes she has a moderate gait instability. She asks the smart voice-
speaker “Why am I feeling dizzy?” The AI bot advises her to measure her blood pressure. Once Emma is finished the AI bot
use the measurements and recommends her to sit down and calls a nurse.
13

14. Supply Chain Management
Our goal is providing innovative technologies to supply chain management, including: monitoring data
sharing; ensuring digitalizing business and contract establishment in IoT platforms; ensuring consistent of
data storage despite attacks; and ensuring full transparency and visibility of all processes running in the IoT
platforms.
Narrative:
● Stakeholders of supply chain include suppliers, producers and clients. Supply chain system must allow
monitoring production processes that they comply with regulations; continuous sharing data between
these stakeholders; and tracking production and information flow.
● One use-case of the supply chain is to track and secure medical supplies in health industry. For
instance, electronic tags can be attached to package. The tag information on each package is captured
and stored in the Blockchain for tracking provenance, certifying its authenticity. By doing so, we can
assure the viability of the entire supply chain. Therefore it helps to detect fraud and manipulation that
might cause potential risk to end-users.
14

15. Smart Agricultural
Discover sensors on an agricultural machinery automatically and integrate them into the agricultural process dynamically. Automated adaption of the
process can save costs by providing a universal application that adjusts accordingly to the available sensors, actuators and even machinery.
Furthermore, the application can be designed to be vendor independent allowing more flexibility.
Narrative:
● The fields of Farmer Klaus needs to be fertilized to increase the growth of this season’s crops. The amount of fertilizer applicable on the field is
regulated by EU policies and Klaus needs to report how much fertilizer was used.
● Modern agricultural machinery uses a variety of sensors to capture the current state of the field. The information can be used to adjust the
amount of fertilizer sprayed onto the plant by controlling the actuator, in this case a nozzle. By integrating additional information sources, such
as soil samples or the weather forecast, this process can be refined even more.
● With the IoTCrawler technologies, a control terminal on the machinery can detect automatically, what kind of sensors and actuator and other
information sources are available. With this information the application on the terminal can use self-configuration methods to adjust to the
current situation.
● A more advanced version of this scenario follows current trends in the agricultural sector, where large machines are replaced by smaller ones
acting in a swarm. Such a swarm needs to be choreographed by a controller, however this process can be very dynamic. The small machines
do not have to arrive on the field at the same time and not all have to be the same model or from the same vendor. With IoTCrawler, the
controller is always aware of available machinery and their capabilities.
15

16. THANK YOU!
www.iotcrawler.eu
mail@iotcrawler.eu