Security research

Strengthening security in IoT platforms

The rapid growth of the Internet of Things has brought countless benefits in automation, efficiency and data-driven decision-making. However, this progress has also exposed IoT systems to critical vulnerabilities, especially concerning communication protocols.

At Thinger.io, security is a priority, which is why we apply rigorous testing and methodologies to ensure the robustness of our platform. Recently, we had the opportunity to present an academic paper addressing the security techniques we implement to evaluate and reinforce our communication protocols. It was presented at the 1st International Workshop on IoT for Safety-Critical Cyber-Physical Systems, part of the 14th International Conference on the Internet of Things (IoT 2024), Oulu, Finland.

In this study, we analyse approaches such as fuzz testing, guided testing, symbolic execution and formal verification, among others, which have allowed us to identify and mitigate potential vulnerabilities in protocols like WebSockets, MQTT and IOTMP.

The paper

Paper
Vulnerability Analysis of IoT Platforms: A Case Study on Thinger.io
Authors
Alvaro L. Bustamante (Thinger.io), Miguel A. Patricio and José M. Molina (Universidad Carlos III de Madrid)
Workshop
1st International Workshop on IoT for Safety-Critical Cyber-Physical Systems
Conference
14th International Conference on the Internet of Things (IoT 2024), Oulu, Finland
Protocols analysed
WebSocketsMQTTIOTMP
Published
ACM, doi 10.1145/3703790.3703821

Presented at IoT 2024, November 19-22, 2024, in Oulu, Finland.

The methods

Key techniques for IoT security

In our research, we highlight several essential methods for evaluating and improving the security of IoT platforms.

Fuzz testing

A testing method that sends random or malformed inputs to systems to detect processing failures.

Guided testing

Tests designed from specific knowledge of the protocol, allowing a more precise evaluation of its vulnerabilities.

Symbolic execution

An approach that analyses all possible execution paths of a program, identifying potential errors before they occur.

Formal verification

A mathematical method that ensures protocols comply with their security specifications.

Thanks to the application of these methodologies, we have been able to strengthen the security of our platform.

First page of the paper "Vulnerability Analysis of IoT Platforms: A Case Study on Thinger.io", with the authors, the abstract, the keywords and the introduction
Abstract and introduction
A page of the paper with the case study of the Thinger.io platform: the list of supported protocols and Figure 1, an overview of the platform architecture
Case study: the Thinger.io platform
Two pages of the paper: the abstract, and the case study of the Thinger.io platform with its architecture.

For the community

A useful guide for other IoT platforms

The paper not only documents our experience in applying security techniques: it also serves as a useful guide for other developers and companies looking to enhance the protection of their own IoT platforms.

Our commitment to security remains strong, and we continue conducting periodic audits, implementing continuous improvements and exploring new strategies to stay at the forefront in this field.

If you are interested in learning more about the techniques and tests we employ at Thinger.io, we invite you to read the full academic paper, where we detail our security strategies and how they can be applied to other IoT projects.

Update, 2026: Thinger.io is now ISO/IEC 27001:2022 certified, a certification that covers the whole organization and the processes behind the platform. How the platform protects identities, devices and operations is on the Security page.

We welcome your feedback to keep improving together on Discord.

We remain committed to a safer IoT for everyone.

Help us keep improving

Questions about the paper or about how we test our protocols: our team and other users are on Discord.

Share your feedback on DiscordSecurity at Thinger.io