Internet of Things (IoT)
When everyday objects gained internet connectivity, they became 'smart.' IoT encompasses billions of sensors, actuators
What Makes Something an IoT Device?
An IoT device is a physical object with sensors, processing capability, software, and some form of connectivity that allows it to collect and exchange data over a network. Unlike general-purpose computers, IoT devices are typically designed for specific functions — monitoring temperature, tracking inventory, or automating lighting. They range from simple temperature sensors that transmit a single reading every hour to complex industrial robots that stream real-time telemetry and accept remote commands.
The defining characteristic of IoT is the cyber-physical loop: the device senses the physical world, transmits data to a network, receives decisions (either from a human, cloud analytics, or edge computing), and acts back on the physical world through actuators. This loop operates autonomously in most deployments — millions of sensors transmit data without human intervention.
IoT Architecture Layers
A typical IoT deployment follows a four-layer architecture:
- Perception Layer: Sensors and actuators that interface with the physical world — temperature sensors, accelerometers, GPS modules, motors, valves
- Network Layer: Communication protocols that transmit data — Wi-Fi, LoRaWAN, NB-IoT, Bluetooth, Zigbee, Thread
- Edge/Fog Layer: Local processing that filters, aggregates, and acts on data before it reaches the cloud — reducing latency and bandwidth
- Cloud/Application Layer: Centralized platforms for data storage, analytics, visualization, and device management
The edge computing layer has become increasingly important as IoT scales. Processing data locally (on the device or a nearby gateway) reduces round-trip latency from hundreds of milliseconds to single-digit milliseconds — critical for industrial control, autonomous vehicles, and healthcare applications.
Communication Protocols
Short-Range Protocols
- Wi-Fi (802.11): High bandwidth (hundreds of Mbps), power-hungry (~100 mW transmit), ideal for video cameras, speakers, and always-connected devices. Wi-Fi 6 (802.11ax) adds OFDMA for efficient multi-device operation.
- Bluetooth/BLE: Low power (~15 mW transmit), short range (10–100 m), for wearables, beacons, and sensors. BLE Mesh (2017) enables thousands of devices in a mesh network with publish-subscribe messaging.
- Zigbee (IEEE 802.15.4): Mesh networking, 250 kbps at 2.4 GHz, 10–100 m range. Low power, used for smart lighting, home automation. Supports up to 65,000 nodes in a network.
- Z-Wave: Sub-GHz (868/908 MHz), mesh networking, 100 kbps. Designed specifically for home automation — avoids 2.4 GHz interference from Wi-Fi and microwave ovens.
- Thread: IP-based mesh (IEEE 802.15.4), IPv6/6LoWPAN, self-healing mesh with no single point of failure. Used by Google Nest and the Matter standard.
Long-Range (LPWAN) Protocols
- LoRaWAN: Long range (2–15 km urban, 50+ km rural), low power (coin-cell battery for 5–10 years), 0.3–50 kbps. Ideal for agriculture, asset tracking, environmental monitoring.
- NB-IoT: Cellular LPWAN (3GPP Release 13), uses existing LTE infrastructure, 164 dB link budget. SIM-based authentication, carrier-grade reliability. Deployed by major carriers worldwide.
- LoRa vs NB-IoT: LoRa uses unlicensed spectrum (no per-device fees), NB-IoT uses licensed spectrum (SIM-based, carrier-managed). LoRa suits private networks; NB-IoT suits national-scale deployments.
Application-Layer Protocols
- MQTT (Message Queuing Telemetry Transport): Lightweight publish-subscribe protocol over TCP/IP. Designed for constrained devices and low-bandwidth, high-latency networks. Supports QoS levels 0 (at most once), 1 (at least once), and 2 (exactly once). Used by 80%+ of IoT platforms.
- CoAP (Constrained Application Protocol): RESTful protocol over UDP, designed for resource-constrained devices. Uses message confirmability (CON/NON) instead of TCP. Supports observe pattern (server push) and block-wise transfer for large payloads.
- HTTP/REST: Standard web API, but heavy for constrained devices — requires TCP, TLS, and large headers. Used for device-to-cloud communication where bandwidth is not constrained.
- AMQP: Advanced Message Queuing Protocol — enterprise-grade messaging with routing, queuing, and security. Used in industrial IoT and financial systems.
Connectivity Standards Comparison
| Protocol | Range | Data Rate | Power | Best For |
|---|---|---|---|---|
| Wi-Fi 6 | 50–100 m | Up to 9.6 Gbps | High | Video, smart speakers, always-on |
| BLE Mesh | 10–100 m | 1–2 Mbps | Very low | Wearables, beacons, lighting |
| Zigbee | 10–100 m | 250 kbps | Low | Home automation, sensors |
| Thread | 10–30 m | 250 kbps | Low | IP-based smart home (Matter) |
| LoRaWAN | 2–50 km | 0.3–50 kbps | Very low | Agriculture, cities, asset tracking |
| NB-IoT | 1–10 km | ~20 kbps | Low | Utility meters, smart cities |
The Smart Home
Consumer IoT centers on the smart home: thermostats that learn preferences, lights that adjust to occupancy, locks that recognize faces, and voice assistants that control everything. The fragmentation of protocols (Zigbee, Z-Wave, Wi-Fi, Thread, BLE) has been a persistent problem — a Zigbee light switch cannot control a Z-Wave door lock without a hub that speaks both protocols.
The Matter standard (launched 2022) addresses this by providing a unified application layer over Thread, Wi-Fi, and Ethernet. Matter uses IPv6 addressing, supports local control (no cloud dependency), and is backed by Apple, Google, Amazon, and Samsung. A Matter-certified smart plug works with any Matter-compatible hub or voice assistant.
Industrial IoT (IIoT)
Factories, power plants, and logistics systems use IoT for predictive maintenance, process optimization, and safety. IIoT requires:
- Deterministic latency: Sub-millisecond response for control loops (robotics, safety systems)
- Rugged hardware: Operating temperatures of −40°C to +85°C, vibration resistance, IP67 enclosure
- Legacy protocol translation: IIoT gateways convert Modbus, PROFIBUS, DeviceNet, and other industrial protocols to IP
- Cybersecurity: Network segmentation, encryption, and authentication in environments where a breach could cause physical damage
Digital twins — virtual replicas of physical assets — enable simulation and optimization before deploying changes. A digital twin of a turbine can predict bearing failure weeks in advance by comparing sensor data against learned degradation models.
IoT Cloud Platforms
- AWS IoT Core: Managed MQTT/HTTP broker, device shadows (virtual state representation), rules engine for data routing, integration with AWS Lambda and S3. Supports billions of devices.
- Azure IoT Hub: Device provisioning, device twins, direct methods (remote calls), file upload, and integration with Azure Stream Analytics. Supports OPC-UA for industrial protocols.
- Google Cloud IoT: Managed MQTT broker, device registry, Cloud Dataflow for stream processing, and BigQuery integration. Discontinued in 2023 but replaced by partner solutions.
- Private alternatives: ThingsBoard, EMQX (MQTT broker), Mosquitto, and self-hosted platforms for organizations requiring data sovereignty.
Security Challenges
IoT security remains a critical concern. Many devices have limited processing power, cannot be updated, and ship with default passwords. The Mirai botnet (2016) hijacked hundreds of thousands of IoT devices (IP cameras, DVRs, routers) for DDoS attacks, reaching 1.2 Tbps — the largest recorded DDoS at the time.
- Default credentials: Mirai scanned for 61 common username/password combinations. Many devices shipped with "admin/admin" or "root/root"
- No update mechanism: Many IoT devices lack over-the-air (OTA) update capability, leaving vulnerabilities permanently unpatched
- Minimal cryptography: Constrained devices often skip TLS due to processing overhead, transmitting data in plaintext
- Long lifespans: Industrial IoT devices operate for 15–25 years, far exceeding typical software support cycles
The OWASP IoT Top 10 identifies the most critical vulnerabilities: weak passwords, insecure network services, lack of secure update mechanisms, insecure data transfer, and insufficient authentication. Countermeasures include secure boot (verified firmware), hardware security modules (TPM), network segmentation (VLANs for IoT), and zero-trust architecture.
6LoWPAN and IPv6 for IoT
The Internet of Things requires IP addressing, but traditional IPv4 (32-bit, ~4 billion addresses) is insufficient. IPv6(128-bit, 3.4×10³⁸ addresses) provides enough address space for every atom on Earth to have a unique IP. The 6LoWPAN adaptation layer (RFC 4944) enables IPv6 packets to traverse IEEE 802.15.4 low-power wireless networks by compressing the 40-byte IPv6 header down to 2–7 bytes using context-based header compression.
6LoWPAN is the foundation of Thread networking and enables true end-to-end IP connectivity from cloud to sensor. Every device gets a globally unique IPv6 address, eliminating the need for network address translation (NAT) and enabling direct peer-to-peer communication.
Edge Computing for IoT
As IoT scales to billions of devices, sending all data to the cloud becomes impractical. Edge computing processes data locally — on the device, a nearby gateway, or an edge server — reducing latency, bandwidth, and cloud costs.
Typical edge processing includes: filtering (discarding readings within normal ranges), aggregation (computing averages, min/max over time windows), anomaly detection (flagging readings outside learned patterns), and local actuation (turning on a valve immediately when a threshold is exceeded, without waiting for cloud round-trip).
The fog computing model extends edge to intermediate layers between device and cloud — gateways, local servers, and micro-data-centers that provide more processing power than the edge device but less latency than the cloud.