Security considerations for IEEE 802.15.4 networks

TLDR

IEEE 802.15.4 defines low‑power wireless radios for personal area networks and sensor nodes and incorporates a range of security provisions and options. The paper seeks to expose design pitfalls in 802.15.4 that compromise security and to advise implementors to avoid insecure optional features and improve the specification. The authors analyze the 802.15.4 specification and security API, pinpointing problematic extensions and proposing specification changes to reduce insecure deployments. The study shows that certain optional features in 802.15.4 weaken security, and recommends that implementors disable them.

Abstract

The IEEE 802.15.4 specification outlines a new class of wireless radios and protocols targeted at low power devices, personal area networks, and sensor nodes. The specification includes a number of security provisions and options. In this paper, we highlight places where application designers and radio designers should exercise care when implementing and using 802.15.4 devices. Specifically, some of the 802.15.4 optional features actually reduce security, so we urge implementors to ignore those extensions. We highlight difficulties in safely using the security API and provide recommendations on how to change the specification to make it less likely that people will deploy devices with poor security configurations.