Band, Emily

Herry, Herry

Perkins, Colin

Singer, Jeremy

English

Enlighten: Publications

Peer to Peer Secure Update for Heterogeneous Edge Devices (Extended Abstract)

Enlighten

Peer to Peer Secure Update for Heterogeneous Edge DevicesEmily Band, Herry Herry∗, Colin Perkins, and Jeremy SingerSchool of Computing Science, University of GlasgowNovember 2017Deployment of smart campuses and smart cities use low-cost, low-power edge compute devicesto build sensor and control systems and provide smart edge compute nodes. The systems often start,with a few tens of nodes, but can rapidly scale to many thousands of devices. These devices can bein inaccessible locations, be mobile, or be in private residential locations, so remote administration isessential to ensure that security updates are deployed and to install new applications.The conventional approach for managing compute resources uses tools such as Chef or Puppet.These apply updates using either direct ssh access to the hosts being managed, or by pulling them froma well-connected central server. Accordingly, they work well for managing large clusters in data centreenvironments with reliable network infrastructure, but are not suitable for more distributed, mobile/ad-hoc, and less well-connected environments.To handle such situations, we designed and built a prototype decentralised management frameworkthat distributes system updates and management scripts via a peer to peer overlay network. This allowsus to manage devices that do not have direct network access, for example nodes behind network addresstranslators (NATs) or firewalls.Our system combines several techniques: 1) STUN-based UDP hole punching to discover and openNAT bindings; 2) an overlay protocol to deliver short messages, similar in scope to HashiCorp Serf, todistribute update notifications; and 3) BitTorrent to securely distribute the software updates. The keynovelty is that our system assumes partial network connectivity, and works in the presence of NATs arefirewalls.We securely send the metadata needed to trigger BitTorrent downloads to target devices that areindirectly connected to the administrator, ensuring they are not vulnerable to man in the middle attacks.We also enriched this metadata with: 1) a resource-unique identifier, which distinguishes updates for twodifferent resources, and 2) a version, which avoids the device using an outdated update which might stillexist in the network. Last but not least, we employ UDP hole punching technique to enable devices thatrun behind different NATs, to directly communicate with each other for distributing the torrent-file.Future work will integrate this peer-to-peer secure update framework into FRµIT testbed1 to enhancescalability and allow us to manage hosts in challenging network environments.∗Corresponding author; e-mail: herry.herry@glasgow.ac.uk1http://fruit-testbed.org

http://eprints.gla.ac.uk/156799/7/156799.pdf

Peer to Peer Secure Update for Heterogeneous Edge Devices (Extended Abstract)

Abstract

Similar works

Full text

Available Versions

Enlighten: Publications

Enlighten