Facilitating secure network communication with resource constrained embedded devices: Analysis and implementation of local web control in smart home applications

Modern smart home IoT (Internet of Things) devices are commonly controlled with proprietarymobile applications via remote servers, which can have significant adverse implications for the enduser. This work aims to analyze the feasibility of an alternative method of control fully withinthe local network of the user, leveraging existing standard web technologies and open controlinterfaces to enable a maximum degree of privacy, choice and sustainability within the smarthome ecosystem, while ensuring the system remains secure against unauthorized manipulation.Given that a large quantity of IoT devices in use today are limited in their computational resources,both in the amount of memory available as well as the processing speed, standard approachessuch as employing HTTPS-based transport security are not always feasible and an the need foralternative solutions that are more suitable for such constrained devices becomes apparent.Herein, multiple approaches for achieving lightweight and secure web-based device control areoutlined and compared. Subsequently, a demonstrator control system architecture using keyedmessage authentication codes is implemented. This proof-of-concept shows that it is feasible tomeet essential security objectives in a local web IoT control context while utilizing less than akilobyte of additional memory compared to an unsecured solution; thus promoting sustainabilitythrough hardening the control protocols used by existing devices that previously had serioussecurity flaws, but too little resources for implementing standard web cryptography. Thereforethis work contributes to the achievement of the vision of a fully open and secure local smarthome.