On Track of Sigfox Confidentiality with End-to-End Encryption

Abstract

The last years brought many novel challenges for the Internet of Things (IoT). Low capital and operational expenditures, massive deployments of devices, reliability and security are among the most crucial ones. The recently introduced Low-power wide area (LPWA) technologies provide one possible way of addressing these challenges. In the current paper, we focus on one of the most mature LPWA technology, namely Sigfox. We provide a brief security assessment of this technology and highlight the main security imperfections. Notably, we also consider the recent changes introduced in the last revision of the Sigfox specification released in the fourth quarter of 2017. Importantly, this paper discusses the highlighted issues and compares three selected cryptographic encryption solutions (AES, ChaCha and OTP) in respect to the main IoT triad of performance, security and cost. We investigate the encryption solutions and characterize their energy consumption in a real-life implementation. The results herein presented are useful for understanding the cost of enabling security aspects and enable selecting the most efficient encryption protocol. CCS CONCEPTS• Security and privacy → Block and stream ciphers;

Analysis on functionalities and security features of Internet of Things related protocols

“…The authors of [93] propose the adoption of the One Time Pad (OTP) system as a data encryption mechanism. With respect to asymmetric encryption and elliptical encryption, such a solution does not transmit additional packets and does not alter the size of the final packet.…”

“…However, this limit does not occur with the Sigfox protocol since, in the worst case (i.e., every day sending the maximum number of messages available in one day), over five years, 255,000 messages are sent; consequently, the device would have no difficulty in generating such a number of keys. In [93], two different simulations are carried out: the first consists in measuring the actual impact in the use of AES-128, while the second simulation compares OTP with AES-128 and ChaCha20 15 , which is a lightweight encryption algorithm. In order to emulate different types of devices, different CPU frequencies are set: 4 MHZ, 8 MHZ, and 16 MHZ.…”

Integrating LPWAN Technologies in the 5G Ecosystem: A Survey on Security Challenges and Solutions

“…In the case of Sigfox, this may be due to the fact that it is defined as a closed system, so that it is difficult to design and develop further improvements devoted to increase its robustness or performance. Even so, one proposal addressing security aspects was represented in [109], which discussed the general aspects of Sigfox security and provided a comparison of different encryption techniques, such as AES, Chacha [110], and one time pad encryption [111] when combined with this technology. As mentioned above, Sigfox is included in the RFC 8376, where three main LPWAN areas are identified to be further developed, namely, (i) management features, (ii) security features, and (iii) applications profiles.…”

Security in Low Powered Wide Area Networks: Opportunities for Software Defined Network-Supported Solutions

“…Sigfox is one of the most popular transmission technologies in LPWAN, in [34] a security assessment of Sigfox is done, and vulnerabilities are discussed. It is highlighted that it lacks end to end security from sensors to users which can cause hindrance in the use of Sigfox in applications with sensitive data.…”