Security in a Radio Controlled Remote Switch

Transcription

1 Security in a Radio Controlled Remote Switch Project 3, EDA625 Security, 2017 Ben Smeets Dept. of Electrical and Information Technology, Lund University, Sweden Last revised by Adnan Mehmedagic on at 16:36 What you will learn In this project you will Learn to setup a 433Mhz transmitter and receiver module Study a communication protocol to control light switches Use Arduino controllers for the receiver and transmitter modules Learn how to improve security in the communication protocol Intercept radio traffic from Nexa and Proove controllers 1

2 CONTENTS Contents 1 Instruction Checklist Introduction 4 3 Communication and Protocol 4 4 Building and testing the receiver Building Testing Building and testing the remote controller Building Testing Reflections 9 7 A secure Proove 9 8 Arduino environment Tracing output Receiver and Transmitter module What to do when it doesn t work A receiver and transmitter using one Arduino Approval sheet 14 2

3 Instruction 1 Instruction You meet in the project description a number of assignments. These assignments guide your work and you should use the assignments to structure your project work and your report. Give clear indications where you put your answers to the specific assignments (e.g. in your report refer to original Assignment and question numbers in this document). For convenience name the report Project3_eda625xyz, where xyz corresponds to your STIL id. You should submit the reports electronically in pdf or word format and use the subject "EDA625" in the that contains the report. Send it to ben.smeets.lu@analys.urkund.se. DO READ this entire document before it starts. AT HOME you should make the circuit drawings how to connect the receiver and transmitter units to the Arduino boards. Compute the length of the antenna, you find the formula in the section that describes the TX/RX modules. Your drawings and computation will be checked and must be approved by the assistant before you can switch on the equipment. BEFORE YOU ASK HELP follow the instructions that go along with the assignments. Check the wiring of your circuit. 1.1 Checklist You should submit Item Description 1 Report with your names on it 2 Circuit TX/Arduin0 1 in report 3 Circuit RX/Arduino 2 in report 4 Source code TX in report 5 Source code RX in report 6 Scanned approval sheet (see end of this document) included in report 3

4 Communication and Protocol 2 Introduction Increasingly we automate functions in our homes. Turning on or off lamps and electronic equipment has been possible already for many years using radio controlled switches. Typically the user buys one or several switches which can be controlled with a hand held remote. These remotes can be very simple or can be programmable, see Figure 1. The units in Figure 1 are relatively cheap and use 433Mhz radio technology to send signals from the remote to the receivers in the switches. In recent years the remotes have been complemented with computerized controls that allow people to program the controller through a web interface and get data from other units like temperature or door sensors. Such systems can then be made into a simple smart home system that allows one to control lights and heating on the basis of programmed time schedule or external stimuli. There are several types of such systems offered today on the market and in this project we will have a look at one of the simpler ones that are sold under different brand names. In this project we will only look at the Proove self learning switches that are shown in Figure 1. These self learning switches can be put into a state in which they learn the codes send by a remote. In older systems remotes and switches had to be paired, often using small dip-switches. In this project we will study the protocol used to control the light switches with the purpose to understand how secure the protocol is. The goal is to study the security flaws and understand how we can improve them. We will realize that with simple improvements one can make the protocol more secure. In the real world the security problems are a concern when we want to have these systems for home automation. We therefore already see better solutions coming on the market using more advanced standardized technologies for low energy communication for Internet-of-Things (IoT) applications. We notably have here WirelessHart, Zigbee and Z-wave. It is instructive to look at the simpler systems to understand the basic principles. Instead of using an existing remote we will develop our own remote using an Arduino and a 433MHz transmitter. Although firstly we will build a dummy receiver using a second Arduino and a 433MHz receiver.this receiver can then listen to signals being sent across the room. Thereafter we will monitor when the existing remote is used and hijack the communication so that we can control the switch using our own home-built remote. We later program the controller to perform a simple on-off cycle of a commercial Proove selflearning switch. The dummy-receiver setup allows us to later simulate our security improved switch. This setup avoids us having to find out how to reprogram the commercial Proove switch which might have been hard but also require to open and modify a device that is to be used on a 230v system with all its safety implications. In the third part of the project you have to make changes in the way the protocol works so it becomes more secure. Here you can apply the knowledge of what you learned in the course, e.g. encryption of data traffic. While working on this project you have to answer a number of assignments. These must be answered properly with motivations and they are also intended to give you some guidance. You are free to explore more than what these assignments ask you to do. 3 Communication and Protocol The communication from the controller to the receiver in the switch is very simple. We follow here the analysis by Joakim Wesslen in [1]. The protocol is using On/Off-Keying of the transmitter to send symbol 0 s and 1 s. By changing the timing in the on-off pattern one distinguishes between a one and zero. Fig 2 shows the timing where the time constant T=250µsec long. There are beside the 0 and 1 symbols two other symbols, the "sync" and the "pause". We refer to the symbols in Fig 2 as the physical symbols. Using these symbols we encode all logical data. Each logical data is sent as two physical symbols using the following rule 4

5 Communication and Protocol Figure 1: Example of two remotes and a self-learning switch of a 433Mhz system. Figure 2: Encoding of 0 s and 1 s into On-Off keying of the transmitter, T=250µsec. logical symbol physical symbols For example the logical bits 011 are sent using the sequence To send more complex data one groups the transmitter data into groups and send each group separate by using first a sync symbol followed by the physical symbols representing the data and ending with a pause symbol. But what is the protocol of the commands the switch understands. In order to distinguish between different remotes each remote has a unique code (TxCode). It is a 26 bit code so the probability that two random remote codes are the same is rather small. After the remote code the bits by which the remote controls the behaviour of the switch follows. It is a pattern of 6 bits as defined below. bit 1: G bit 2: O bits 3-4: CC bits 5-6: UU Group code On/Off Channel bits U=Unit bits 0 or 1 0 or 1 00=Proove/Anslut Proove/Anslut Unit #1 = 00, #2 = 01, #3 = 10 11=Nexa Nexa Unit #1 = 11, #2 = 10, #3 = 01 5

6 Communication and Protocol Hence each remote can control four switches of the brands "Nexa", "Proove", and "Anslut". The switches can be controlled individually or together as a group by setting the group code bit appropriately. Putting all this together we see that the packet format of a command equals N NNNNN NNNNN NNNNN NNNNN NNNNN G O CC UU where the NNN...NNN N bits represent the 26 bits of the remote s TxCode code. So we have 32 binary symbols that we must transmit between the sync and the pause One can write a simple program for the Arduino Uno to send a command based on the above description. The listing shows the most important routines. Via the course web you can download the complete program. //========================================================================== // Protocol layer, // Manchester like code, each symbol is repeated in complement form // Packet: sync+code+pause, void Tx433::sendCode(unsigned long code, int len) { int i = 0; unsigned long mask = 1; mask <<= (len-1); sendsync(); while (i < len) { if (mask & code) { sendone(); sendzero(); Serial.print("1"); else { sendzero(); sendone(); Serial.print("0"); mask >>= 1; i++; sendpause(); Serial.println(); /* Send the on/off data to the receiving device /* data=txcode+group+on+chcode/dim+dev /* Packets are send RETRANSMIT times in a row */ void Tx433::sendPackets(unsigned int dev, bool on) { unsigned long data; unsigned int group; dev = (dev < 3)? dev : 3; group = (dev == 3)? 1 : 0; data = TxCode; data = (data << 1) (1^ group); data = (data << 1) (1^ on); data = (data << 4) (DevControl(channelCode, dev)); // Encrypt the data // encrypt(&data,key) for (int i = 0; i < RETRANSMIT; i++) { sendcode(data, 32); // Physical layer void Tx433::sendZero() { digitalwrite(txpin, HIGH); delaymicroseconds(pulse_high); digitalwrite(txpin, LOW); delaymicroseconds(pulse_zero_low); void Tx433::sendOne() { digitalwrite(txpin, HIGH); delaymicroseconds(pulse_high); digitalwrite(txpin, LOW); delaymicroseconds(pulse_one_low); void Tx433::sendSync() { digitalwrite(txpin, HIGH); delaymicroseconds(pulse_high); digitalwrite(txpin, LOW); delaymicroseconds(pulse_sync_low); void Tx433::sendPause() { digitalwrite(txpin, HIGH); delaymicroseconds(pulse_high); digitalwrite(txpin, LOW); delaymicroseconds(pulse_pause_low); //========================================================================== Note that to increase the reliability and combat disturbances each command is repeated a number (RETRANSMIT) of times. Note also that we set the value of the on/off bit on Pin 13. Pin 13 is useful 6

7 Building and testing the receiver as it is connected to a LED on the Arduino board. In the full program that you download you will find some additional code lines that are useful for debugging and experiments. Figure 3 show the waveforms on a oscilloscope of the five packages that are transmitted (blue) and received (yellow) Figure 3: Transmitted (blue) and received(yellow) data packages 4 Building and testing the receiver 4.1 Building Take the circuit drawing that you prepared at home which shows how to connect the RX module on the breadboard and with the Arduino unit. Put the RX module on a breadboard and wire the ground and voltage pins. The receiver is NOT given an antenna, instead we connect the antenna input to the ground via a 220 Ω resistor, see Figure 4. We do not use the analog output (Pin3) of the RX module; it Figure 4: Coupling of antenna input of the receiver and indicator led. should remain unconnected. It is convenient to connect the digital output (Pin2) not only to the Arduino unit but also to the LED that you serial couple with a 1 KΩ resistor to the ground. This allows us to see if the receiver is receiving signals. Again be careful to connect the right pins. We take the GND and +5V from the connector of the Arduino board. Now connect the Arduino to your lab computer and fire up the IDE and select the USB port which the Arduino is connected to. Now we can download the program and also trace the program as it executes. 7

8 Building and testing the remote controller Install the RX library for the receiver module so that we can listen to signals in the room. At this point we turn the switch on and off with an existing remote while having the serial monitor window open. This way we can figure out at what port the switch is working at. 4.2 Testing Assignment 1 Compile and download the code into the receiver Arduino and let it run. Note that the TxCode is set to 0 in the receiver program. Watch the log screen. It might happen that you see data coming out even if your remote is switched off, why is that? Question: why is the TxCode set to zero in the RX code? Show the working receiver to the assistant for approval. Before calling help: If your receiver is not showing any sign of life check carefully all connections and reload the program and try again. Check that you have the correct voltage for the receiver. Check the data sheet. If that doesn t result in any progress consult your laboratory assistant. 5 Building and testing the remote controller 5.1 Building Now it is time to put the controller together. Take the circuit drawing that you prepared at home which shows how to connect the TX module on the breadboard and with the second Arduino unit. Put the TX module on the second breadboard and connect it to the Arduino. If you do not have a second breadboard place the receiver as far as possible from the sender module. Preferably you put an ALU foil of 10cm x 17,3 cm between them and have to foil connected to the ground.be careful to connect the right pins. We take the GND and +5V from the connector of the Arduino board and we use Pin 13 to control the data input to the transmitter. We connect a quarter wave wire to the antenna output. We are going to use a simple wire that will act as a quarter wave antenna. Since we are keeping things close the antenna is not that critical, hence we can use a simple wire. To calculate the length of our wire we use the simple formula: λ 4 = v f 1 (1) 4 Since we have found the TxCode with the receiver module we can connect our second Arduino setup with the transmitter module and install the TX library. At this point you will write a simple loop program that turns the switch on/off continuously. With some analysis of the code you should be able to figure out how the TxCode can be abused so that we can control the switch with our own, home-built remote. Connect the switch to a 230V outlet in the wall and check if you can get the switch to turn on and off. 5.2 Testing Assignment 2 Compile and download the code and let it run on your Arduino. Likely nothing happens in your switch! If it does your are lucky, if not you may have to modify your controlling program so the controlling process can be carried out. Implement a (loop) program that one can use to make the switch blink on/off. Before calling help: If nothing works check your wiring. You can test your Arduino with a simple test program that switches the led on and off in a slow pace. If this test program does not work consult your assistant. He/She can verify both the Arduino and the TX module. 8

9 A secure Proove Assignment 3 Replace your loop program with the TestLoop loop program in TX.ino and make this run on your system. Convince yourself that your system works and switch it off to reduce the interference you might cause to other groups. Call the laboratory assistant and show him/her that your system works with this test loop. When that is done switch your transmitter off again. 6 Reflections By now you should have gotten an insight on how the system works. Let us consider its security. What we don t want is that unauthorized people can control our switch. Assignment 4 Answer the following questions: 1. What is the probability that a command with a randomly chosen TxCode will be accepted by a given switch (receiver) unit? 2. Why is the probability you computed not meaningful from a security point of view? 3. Describe a way to attack the system other than what we have done, by monitoring signals. 7 A secure Proove Obviously, if one wants a more secure solution we have to modify the system. To protect against unauthorized people sending false data to a receiving switch one could use an authentication code (MAC) or encryption. Assignment 5 Describe the advantages and disadvantages of authentication versus encryption in our system. If we modify the transmitter to a more secure version with either MAC or encryption we will face a problem. The problem will occur in the switch, since we cannot reprogram the receiver in the switch to handle MAC or encryption. Hence we will have to use our own receiver that we have built from now on. Assignment 6 Answer the following questions: 1. How many bits for a MAC are needed if you want the probability of impersonating a valid transmitter to be not more than 2 32? 2. Why is a stream cipher not a good solution for encryption? 3. Implement an encryption and decryption routine and integrate it into your solution and verify that it works. 1 In the laboratory it is easy to program required keys in the receiver and in the transmitter. 9

10 Arduino environment Assignment 7 Answer the following questions: 1. If one uses symmetric key encryption, how could one in a real-life system do the key provisioning from a transmitter to a receiver? 2. If using a asymmetric (public-key) cryptography how you would do then?. Make the necessary modifications to the sending and receiving program to make the command transmission secure. Show the working sender and receiver for your secured setup to the assistant for approval. 8 Arduino environment We use two Arduino controllers that we program from a lab PC. Both controllers are connected at the same time to the Lab PC using a USB cable. Hence the PC must have two USB ports. Each IDE environment uses a different TTY interface that you must select in the IDE. The PC communicates with the Arduino via a serial TTY interface running over USB. There is one environment for the controller connected to at TX module and one controller connected to the RX module. The modules are placed on separate breadboards that are connected to the two Arduino controllers. The Arduino IDE environment should already be installed on your lab PC. So do not do that again. If this laboratory is the first time you work with an Arduino and its development environment it is good that you first watch some of the tutorials on Youtube to get a quick introduction, e.g. youtube.com/watch?v=fcxza9_kg6s or For more guidance on the use the Arduino environment look at [2]. We will use the Arduino UNO V3 controller for which the Pin assignments are shown in Figure 7. We power the Arduino units via the USB so no external power source is needed. More information on the Arduino Uno controller can be found at [3]. 8.1 Tracing output You can start window where you can see the output of your Arduino program. Look at Figure 5 how to start this window. Remark: the Serial.print uses interrupts to write to the serial interface connected Figure 5: Start of serial monitor. 10

11 REFERENCES to the USB. This means that in the TRX sketch where we use interupts in the receiver and transmitter we have to be careful in the handling of the interrupts if we also want to write to the serial interface. 9 Receiver and Transmitter module We use receiver module (RX) and a transmitter module (TX) for AM modulated transmission on 433MHZ. The data sheets are available via the course web. Both modules can be operated at 5V. The Pin assignments of both modules are in the data sheets and are given in Fig 6. Hence we use simple 5v supply source on the Arduino boards to power the TX and RX modules. The RX module is insensitive for the voltage that is actually delivered by the Arduino via the USB cable from the PC. The receiver is rather critical and must have an operating voltage of at least 4.9 volt and not more than 5.1 volt. Use separate antennas. Sharing a single antenna requires a special construction such as a duplexer Figure 6: Pin assignments of the transmitter (TX) and receiver (RX) modules. The modules need an antenna. We use here a simple wire of λ/4 of the wavelength λ which is given by c/f, where c is the speed of light and f is the frequency which is 433Mhz. A shorter antenna will work too since we will not try to bridge long distances between the receiver and transmitter. Now working with the receiver is tricky in a laboratory environment where other groups are working at the same time and have their transmitters on. There will be a lot of interference that causes problems. So be warned. When wiring the modules note the correct pin assignments when connecting the supply and GND pins and that VCC is +5V. 10 What to do when it doesn t work In the first place check the wiring. If you suspect that a module is not working use the instructions you find on the course web, projekt. Follow the steps and check with your laboratory assistant how to proceed. References [1] Joakim Wesslen, Home Automation and RF Protocols, home-automation-rf-protocols, last accessed on [2] Arduino Home Page, Getting Started with Arduino and Genuino products, arduino.cc/en/guide/homepage, last accessed on [3] Arduino Home Page, Arduino UNOv3 Board Overview, ArduinoBoardUno, last accessed on

12 A receiver and transmitter using one Arduino 11 A receiver and transmitter using one Arduino If you are interested you can also play around with a setup where we use only one Arduino to transmit and receiver control signals, a socalled transceiver. This is found as the TRX sketch solution. It uses pin13 to transmit and PIN 8 to receiver in the same manner as before when we had one Arduino for the receiver and one for the transmitter. The design here is much more trickier and maybe hard to understand as it uses interrupts on timers and inputs. Using such a solution we can make a simple repeater (range extender). The sketch has been verified to work on a Telldus Net with a Proove switch. 12

13 A receiver and transmitter using one Arduino Figure 7: Pin assignments Arduino Uno V3. 13

14 Approval sheet 12 Approval sheet On this sheet your assistant will sign-off that you did the necessary preparations prior to the start of the project in the laboratory rooms. You are NOT allowed to switch the equipment on before he/she has checked this and gives an OK to proceed. The assistant also checks and records on this sheet if you got your implementations properly working. SCAN this page and include the scan of your group s approval sheet in your report. Date: Your name 1: Your name 2: Item Approved Circuit drawing of TX and coupling to Arduino 1... Circuit drawing of RX and coupling to Arduino 2... TX circuit working against switch... RX circuit working against TX... TX and RX circuits working with protected transmission... 14