Incentivized Delivery Network of IoT Software Updates Based on Trustless\n Proof-of-Distribution

Abstract

The prevalence of IoT devices makes them an ideal target for attackers. To\nreduce the risk of attacks vendors routinely deliver security updates (patches)\nfor their devices. The delivery of security updates becomes challenging due to\nthe issue of scalability as the number of devices may grow much quicker than\nvendors' distribution systems. Previous studies have suggested a permissionless\nand decentralized blockchain-based network in which nodes can host and deliver\nsecurity updates, thus the addition of new nodes scales out the network.\nHowever, these studies do not provide an incentive for nodes to join the\nnetwork, making it unlikely for nodes to freely contribute their hosting space,\nbandwidth, and computation resources. In this paper, we propose a novel\ndecentralized IoT software update delivery network in which participating nodes\nreferred to as distributors) are compensated by vendors with digital currency\nfor delivering updates to devices. Upon the release of a new security update, a\nvendor will make a commitment to provide digital currency to distributors that\ndeliver the update; the commitment will be made with the use of smart\ncontracts, and hence will be public, binding, and irreversible. The smart\ncontract promises compensation to any distributor that provides\nproof-of-distribution, which is unforgeable proof that a single update was\ndelivered to a single device. A distributor acquires the proof-of-distribution\nby exchanging a security update for a device signature using the Zero-Knowledge\nContingent Payment (ZKCP) trustless data exchange protocol. Eliminating the\nneed for trust between the security update distributor and the security\nconsumer (IoT device) by providing fair compensation, can significantly\nincrease the number of distributors, thus facilitating rapid scale out.\n