Two-Factor Commissioning for Thread Protocol

Thread is a wireless protocol built based on the IEEE 802.15.4 standard to enable IPv6-based, low-power, and reliable mesh topology for IoT systems. Thread commissioning allows new IoT devices to join the network by validating their credentials. Security of the commissioning process is crucial because it is the gateway to entering the Thread network. Its vulnerabilities could affect the entire IoT system and cause physical and financial damage. Literature review and vulnerability assessments point to the possible security risks on commissioning, such as credentials leakage, password-guessing attacks, and infringement of counterfeit devices through Datagram Transport Layer Security (DTLS) handshake. To mitigate the security threats, we proposed QR code encryption and additional layers of authentication with one-time random keys and login attempts controller in commissioning. The proposed solutions were analysed with different security test cases and proved that they could restrict the counterfeit devices from establishing DTLS communication and slow down password-guessing attacks.