Storing encrypted sensor data to the IOTA Tangle.

• 

  Flow

• 

  Serverside

• 

  Clientiside

• 

  IOTA Search

Inspiration

RuuviTags are used in logistics applications where the tags move outside the owner's infrastructure. The challenge is to get data from a tag in unknown location to owner's servers, while maintaining the confidentiality and integrity of the data.

Sending and storing sensor data over untrusted network has three big issues: 1) Confidentiality of the data, how the data can be kept private. 2) Authenticity of the data, how receiver can trust the readings. 3) Delivering the data, how the data can be sent to intended receiver.

What it does

Problem 1) is solved with RuuviTag's in-built AES-ECB-128 hardware, true HW RNG and a random 64 bit ID burned in the silicon. The tag has encryption key which is salted with the Unique ID. Finally each message is salted with additional 32-bit random nonce.

Unique ID has to be read via NFC, which means that attacker requires physical access to the device. Random nonce prevents attacker from mapping cryptographic outputs to known conditions.

2) Since the data is encrypted with unique key known only by owner of the device, authenticity can be verified by decrypting the data. The broadcast data format has trailing 24 bits all zeroes, so chance of forged transmission being decrypted into something reasonable with matching tail is miniscule.

3) Delivering data is solved via IOTA Tangle. A gateway has to send BLE advertisement data to a server which attaches the data to Tangle, but the gateway doesn't have to care about owner of sensor or target IP address of the server.

Gateway sends data to the server, and server converts hex to IOTA's trinary format which is then attached as a message to the IOTA transactions. In this hackathon the server is configured to attach advertisements with matching headers to the Tangle and send every transaction to specific address, but in production the server could attach all incoming data and payment for data delivery could be arranged over the Tangle. The BLE advertisements could contain a tag which would be broadcasted to the Tangle to let owner of the data to search for their data.

Finally the owner of the data searches for transaction incoming to his analytics address, downloads transactions and decrypts the data.

How I built it

On sensor side RuuviTag-fw v1 is used as a base. AES encryption was added for this hackathon. Please see IoThon fork for the code. The application is built on top of Nordic Semiconductor SDK 12.3 using C. Ask Otso for a demo.

Gateway is a cheap BLE-WIFI gateway.

Data is interfaced to the Tangle with a VPS running on DigitalOcean. Serverside code is available on GitHub and npm. The code is NodeJS. Please see readme of GitHub for details

The receiver code is likewise available on GitHub and npm. Like serverside, the code is done with NodeJS. More details are in the readme.

Challenges I ran into

IOTA's example for doing proof-of-work has been broken, as it relies on some FFI libraries which won't compile after a recent update to Chrome's V8 engine. Setting up a full node would require a rather high-performance VPS and manually contacting people to set up the neighbor nodes.

The usual silliness when working with crypto RNG and bitwise operations with several languages and platforms.

Accomplishments that I'm proud of

The system works end-to-end, although it's not robust against malformed data etc.

What I learned

Quite a bit about nRF52 HW AES.

What's next for Storing encrypted sensor data to the IOTA Tangle.

Including TAG of transaction in the advertisement data for zero configuration on receivers.

Built With

• c
• iota
• node.js
• ruuvitag