Device Identity and Trust in IoT-sphere Forsaking Cryptography

Pre-print: Radio Identity Verification-based IoT Security Using RF-DNA Fingerprints and SVM

“…Each trial is comprised of eight authorized radios to facilitate rogue radio rejection assessment using that trial's two remaining radios. The results in [59] achieve FVR∈ [6,9]% for the rogue radios across the five trials at SNR=15 dB. In [59]: (i) the RF fingerprints are extracted from the signal's instantaneous amplitude that is negatively affected by noise, (ii) only a single feature selection approach is considered, (iii) the RF fingerprints of every radio are comprised of the same number of features, and (iv) TVR≥90% requires a SNR≥20 dB.…”

“…At the selected SNR, a feature selection method is removed from consideration if either the TVR≥90% is not met for any of Fig. 7: ID verification (•) and rogue rejection (×) performance for the six authorized radios of all three trials using Relief-F feature selection at SNR= [3,6] dB. The x-axis labels indicate the claimed digital ID with the number of retained features in parentheses and "Others ( )" indicates the five authorized radios whose ID is not being verified.…”

“…Due the TVR and FVR performance results presented in Fig. 6, ID verification and rogue rejection performance is continued to be assessed for SNR= [3,6] dB. However, for these SNR values the POEACC selected N r -dimensional RF-DNA fingerprints no longer satisfied the selected TVR≥90% and FVR≤10% benchmarks.…”

“…The number of deployed IoT devices continues to explode annually and is estimated to reach roughly 75 billion by 2025 [2]- [4]. Alarmingly 70% of all IoT devices do not employ encryption due to: (i) limited on-board computational capability, (ii) being too expensive for the manufacturer to implement, and (iii) scalability issues associated with implementation and management [5], [6]. This makes them, and the associated infrastructure, susceptible to attack by devices that are incorrectly authenticated as legitimate, when in fact they are not, due their use of compromised digital credentials that are transmitted in clear text.…”

On Security Best Practices, Systematic Analysis of Security Advice, and Internet of Things Devices

“…We note that, beyond the device identification process (our focus) per se, the resulting classification of device instances is often used in subsequent management or processing tasks as observed in our literature review (e.g., applying policies to specific classes of devices). ✓ Noguchi [161] ✓ Perdisci [167] ✓ Ray [171] ✓ AA3 Yousefnezhad [225] ✓ AA3 Aneja [19] ✓ AA3 Chowdhury [52] ✓ AA3 Hamad [100] ✓ ✓ AA3 Anantharaman [18] ✓ ✓ Kotak [126] ✓ ✓ Ammar [15] ✓ Ammar [16] ✓ Santos [183] ✓ Meidan [150] ✓ Singla [190] ✓ Marchal [144] ✓ Bao [28] ✓ Thomsen [203] ✓ Miettinen [152] ✓ Yu [227] ✓ Bezawada [40] ✓ Salman [181] ✓ Marchal [144] ✓ Aksoy [6] ✓ Kumar [130] ✓ AA4 Anantharaman [17] ✓ AA1, AA4 Mukhandi [155] ✓ AA1 Bin-Rabiah [41] ✓ AA1 Gritti [91] ✓ AA1 Kalra [119] ✓ AA1 Malche [143] ✓ AA1 Nashwan [157] ✓ AA1 Kim [122] ✓ AA2 Kim [123] ✓ AA1, AA2 Wang [214] ✓ AA2 Niya [160] ✓ AA2…”