2

I am trying to build a system in which IoT devices can connect and are classified without the need for manual checks by the system administrator. In this system, IoT devices will send data, and on the basis of that data, they will be classified into groups. Also, extra layer of encryption might be applied depending on what device it is.

Now, my question is:

How to identify what kind of IoT device is entering my network. It could be a sensor or a fridge or an AC or a smartphone. How do I identify what device it is? What metrics do I use? Should I analyze its packet or payload? Or should I use the MAC address to identify what type of device it is? Does MAC address give this type of information?

I am confused about this. If I can identify what device it is, I can then authenticate and classify the device.

Improve this question
2
  • Have a look at SSDP (Simple Service Discovery Protocol).
    – MatsK
    Sep 13, 2021 at 12:19
  • 1
    A MAC address certainly won't tell you anything about the type of sensor. At best it'll tell you the manufacturer, but it's frequent that it tells you the manufacturer of the chip inside rather than the device itself. What kind of devices? How are they connecting? Wi-Fi? BLE? Zigbee? Ethernet? Something else? Depending on the tech, there may be ways to query the device to determine what it is, or they may advertise such info. Usually devices can't just join without being explicitly accepted (or at least they shouldn't, for security reasons).
    – jcaron
    Sep 13, 2021 at 12:19

1 Answer 1

Reset to default
1

I'd like for you to consider these points that arise from your questions.

  1. Are you wanting to classify the entire device or are you wanting to classify the data ? i.e, Is it possible now (or in the foreseeable future) for a single device to send up data of different classifications ?
  2. What threats do you want to protect against ? This will determine your authentication mechanism.
    Those questions will determine your future path.

If you choose to go MQTT based IoT with one of the big providers (AWS/Azure/Google), the standard way to authenticate a device and encrypt communications is to use a certificate. It is best to generate a certificate per device so that if a device becomes compromised, you can just revoke its certificate and all the other devices are still able to communicate.
With IoT based on MQTT, the clientID identifies the device. There are techniques to ensure that devices cant spoof the clientID of another device (by using the certificate pricipal ID or policies) if you want to protect against that threat as well.
You may not be able to authenticate at a sensor level. Only at a level where something can support some authentication. Maybe that device controls a few sensors ?

If you choose to classify at a data level, you can more confidently do that once you have secured the entire device as above. Now, you can just use MQTT topics to identify the different types of data and apply appropriate security policies on the different pieces of data.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.