Rchain ARM power user router project (discussion)

[vkhansen]

This is a project I have been conceptualizing and wish to open up to community input and participation with the goal of turning it into an opensource product:

Summary:

Goal is to run Rchain node on high powered ARM openWRT routers and eventually control the routers configuration via Rchain DAG and smartphone/wallet app. (close all ports and management interfaces) Envisioned as way to promote the platform, and increase IoT security etc.

Project will build on work by kayvank who already ran a node on ARM based PI:

https://github.com/kayvank/rchain-node-bin

See DRAFT slides: https://docs.google.com/presentation/d/1ybN6LbMfDmpxaoJWTCkDAhgGTlYnyd4KUtraysi3ooE/edit?usp=sharing

Specific:

Obtain sample routers/embedded boards from Compex (100$- $350+~$50 shipping) for interested developers (Approxx. 3-5 people?)

https://www.compex.com.sg/product/mmt865hv/ http://shop.compex.com.sg/4x4-mmt865hv.html http://shop.compex.com.sg/wpq865.html

See also lower cost boards for initial development: https://www.compex.com.sg/product/wpj419/ http://shop.compex.com.sg/wpj419.html https://www.compex.com.sg/product/wpj428/ https://techship.com/products/compex-wpj428hv-embedded-board/

• Develop a basic default/development configuration running OpenWRT, router would be designed to start Rnode automatically and turn on basic services (minimalist). (Router is shipped with CompexWRT)

• Design and prototype a more interesting yet low cost router case which can mount multiple high gain or directional antennas instead of the beige case with internal “flatenna”. A sealed outdoor case is also needed.

• Develop a secure version wherein the router has no open management interfaces and can only be configured via Rchain/Rholang channels within the “Rrouter” namespace.

• Develop a library of basic whitelisted pre-configuration profiles (i.e. AP, Bridge, Mesh, NIDS, Secure Rnode only) specific to the mmt865hv hardware.

• Implement distributed DNS solution

• Develop a way to update and verify against whitelist router firmware via Rnode/Rchain

• Develop simple/secure way to configure router potentially with smartphone interface, allows /Dapp’s and namespaces to be toggled via simple control interface.

• Reach goal; Develop provably secure means of remote attestation of the router’s whitelisted firmware and configuration:

  • i.e. hashing firmware/ OS files at various layers (See example for windows hosts: https://docs.microsoft.com/en-us/sysinternals/downloads/rootkit-revealer)
  • Question: how can it be determined/proven if the whitelisted files are really being tested/hashed on the router and not within a simulation to get the right answers when the router is in fact compromised.

• Answer: Ref 1: https://www.semanticscholar.org/paper/Mobile-Malware-%3A-Why-the-Traditional-AV-Paradigm-is-Jakobsson-Stewart/4194e4f5fccaac653f00ebb80f51f01e6c7fd80a Ref 2:https://eprint.iacr.org/2018/031.pdf

Measurable:

Progress measured in ability to configure and interface with router within Rchain channels, specific goals would be:

• Reach at point when traditional management interfaces (SSH,HTTPS) can be turned off and only handled through rchain channels.
• Showing a significant number of useful tested configurations via this method for different router applications.
• Show solutions to reach goals, or other novel yet undiscovered use cases/applications.

Achievable:

Running Rnode on ARM is already shown to be possible (as it should be since Java is used), nothing about this project is fundamentally impossible but requires generating and testing device specific firmware’s.

Relevant:

Relevant in that it provides numerous security advantages/improvements, to router and IoT/Wifi device security, shows Rchain being used in a real world physical setting. Provides a secure and low cost platform to quickly deploy rnode’s where they are needed.

Time-bound:

3-6 month project to show key results. Possible follow on projects from reach goals.

Total projected budget: Hardware (10 routers) = $400 10 = $4,000 (Budget 2x for bricked devices) 5 Developers 50% time for 6 months = $2,200 5 * 6 = $66,000

Legal

Task Submitter shall not submit Tasks that will involve RHOC being transacted in any manner that (i) jeopardizes RHOC’s status as a software access token or other relevant and applicable description of the RHOC as an “asset”—not a security— or (2) violates, in any manner, applicable U.S. Securities laws.

[allancto]

@vkhansen interesting proposal. What's the rationale for entire router rather than just firmware, and why such a high end router?

Thanks! -@allancto

[vkhansen]

@allancto, Good point, I updated the proposal to include the WPJ428 and WPJ419 as a starting point.

We are interested in the WPQ865/MMT865HV for the final product as the high end market was identified as the type of user who would be most likely to want these features but that doesn't meant the lower cost boards could not be used for initial testing and development.

Once we get to building firmware white-lists using the same chipsets would become important, (IPQ8065 - WPQ865) vs (IPQ4019 - WPJ419 & IPQ4028 - WPJ428)

The WPJ419 has an SD card slot which could be helpful.

-@vkhansen

[ddayan]

@vkhansen will you be at RCon3? I planning to ask pyrofex some questions about the feasibility of iot nodes. Yes we can run it on a pi but it's just a hack and probably would not be useable on mainnet (or even testnet). The main concerns I have are RAM and storage requirements.

[vkhansen]

@ddayan @allancto

Regrettably I will not be at Rcon3 unless I were to get some kind of last-minute scholarship as I cannot afford the travel costs.

Yes, the Pi implementation is interesting and serves as a baseline of sorts, however limited and unstable.

The performance issues were part of the reason why we anticipated actual applications would need to target the larger router w/ its dual-core 1.7 Ghz ARM, which has 1 GB of ram and additional storage possible via USB.

I visited compex Singapore headquarters in July and as they are an OEM they can fabricate whatever we need, i.e increasing ram capacity and hard drive expansion options if this becomes an official project.

[ddayan]

I thought the idea was to get it to run in commercial routers. I’ll try to get some info next week and I’ll share it here.