A distributed audit trail for the Internet of Things
Options
BORIS DOI
Abstract
Sharing Internet of Things (IoT) data over open-data platforms and digital data
marketplaces can reduce infrastructure investments, improve sustainability by
reducing the required resources, and foster innovation. However, due to the
inability to audit the authenticity, integrity, and quality of IoT data, third-party
data consumers cannot assess the trustworthiness of received data. Therefore,
it is challenging to use IoT data obtained from third parties for quality-relevant
applications. To overcome this limitation, the IoT data must be auditable. Distributed
Ledger Technology (DLT) is a promising approach for building auditable
systems. However, the existing solutions do not integrate authenticity,
integrity, data quality, and location into an all-encompassing auditable model
and only focus on specific parts of auditability.
This thesis aims to provide a distributed audit trail that makes the IoT auditable
and enables sharing of IoT data between multiple organizations for
quality relevant applications. Therefore, we designed and evaluated the Veritaa
framework. The Veritaa framework comprises the Graph of Trust (GoT) as
distributed audit trail and a DLT to immutably store the transactions that build
the GoT. The contributions of this thesis are summarized as follows. First, we
designed and evaluated the GoT a DLT-based Distributed Public Key Infrastructure
(DPKI) with a signature store. Second, we designed a Distributed
Calibration Certificate Infrastructure (DCCI) based on the GoT, which makes
quality-relevant maintenance information of IoT devices auditable. Third, we
designed an Auditable Positioning System (APS) to make positions in the IoT
auditable. Finally, we designed an Location Verification System (LVS) to verify
location claims and prevent physical layer attacks against the APS. All these
components are integrated into the GoT and build the distributed audit trail.
We implemented a real-world testbed to evaluate the proposed distributed audit
trail. This testbed comprises several custom-built IoT devices connectable
over Long Range Wide Area Network (LoRaWAN) or Long-Term Evolution
Category M1 (LTE Cat M1), and a Bluetooth Low Energy (BLE)-based Angle
of Arrival (AoA) positioning system. All these low-power devices can manage
their identity and secure their data on the distributed audit trail using the IoT
client of the Veritaa framework. The experiments suggest that a distributed
audit trail is feasible and secure, and the low-power IoT devices are capable
of performing the required cryptographic functions. Furthermore, the energy
overhead introduced by making the IoT auditable is limited and reasonable
for quality-relevant applications.
marketplaces can reduce infrastructure investments, improve sustainability by
reducing the required resources, and foster innovation. However, due to the
inability to audit the authenticity, integrity, and quality of IoT data, third-party
data consumers cannot assess the trustworthiness of received data. Therefore,
it is challenging to use IoT data obtained from third parties for quality-relevant
applications. To overcome this limitation, the IoT data must be auditable. Distributed
Ledger Technology (DLT) is a promising approach for building auditable
systems. However, the existing solutions do not integrate authenticity,
integrity, data quality, and location into an all-encompassing auditable model
and only focus on specific parts of auditability.
This thesis aims to provide a distributed audit trail that makes the IoT auditable
and enables sharing of IoT data between multiple organizations for
quality relevant applications. Therefore, we designed and evaluated the Veritaa
framework. The Veritaa framework comprises the Graph of Trust (GoT) as
distributed audit trail and a DLT to immutably store the transactions that build
the GoT. The contributions of this thesis are summarized as follows. First, we
designed and evaluated the GoT a DLT-based Distributed Public Key Infrastructure
(DPKI) with a signature store. Second, we designed a Distributed
Calibration Certificate Infrastructure (DCCI) based on the GoT, which makes
quality-relevant maintenance information of IoT devices auditable. Third, we
designed an Auditable Positioning System (APS) to make positions in the IoT
auditable. Finally, we designed an Location Verification System (LVS) to verify
location claims and prevent physical layer attacks against the APS. All these
components are integrated into the GoT and build the distributed audit trail.
We implemented a real-world testbed to evaluate the proposed distributed audit
trail. This testbed comprises several custom-built IoT devices connectable
over Long Range Wide Area Network (LoRaWAN) or Long-Term Evolution
Category M1 (LTE Cat M1), and a Bluetooth Low Energy (BLE)-based Angle
of Arrival (AoA) positioning system. All these low-power devices can manage
their identity and secure their data on the distributed audit trail using the IoT
client of the Veritaa framework. The experiments suggest that a distributed
audit trail is feasible and secure, and the low-power IoT devices are capable
of performing the required cryptographic functions. Furthermore, the energy
overhead introduced by making the IoT auditable is limited and reasonable
for quality-relevant applications.
Date of Publication
2023
Year of graduation
2023
Theses Type
dissertation
Language(s)
en
Author(s)
Schärer, Jakob |
Faculty/Graduate School
Institute
Access(Rights)
open.access
Primary OA Publication
true