Device-friendly TLS 1.3

Pod IoT Platform API

Pimoroni LED 10 mm

Arduino IDE

Arduino MKR GSM 1400

Arduino Nano Every

enosim-cli

DHT22 Temperature Sensor

This project is the next in the series to demonstrate usage of SIM-based cryptographic services to improve security of IoT devices.The first project demostrated telemetry data encryption while delivering messages from IoT device to a server. It was <a href="https://create.arduino.cc/projecthub/kostiantynchertov/tls-1-3-for-arduino-nano-649610">"TLS 1.3 for Arduino Nano"</a>.The second project <a href="https://create.arduino.cc/projecthub/kostiantynchertov/zero-touch-provisioning-based-on-tls-1-3-a07359">"Zero Touch Provisioning based on TLS 1.3"</a> was intended to show Device Deployent or in other words configuration of the device at the first power up. The project also demonstrated permanent secure control of a device by means of periodical requests of control parameters from a server.Now the SIM interface functions of both projects were combined into the library PodEnoSim which is available from Arduino Library Manager and provides the more simpler way for IoT developers to start with the technology.To load the library find <code >Tools</code> item from the IDE main menu and select <code >Manage Libraries...</code> In the search field type <code >PodEnoSim</code> and push <code >Install</code> button.<figure><img src=https://projects.arduinocontent.cc/d77ae6d1-9c59-4850-8c00-6aa52229998d.png /><figcaption> </figcaption></figure>During library installation you may asked about missed dependencies.<figure><img src=https://projects.arduinocontent.cc/cd2263be-2d48-4019-8172-e49692ed479d.png /><figcaption> </figcaption></figure>Push <code >Install all</code> button to be sure everything will work correctly.The library was tested on two different microcontrollers: <ul ><li >SAMD21 with u-blox SARA-U201 modem (MKR GSM 1400 board) </li></ul><ul ><li >ATMega4809 with Sim7000E modem (Arduino Nano Every board with Waveshare NB-IoT Hat).</li></ul>The next examples are provided for each board:<ul ><li >send data to server in authenticated and encrypted way (<code >SIM2CloudEncryption-DHT22</code>)</li></ul><ul ><li >get configuration or control parameters from a server in authenticated and encrypted way (<code >ZeroTouchProvisioning-LEDExternal</code>).</li></ul>There are 2 additional examples for the MKR GSM 1400 board which allow to explore the technology without any additional hardware - just a simulation of data source (<code >SIM2CloudEncryption</code>) and control from the server the state of the built-in LED (<code >ZeroTouchProvisioning-LEDInternal</code>).Lets go throught the simplest example - <code >SIM2CloudEncryption</code>. All you need to test it - Arduino MKR GSM 1400 board and Pod ENO SIM.To load an example find <code >File</code> item from the IDE main menu and select <code >Examples</code> then navigate down till section <code >Examples</code><code >from</code><code >Custom</code><code >Libraries</code> and find the name of the libray <code >PodEnoSim.</code> Choose <code >Arduino-MKR-GSM-1400</code> and <code >SIM2CloudEncryption</code> and you 'll get the demo scetch.The scetch simultes (hardcoded) "sensitive" information which you need to send to a server. It is a JSON-encoded message: <code >{"temperature":21.5}</code>. It is encoded as <code >DATA_ITEM</code> constant. As you would like to change it please don't forget to update the <code >LEN_DATA</code> constant accordingly.The setup() functions includes 4 steps to prepare for data sending:<ul ><li >method <code >init() </code>is called with MODEM_BAUD_RATE parameter to initialize serial interface to the modem;</li></ul><ul ><li >method <code >waitForModemStart()</code> is called to wait until the modem becomes responsive to the AT commands;</li></ul><ul ><li >method <code >waitForNetworkRegistration() </code>is called to wait until the modem be able to open data channel to the server;</li></ul><ul ><li >method <code >deviceIdSet()</code> is used to provide SIM with unique device identifier.</li></ul>The loop() function may include some code for getting the data and formatting it. The most interesting part is the request to send encrypted data to a server will look as simple as<pre ><code >byte res = enosim.dataSend(dataBuffer, dataLength); </code></pre>So you could enforce your project with TLS1.3 encryption by adding just one line of code in the main loop!<h3 >Control and simulation</h3>The open source client tool written in python3 may be used to control Pre-Shared keys, upload device configurations and analyze data downloaded be devices. It also provide possibility to simulate SIM sessions to upload test data and download configurations.To install the tool, clone the repository <a href="https://github.com/PodgroupConnectivity/enosim-cli">enosim-cli</a> and execute <pre ><code >cd enosim-cli python3 </code></pre>To use the tool you shall request from Pod the next secrets:<ul ><li >TLSPROXY_KEYENC</li></ul><ul ><li >API_USER</li></ul><ul ><li >API_PASS</li></ul><ul ><li >SIM_KEY</li></ul>The best way to use is put all of the secrets into <a href="http://config.yml/">config.yml</a> file in the iotsim-cli folder.The DEVICE_ID shall be also configured in advance. For simulation it may be any value but for real usage the value shall be unique along all your devices used.You could simulate a device, for example a carbon dioxide sensor, by sending data with the command<pre ><code >python3 enosim-cli simulate stc -j '{"co2": 340}' </code></pre>you 'll get the next messages<pre ><code >2021-06-30 13:03:13,093 - enosim - INFO - TLS1.3-PSK session established. Initialising operation. 2021-06-30 13:03:15,856 - enosim - INFO - b'{"co2":340,"iccid":"98xxxxxxxxxxxxxxxxxx","deviceid":"deb001deb002deb003"}' </code></pre>The last line is the response from the server to confirm the data was received correctly.Now you could get the data from the server<pre ><code >python3 enosim-cli device getdata </code></pre>and see the server response like this<pre ><code >2021-06-30 13:16:04,373 - enosim - INFO - [ { "sim_attribute_update_id": 507, "iccid": "89xxxxxxxxxxxxxxxx", "deviceid": "deb001deb002deb003", "createdAt": "2021-06-30", "updatedAt": "2021-06-30", "sim_attributes": [ { "id": 679, "sim_attribute_update_id": 507, "key": "co2", "value": "340", "createdAt": "2021-06-30", "updatedAt": "2021-06-30" } ] } ] </code></pre><code >The</code><code >PSK</code> in the SIM and in the server may be updated to user specified value. To set new value '404142434445464748494a4b4c4d4e4f' as the PSK in the SIM and to upload it to the server setup a PCSC reader, insert the SIM into the reader and use the next command<pre ><code >python3 enosim-cli </code></pre>The tool allows to discover technology deeply and debug your own server application or bridge to an IoT platform.

Examples

Schema with Arduino Nano Every board

Schema with MKR GSM 1400 board

Device-friendly TLS 1.3

The library to access SIM-based cryptography services - TLS1.3 protocol implementation - for two boards: MKR GSM 1400 and Nano Every