TULKAS: desenvolvimento de metodologias e estudo para implementação de segurança em sistemas IoT

• Ano de defesa: 2025
• Autor(a) principal: Costa, Pedro Ramires da Silva Amalfi
• Orientador(a): Schepke, Claudio
• Tipo de documento: Dissertação
• Tipo de acesso: Acesso aberto
• Idioma: por
• Instituição de defesa: Universidade Federal do Pampa
• Programa de Pós-Graduação: Mestrado Profissional em Engenharia de Software
• Departamento: Campus Alegrete
• País: Brasil
• Palavras-chave em Português: Engenharia de software; Internet das coisas; Sistemas de computação - Medidas de segurança; Teste de invasão (Medidas de segurança para computadores); Software engineering; Internet of things; Computer systems - Security measures; Penetration testing (Computer security)
• Área do conhecimento CNPq: CIENCIAS EXATAS E DA TERRA
• Link de acesso: https://repositorio.unipampa.edu.br/handle/123456789/10276

This dissertation presents the threat modeling and security analysis of a small irrigation subsystem based on IoT, focusing on the embedded ESP32 device, connected sensors, and their communication with the edge server (Orange Pi). Developed by the company Tulkas Desenvolvimento, the solution targets small rural producers, particularly in areas with limited connectivity and low technological familiarity. We apply STRIDE and DREAD methodologies specifically to the sensing layer and secure communication via MQTT over TLS to identify critical vulnerabilities and conduct targeted security testing. Based on the results, feasible mitigation strategies were proposed, such as firmware encryption, mutual authentication, and physical protection of the devices. The work also discusses the partial system architecture, hardware and software design decisions, and the challenges of implementing security in rural environments. As in future work, we propose to extend the threat modeling to the entire system, including the cloud infrastructure and user interface.