# H2O: Secure Interactions in IoT via Behavioral Fingerprinting
###### Abstract
Also in the field of human-to-human communications, the problem of fake identities and identity theft are issues whose relevance is increasing, especially in the social network domain [19]. Researchers often refer to this branch of security as trust and reputation management, essential for establishing an efficient collaboration among a network of participants that might not have sufficient prior knowledge about each other [20]. Due to these intrinsic differences of IoT entities, an effective method to provide objects and humans with the possibility to continuously and unobtrusively authenticate each others in the network is a demanding task and, to the best of our knowledge, a unique approach for all the entities to assess the reliability of an object or a person owning an object has not been found yet. To tackle the above issues, we designed a complete framework, called H2O (Human To Object). The environment of our system is a classical IoT network, where persons interact with objects (with low or high computational capabilities) to exchange information or get services. The IoT network can be divided in some subgroups, namely the \(PAN\) (the personal area network of a user, composed of all the objects owned by the user himself) and the \(PU\) (the set of smart public things). Moreover, the objects can be divided also according to their computational capabilities. All the objects of the network have a profile describing what they usually do (how they interact with the environment) and some patterns of communication (both with other objects and humans). The recent scientific literature in the context of IoT contains several approaches to computing behavioral fingerprints [8; 21; 22; 23]. Fingerprint is used to analyze the current behavior of an object and to assess whether it is congruent with the expected one. Moreover, our approach is collaborative, hence if a node wants to create a new relationship with another one for which it has no fingerprint, it can rely on the knowledge of its neighbors. In particular, it can query its peers to receive information about the new node. According to _(i)_ the number of answers received from them, _(ii)_ the expressed opinions, and _(iii)_ the relationship the querying node has with each of them, a reliability assessment towards the unknown node can be performed. Following this evaluation, the node can decide whether to interact or not with the new node. In our approach, also human-to-human interactions can be certified with a certain degree of reliability. This step is performed through continuous authentication techniques an object can provide to its owner. Therefore, when a human wants to interact with a person he has never met before, at the start of the communication, he will need some evidence of his identity. This proof can be produced by the objects held by the second person. Moreover, the objects belonging to a \(PAN\) can cooperate to provide a score for their owner in case of need. Indeed, if an object is not equipped with a way to authenticate its owner through a biometric mechanism, it can rely on the members of the \(PAN\) network it belongs to. Of course, the reliability of the object, providing the information about its owner identity, can be assessed through the aforementioned object-to-object solution. Therefore, in our approach, the intrinsic heterogeneity of a IoT network turns out to be a strength rather than a limitation, and it can be exploited to find a homogeneous solution to certify the real identity of a network entity. In summary, we can list the main contributions and the novelty of our approach as follows:  
* we provide a unified network, called H2O, in which each entity, either an object or a human, can estimate the reliability of its/his contacts. * we provide an approach leveraging state-of-the-art behavioral fingerprint techniques allowing an object to assess if another one (which it usually interacts with) has been hacked or is corrupted, before starting a communication.