Timeframe
Background
In 2021, following the successful completion of the first NSTIx Cyber project, a further project was commissioned to explore the challenge of improving the security of LoRaWAN-based IoT networks. Separately in May 2021 the UK’s National Cyber Security Centre (NCSC) had published its Connected Places Cyber Security Principles guidance, a document that is designed to guide local authorities in appropriately managing the risks to their connected places.
Problem
LoRaWAN is a low power wide area networking (LPWAN) technology that is rapidly being adopted across industries including smart cities and connected places, and increasingly grey areas that arguably fall under Critical National Infrastructure. Whilst ideal for experimentation and getting quickly to value, its architecture of end nodes, gateways, application and network servers means it can be challenging to configure and integrate correctly and securely.
The requirement for the work was to produce a self-contained appliance that could be used to create pop-up hardened LoRaWAN networks. Further, to validate the design against the NCSC’s Connected Places Cyber Security Principles guidance, a threat and principles alignment analysis also needed to be produced.
Solution
An instance of Configured Things’ configuration management platform is utilised to manage the solution. Ericsson Cradlepoint’s R1900 router provided 5G backhaul connectivity and a docker-based containerised compute environment from which Configured Things’ agent could run, to connect to and configure the rest of the deployment. An instance of the open-source ChirpStack LoRaWAN backend and the Mosquitto MQTT message broker were hosted in the containerised environment.
Configured Things’ declarative approach utilises cross-domain document exchange, configurations describing the desired state of the system are stored in GitHub by a remote administrator, these configuration documents are then fetched by the appliance and the system reconfigured. For example whenever a new gateway would be added to the system, not only would ChirpStack be reconfigured, but MQTT ACLs would also be updated to reduce the attack surface of the system to only authorised endpoints. Certificate-based authentication is utilised to authenticate each gateway and the ChirpStack backend individually to the broker.
The solution integrates a LORIX One LoRaWAN gateway, which is fully managed and configured by the platform to utilise network services via the Cradlepoint router.
To further limit what data might be accessed from the ChirpStack system, rather than expose the broker wholesale to downstream applications, Configured Things created a Data Gateway that proxied data according to policy with the downstream application.
A STRIDE analysis has also been conducted to understand the threats to the system and a gap analysis performed against the NCSC’s Connected Places Cyber Security Principles.
The following video discusses and demonstrates the work:
About Configured Things
Configured Things is a Bristol based startup formed in 2018, spun out of Hewlett Packard Labs. We create products and solutions that address the challenges of managing systems and data across trust boundaries. We are alumni of the NCSC for Startups program, and retain a close working relationship with the NCSC and other government agencies.
If you would like to hear further about this work or our solutions generally, please contact: getconfigured@configuredthings.com
