Bootstrapping the Integrity of Sensor Data Labels at the Microcontroller Level Using Physically Unclonable Functions: Addressing Physical Vulnerabilities in the IoT Domain

Abstract

Modern decision-making processes across industries today increasingly rely on data-driven insights derived from various sources. As smart devices, sensor tech- nology, and the IoT (Internet of Things) evolve, organizations are progressively leveraging these technologies for data-driven decision-making. However, with the introduction of regulations such as the General Data Protection Regulation (GDPR) in recent years, organizations are compelled to adjust to new limita- tions imposed on user data collection and processing. This thesis is dedicated to one of the many technical difficulties associated with GDPR compliance in the IoT domain, specifically, compliance with regulations requiring data provenance at the IoT device level.

The thesis investigates the feasibility of leveraging Physically Unclonable Func- tions (PUFs) to bootstrap the integrity guarantees of sensor data labels, acting as provenance information, especially in environments prone to physical data extraction threats. The work to address the feasibility of PUF technology in this context is performed through the design and implementation of a prototype system. By exploring the potential of PUFs in this context, the thesis aims to contribute to the development of trusted data provenance solutions extending to the IoT domain.

The work provided in the thesis includes an account of the design and imple- mentation of the prototype, consisting of three main components. An evaluation of the security and efficiency of the prototype system is also included, exposing some vulnerabilities and potential solutions to patch these. The efficiency eval- uation included concludes that the performance is adequate given the context, but also provides a possible strategy to improve sensor data throughput of the system.

In conclusion, the prototype system and work included in the thesis lays a foundation for the viability of PUF technology as a means to bootstrap the integrity of sensor data labels at the IoT device level.