The Internet of Things (IoT), also called the Internet of Everything or the Industrial Internet, is a new technology paradigm regarded as a global network of machine and devices capable of interacting with each other. Internet of things (IoT) is closely related to numerous fields. The IoT platform is a suite of components that enable deployment of applications, independent and secure connectivity between devices, device/sensor management and integration with 3rd party systems. With increased demand of utilize the platform by web access, the task of this thesis is to develop a RESTful web service for specific IoT platform – SensibleThings platform using Jersey framework. Then measuring the web server under two scenarios and evaluating. Finally, I present the future work for the RESTful web service to improve its functions.

The interest and demand for smart home technologies has increased rapidly during the past few years. Due to factors such as convenience, innovation, flexibility, and security, these products are becoming a bigger part of our everyday life. With the increased demand and need for this technology, companies are working quickly to try to meet this demand and need of their customers. The development is becoming faster and faster, and therefore the risk of security being overlooked has increased. Companies want to meet the demand, and by trying to get the products on the market faster, other aspects might be compromised. A country which is often looked to for development and production of products is China. China is believed to be one of the countries with the most promising future for smart technologies and Internet of Things due to the immense investment put into telecommunications, development of technologies, and supporting infrastructure. The research of this thesis sought to investigate what effects the increased interest and demand for smart technologies has had on companies who are working with smart home technology by conducting a multiple case study on three companies in China which are in the smart home technology industry. With this case study, the perspective from the three companies has been gathered and analyzed. The research resulted in finding out the perception which these three companies have on the rapid development of smart home technologies, and the firsthand effects it has had on their individual company.

An extensive analysis of attribute-based encryption (ABE) in systems with resource constrained devices is performed. Two system solutions of how ABE can be performed in such systems are proposed, one where the ABE operations are performed at the resource constrained devices and one where ABE is performed at a powerful server. The system solutions are discussed with three different ABE schemes. Two of the schemes are the traditional key policy ABE (KP-ABE) and ciphertext policy ABE (CP-ABE). The third scheme is using KP-ABE to simulate CP-ABE, in an attempt to benefit from KP-ABE being computationally cheaper than CP-ABE while maintaining the intuitive way of using CP-ABE. ABE is a computationally expensive encryption method which might not be feasible to perform at the resource constrained sensors, depending on the hardware. An implementation of a CP-ABE scheme with a 128 bit security level was written and used to evaluate the feasibility of ABE on a sensor equipped with an ARM Cortex-M3 processor having 32 kB RAM and 256 kB flash. It is possible to perform CP-ABE on the sensor used in this project. The limiting factor of feasibility of ABE on the sensor is the RAM size. In this case policy sizes up to 12 attributes can be performed on the sensor. The results give an idea of the feasibility of encryption with ABE on sensors. In addition to the results several ways of improving performance of ABE on the sensor are discussed.

With the invention and rise of the Internet of Things, a technology that facilitates the gathering and use of personal data, the importance of the security and the integrity of the user has increased. The purpose of this study is to investigate the different outlooks of two different target groups, professional developers and users, on the subject of integrity and personalization in the digital sphere of systems development. A qualitative approach was used for this study. Interviews were conducted with 6 different professionals in the field of development and design. To gather data from the nonprofessionals a survey was used. The data was then analyzed using qualitative content analysis. The result implies that users are more concerned with the impact Internet of Things have on their privacy and integrity than the producers. We conclude that this stems from not enough awareness from the consumers of the actual risks and benefits of personalization. From our analysis we then developed a model to aid developers in working with consumers. This framework allows the user to divulge only the data they are comfortable with, while also giving them the opportunity to receive a more tailored service if they choose to share more.

The Internet of Things (IoT) is a concept that revolves around ordinary devices that are connected to the internet for extended control and ease of use. Altran, a company dealing in high technology and innovation consultancy, predicts a large growth in business opportunities in the IoT area in the coming years, and therefore wants to invest in knowledge about the Internet of Things. Altran wanted a report that described popular wireless IoT communication technologies along with a proposal for a general IoT communication platform or base that could be used to implement many of these technologies. Additionally, an audio streaming application were to be implemented on the proposed platform to validate its credibility. The project resulted in a report on 6 different wireless IoT technologies: Z-wave, ZigBee, Thread, Bluetooth, 802.11n, and 802.11ah. A hardware and software base was proposed that could implement 4 of 6 of these technologies. This base was the Raspberry Pi 2 along with the Raspbian Jessie operating system. Finally an audio streaming system that could stream data to a set of smart Speaker nodes over wireless links based on IEEE 802.11n was implemented on the proposed base.

Les applications de l'Internet des objets (IdO/IoT) se composent de divers objets en grande partie mobiles et avec des ressources limitées ou riches. Des tels dispositifs exigent des interactions légères et faiblement couplées en termes de temps, d'espace et de synchronisation. Les protocoles au niveau middleware de l'IoT prennent en charge un ou plusieurs types d'interaction assurant la communication entre objets. De plus, ils supportent différents niveaux de Qualité de service (QDS) pour cette communication par rapport aux ressources disponibles sur les dispositifs et les réseaux. Les dispositifs utilisant le même protocole middleware interagissent de manière homogène, car ils exploitent les mêmes caractéristiques fonctionnelles et de QDS. Cependant, la profusion de protocoles middleware pour l'IoT se traduit par des objets très hétérogènes. Cela nécessite des solutions d'interopérabilité avancées intégrées à des techniques de modélisation et d'évaluation de la QDS. La principale contribution de cette thèse est d'introduire une approche et de fournir une plate-forme pour la synthèse automatique des artefacts logiciels permettant l'interopérabilité. De tels artefacts permettent l'interconnexion entre des objets mobiles qui utilisent des protocoles hétérogènes au niveau middleware. Notre plate-forme prend en charge l'évaluation de l'effectivité de l'interconnexion en termes de la QDS de bout en bout. Plus précisément, nous dérivons des conditions formelles pour des interactions réussies, et nous permettons la modélisation et l'analyse des performances ainsi que le réglage du système de bout en bout, tout en considérant plusieurs paramètres système pour l'IoT mobile. / Internet of Things (IoT) applications consist of diverse Things including both resource-constrained/rich devices with a considerable portion being mobile. Such devices demand lightweight, loosely coupled interactions in terms of time, space, and synchronization. IoT middleware protocols support one or more interaction types (e.g., asynchronous messaging, streaming) ensuring Thing communication. Additionally, they introduce different Quality of Service (QoS) features for this communication with respect to available device and network resources. Things employing the same middleware protocol interact homogeneously, since they exploit the same functional and QoS features. However, the profusion of developed IoT middleware protocols introduces technology diversity which results in highly heterogeneous Things. Interconnecting heterogeneous Things requires mapping both their functional and QoS features. This calls for advanced interoperability solutions integrated with QoS modeling and evaluation techniques. The main contribution of this thesis is to introduce an approach and provide a supporting platform for the automated synthesis of interoperability software artifacts. Such artifacts enable the interconnection between mobile Things that employ heterogeneous middleware protocols. Our platform further supports evaluating the effectiveness of the interconnection in terms of end-to-end QoS. More specifically, we derive formal conditions for successful interactions, and we enable performance modeling and analysis as well as end-to-end system tuning, while considering several system parameters related to the mobile IoT.

La question de sécurité a toujours constitué un défi pour les chercheurs dans le domaine des réseaux de communication. L’apparition de nouveaux paradigmes, applications et des technologies d’un côté ; l’ubiquité et l’hétérogénéité des entités communicantes d’un autre côté, ont induit des problèmes de sécurité très complexes. Les préjudices engendrés sur la vie privée des utilisateurs peuvent être irréparables. D’abord, nous avons proposé une approche systémique et cognitive permettant d’inclure les aspects de sécurité d’Internet des Objets (IdO) dans un cadre cohérent. Comparé à l’approche analytique, elle peut manquer de rigueur théorique, mais reste flexible et utilisable dans la prise de décision dans l’environnement ubiquitaire d’IdO. Ensuite, nous avons défini des questions liées aux menaces accidentelles ou intentionnelles, pouvant arriver en cas de compromission de données privées échangées. La caractérisation du problème a eu lieu en étudiant les concepts fondamentaux dans IdO et les travaux de recherche effectués dans le contexte de la sécurité. En examinant les différents travaux de recherche, nous avons constaté que plusieurs solutions classiques restent applicables de point de vue sécurité mais sont limitées par des contraintes d’énergie, de mémoire et de capacité de calcul. Pour y remédier, nous avons visé à construire une réponse pragmatique en utilisant la théorie des jeux. L’avantage de cette approche réside dans ses bases mathématiques et formelles solides permettant d’atteindre les meilleurs équilibres. Après, nous avons justifié analytiquement nos choix portant sur des éléments essentiels de notre système, leurs interactions et leurs objectifs. Nous avons utilisé un calcul probabiliste basé sur un processus Markovien. Dans notre approche, nous avons défini trois scénarios différents (e-santé, commerce et transport intelligent), deux acteurs principaux (DH : Data Holder, et DR : Data Requester), ayant des comportements de types différents (trusted-regular, trusted-curious, untrusted-curious et untrusted-malicious), et un ensemble de stratégies dépendant de quatre paramètres (moyens de communication, détection d’attaque, motivation financière, et concession sur les données privées). Enfin, nous avons montré l’existence d’un équilibre du jeu avec une valeur de motivation financière et un niveau de protection des données privées satisfaisants, et en calculant les probabilités correspondantes. Nous avons validé notre modèle en obtenant des résultats numériques conformes à ceux tirés du modèle théorique. / Security questions have always constituted a research challenge in the field of communication networks. The appearance of new paradigms, concepts, applications and technologies from one hand, and the ubiquity and the heterogeneity of the communicating entities from another hand, led to new complex problems of security. In some cases, the damages caused to the private life of every user can be irreparable. First, we propose a systemic and cognitive approach to include all Internet of Things (henceforth IoT) security aspects in a coherent framework. Compared to the analytic approach, our vision may lack theoretical rigor, but remains a flexible approach that may be required during decision making in ubiquitous environment. Next, we identify precise questions related to accidental or intentional threats, which may lead to private data breach during their exchange over networks. Then, we characterize the privacy problem by studying the fundamental concepts of IoT and the research activities related to security. By examining the related research work, it has been noticed that several classical solutions remain applicable but are limited by energy constraints, memory space, and calculation capacities. To overcome this problem, we propose a logical and controllable solution based on game theory approach. The advantage of this choice resides in its solid mathematical and formal basis. Then, we analytically explain the choice of the main system components, their interactions and their objectives. We used a probabilistic approach using a Markovian process, where we define three different application scenarios (e-health, trade and intelligent transport), two main actors (private data owner and requester) with different player’s types (trusted-regular, trusted-curious, untrusted-curious and untrusted-malicious), and a set of strategies depending on communication facilities, attack detection, incentive motivation and privacy concession. Finally, we evaluate the model by demonstrating the existence of an equilibrium solution with a satisfactory value of incentive motivation and data privacy concession, and by calculating the final state probabilities. We validate the proposed model through numerical results obtained from the theoretical model.

Cette thèse traite des problèmes et des défis de sécurité dans l’Internet des Objets (IdO). L’évolution de l’Internet classique vers l’Internet des Objets crée de nombreux challenges dans la manière de sécuriser les communications et soulève des problèmes liés au contraintes de l’internet des objets à savoir : objets à faibles ressources d’énergie et de calculs, hétérogénéité nuisant à l’interopérabilité des objets, taille du réseau de plus en plus grande, ... etc. En effet, Internet s’est développé d’un réseau d’ordinateurs personnels et de serveurs vers un immense réseau connectant des milliards d’objets intelligents communicants. Ces objets seront intégrés dans des systèmes complexes et utiliseront des capteurs et actionneurs pour observer et interagir avec leur environnement physique. Les exigences des interactions entre objets communicants en termes de sécurité dépendent du contexte qui évolue dans l’espace et le temps. Par conséquent, la définition de la politique de sécurité doit être adaptative et sensible au contexte. Un des problèmes auxquels nous nous sommes intéressés est le contrôle d’accès efficace à base de cryptographie d’attributs : « Attributes Based Encryption (ABE) ». Les schémas ABE (CP-ABE et KP-ABE) présentent plusieurs atouts pour l’implémentation d’un contrôle d’accès cryptographique. Par contre, ces schémas posent des défis opérationnels à cause de leurs complexités et leur surcoût élevé en termes de temps d’exécution et consommation énergétique. Pour pallier cet inconvénient, nous avons exploité l’hétérogénéité d’environnement Internet des Objets pour proposer des versions collaboratives et distribuées de ces schémas de contrôle d’accès cryptographique. Nos solutions réduisent considérablement le coût en termes d’énergie nécessaire à l’exécution. Le deuxième inconvénient des schémas ABE est l’inexistence de mécanismes efficaces de gestion de clés. Nous avons proposé des solutions pour le problème de révocation d’attributs dans le schéma CP-ABE, Ces solutions, en plus de leur efficacité, répondent à des exigences de sécurité différentes selon le cas d’applications. Nous avons proposé également, une solution à base de CP-ABE pour le problème du « grouping proof ». Le « grouping proof » consiste à fournir une preuve sur la coexistence, dans le temps et l’espace, d’un ensemble d’objets. Parmi les applications de notre solution, on peut citer le payement NFC et la sécurisation de l’accès aux locaux sensibles. / In this thesis, we deal with security challenges in the Internet of Things. The evolution of the Internet toward an Internet of Things created new challenges relating to the way to secure communications given the new constraints of IoT, namely: resource constrained objects, heterogeneity of network components, the huge size of the network, etc. Indeed, the Internet evolved from a network of computers and servers toward a huge network connecting billions of smart communicating objects. These objects will be integrated into complex systems and use sensors and actuators to observe and interact with their physical environment. The security requirements of the interactions between smart objects depend on the context which evolves in time and space. Consequently, the definition of the security policies should be adaptive and context-aware. In this thesis, we were interested in the problem of access control in IoT relying on Attribute based Encryption (ABE). Indeed, ABE schemes present many advantages in implementing a cryptographic fine-grained access control. However, these schemes raise many implementation challenges because of their complexity and high computation and energy overheads. To overcome this challenge, we leveraged the heterogeneity of IoT to develop collaborative and distributed versions of ABE schemes. Our solutions reduce remarkably the overhead in terms of energy consumption and computation. The second limitation of ABE schemes is the absence of efficient attribute/key revocation techniques. We have proposed batch based mechanisms for attribute/key revocation in CP-ABE. We demonstrated the efficiency of the proposed solutions through simulations. Finally, we have proposed a CP-ABE based solution for the problem of grouping proof. This problem consists of providing the proof that a set of objects are present simultaneously (same time and same location). The propose solution has many applications such as enforcing the security of NFC based payments and the access to sensitive locations.

This thesis studies the phenomenon of human-system interaction in smart homes as a practice of Internet of Things. The research was conducted through interviews, workshops and observations and followed an interpretive research paradigm of phenomenologically-situated paradigm of HCI and a qualitative research approach. The theories of Phenomenology and Postphenomenology were used to interpret the experiences, beliefs and views of the participants. The empirical findings were processed and a thematic analysis was followed in order to identify the main themes that emerged out of the interviews, workshops and observations. The discussion of the findings showed that the research questions were answered to the grade that the participants of the research design, use and interact with smart homes in a multiple and complex way.

Embedded systems have been present in our daily lives for some time, but trends clearly show a rise in inter-connectivity in such devices. This presents promising new applications and possibilities, but also opens up a lot attack surface. Our goal in this thesis is to find out how you can develop such interconnected embedded systems in a way that guarantees the three major components of information security: Confidentialy, Integrity and Availability. The main focus of security is networked security. In this thesis, a dual approach is taken: investigate the development process of building secure systems, and perform such an implementation. The artifacts produced as byproducts, the software itself, deployment instructions and lessons learned are all presented. It is shown that the process used helps businesses find a somewhat deterministic approach to security, have a higher level of confidence, helps justify the costs that security work entails and helps in seeing security as a business decision. Embedded systems were also shown to present unforeseen obstacles, such as how the lack of a motherboard battery clashes with X.509. In the end, a discussion is made about how far the system can guarantee information security, what problems still exist and what could be done to mitigate them.