# A Secure Internet of Things Smart Home Network: Design and Configuration
## 4 Demonstration
### Discussions  
The home gateway is the most important network entity in a home network. It is responsible for monitoring all safety aspects in both inbound and outbound traffic of the network. It controls all the Wi-Fi enabled home devices such as smart phones, tablets, laptops, etc. in accessing the Wi-Fi network. If some unauthorized user gains access through the home gateway, the home network and the associated home devices can be easily compromised. It is, therefore, essential to keep the home gateway as secure as possible without losing its intended functionality.  
Unfortunately, not all home network users assume adequate security posture in this respect. They just rely on the bare minimum home network security provided by the Wi-Fi Access 2 (WPA2) security with the requirement of a password to restrict access to the home gateway. Currently, many home gateways are equipped with low-level software called firmware which controls their operations. However, the firmware sets the security by defining only the standard rules for home networks. In addition, users must manually keep the firmware up to date by installing security patches, a process that varies depending on the given home gateway. Another feature designed to make easy remote access from  
Figure 17: Average end-to-end delay between IoT server and web server.  
external networks to the home gateway is the Universal Plug and Play (UPnP), which operates with a turn on/off mode. However, if it is set to the off position, the user cannot access the home gateway even with admin-level access. Moreover, the UPnP can also be used by a malware program to compromise security settings of the home gateway.  
Even though many home gateways are now equipped with the above-mentioned security features and reflects the importance placed on security and reliability in home networks, there are still many important security settings that require end user intervention and customization for their target home networks to achieve adequate security. We define four goals for such customization and configuration and demonstrate the goals achieved with the proposed secure configuration. Since IoT services in a home network involve HTTP as well as MQTT with no built-in security features, our proposed configuration supports both the HTTP server and the MQTT broker. We also claim that one of the highest risks to a home network is that the network itself can be compromised by trusted network entities within the home network. For example, once an attacker gains access to a smart phone or laptop, the home network can be easily compromised through the opened entry point of the trusted network entity. To cope with this, we logically isolate the IoT-subnet from other networks and control access at the home gateway with NAT/PAT and ACL configuration.  
For the home network performance in terms of Quality of Service (QoS), network latency among the network entities within a home network can be a critical metric. The proposed secure configuration will not bother to provide seamless IoT services with latency issue because (1) most of the IoT devices are equipped with a micro-controller with a built-in high-speed Wi-Fi enabled module ESP8266, and (2) various delays such as transmission delay, propagation delay, processing delay, and queuing delay contributing to user-experienced latency are not significant when we consider home network environments including improved bandwidth, physical transmission distance, processing speed and experienced level of congestion of the home gateway.