UC Irvine

The internet of things (IoT) has been attracting growing attention in recent years. As one potential technology used for IoT sensor network, Bluetooth Low Engery (BLE) is becoming one of the most anticipated solutions to establish IoT networks. Whilst BLE based IoT devices are becoming increasingly popular, security becomes an unavoidable concern not only for the devices by themselves but also for the whole network constructed with BLE devices.

In this thesis, we investigate the security issues on devices and we study the potential security issues for BLE-based IoT sensor networks. In order to explore the security on BLE scatternet, we explore how to form a BLE scatternet, how to implement an appropriate routing algorithm specifically for this network and what kind of potential attack this network may encounter often.

The research endeavor makes four contributions to the security field of intrusion detection on devices and IoT sensor networks. First, we propose a hardware-based intrusion detection approach called CONtrol-flow VERification SystEm (CONVERSE), which ensures control-flow integrity by verifying the destination of control-flow branches at runtime. Many techniques exist for an attacker to alter control-flow to trigger malicious behavior, such as stack and heap overflows which overwrite a return address or function pointer. By verifying branch target addresses at runtime, security exploits can be detected as illegal control-flow. Secondly, we propose an approach for scatternet formation and multi-hop routing for BLE scatternet. We define procedures for device discovery, communication between piconets and forming multi-hop scatternet. Thirdly, we improve the routing algorithm for BLE network in step 2, and present BLE Scatternet Battery- Aware Routing (BSBR), a power aware routing mechanism based on Dynamic Source Routing (DSR) which can be applied to BLE-based Mobile Ad-Hoc Networks (MANETs). Furthermore, we study the impact of battery exhaustion attacks on BLE-based networks. In order to defend against this type of attack, we propose an intrusion detection and prevention approach requiring the suspicious nodes to switch roles with its connected nodes after a pre-determined time. If the suspicious node is identified as a malicious one, it will be blacklisted to prevent future attacks.