GTU 3171108 Internet of Things Summer 2026 Solved Paper & Solutions

Internet of Things (IoT) is a network of physical objects (things) fitted with sensors, actuators, software and network connectivity, which collect and exchange data over the Internet and act on it, with little or no human help.

Four characteristics:

1. Connectivity: every device is connected to the Internet or a local network.
2. Sensing: devices sense the physical world (temperature, motion, light) and produce data.
3. Unique identity: each thing has a unique address, such as an IP or MAC address.
4. Intelligence and automation: data is analysed, and devices act on their own, for example turning on a fan when it gets hot.

Others: scalability and heterogeneity.

So M2M is a subset of IoT: IoT extends M2M with the Internet, the cloud and analytics.

End-to-end IoT architecture shows how data travels from a physical thing to the user and how commands travel back. It is commonly described in four layers (stages).

1. Perception (device) layer

• Has the sensors that measure physical quantities (temperature, humidity, motion, light) and the actuators that act (motors, relays, valves).
• A microcontroller (Arduino, ESP8266, ESP32) reads the sensors, converts the analog signals to digital data and drives the actuators.

2. Network (gateway) layer

• Carries data from the devices to the cloud.
• Short-range links: Wi-Fi, Bluetooth Low Energy, Zigbee. Long-range links: LoRaWAN, NB-IoT, LTE, 5G.
• An IoT gateway collects data from many local devices, converts protocols, filters data and forwards it securely over the Internet. It can also do edge computing, processing data close to the source to cut delay.

3. Processing (cloud and middleware) layer

• The cloud platform (AWS IoT, Azure IoT, ThingSpeak, Firebase) stores the data in databases.
• It processes and analyses the data, runs rules and machine learning, and sends commands back.
• It manages devices: registration, authentication and firmware updates.

4. Application layer

• Gives the user a service: a mobile app, web dashboard, alerts and reports.
• Examples: smart home control, smart agriculture, health monitoring, smart city.

Security across all layers

Authentication, encryption (TLS), access control and secure updates are needed at every layer, because an attack at any point can affect the whole system.

Example flow

A soil moisture sensor sends a reading through Wi-Fi to the cloud. The cloud sees the soil is dry and sends a command. The gateway forwards it, and a relay switches on the water pump. The farmer sees the status on a phone app.

A sensor turns a physical quantity into an electrical signal. An actuator turns an electrical signal into a physical action.

NodeMCU is a low-cost, open-source IoT development board built around the ESP8266 Wi-Fi microcontroller (ESP-12E module).

Main features:

• 32-bit Tensilica processor running at 80 to 160 MHz, with about 4 MB flash memory.
• Built-in Wi-Fi (802.11 b/g/n), so no separate network module is needed.
• About 11 digital GPIO pins (with PWM, I2C, SPI and UART) and one analog input (A0).
• USB port for power and programming. Works at 3.3 V.
• Programmed with the Arduino IDE (C/C++), Lua or MicroPython.

Role in IoT implementation:

1. Reads sensors connected to its pins, such as DHT11 or an LDR.
2. Connects to Wi-Fi and sends the data to a cloud platform (ThingSpeak, Blynk, Firebase) using HTTP or MQTT.
3. Receives commands from the cloud or a phone app and drives actuators (relays, LEDs, motors).
4. Can run a small web server, so a device can be controlled from a browser on the same network.

It is cheap, small and easy to program, so it is widely used for smart home, weather station and monitoring projects.

Reading sensor data and sending it to the cloud is the most basic IoT task. The steps are the same on any platform. Here, a NodeMCU reads a DHT11 temperature and humidity sensor and sends the data to ThingSpeak (a cloud platform).

Step 1: Connect the sensor

The DHT11 has three pins: VCC to 3.3 V, GND to ground and DATA to a digital pin (D4).

Step 2: Set up the cloud

Create a channel on ThingSpeak with two fields (temperature, humidity). The platform gives a Write API key, which identifies and authorises the device.

Step 3: Program the board

How it works

1. Read: the board reads the temperature and humidity from the sensor.
2. Connect: it joins the Wi-Fi network, then opens a connection to the cloud server.
3. Format and send: the readings are put in a request with the API key and sent using HTTP (as above) or MQTT (publish to a topic).
4. Store: the cloud saves each reading with a time stamp in its database.
5. Visualise and act: the cloud draws graphs and can trigger alerts or actions when a value crosses a limit.
6. Repeat: the loop runs every 20 seconds (ThingSpeak's free plan accepts one update every 15 seconds).

Points to note

• Use MQTT for frequent, small messages, as it uses less bandwidth and power.
• Use TLS (HTTPS or MQTTS) and keep keys secret, to stop others from sending fake data.
• If the network fails, the device can store readings and send them later.

Transport layer protocols:

1. TCP: connection oriented and reliable. Used by MQTT and HTTP.
2. UDP: connectionless, fast and light. Used by CoAP.
3. DTLS / TLS: add security over UDP and TCP.

Application layer protocols:

1. MQTT: publish and subscribe messaging through a broker.
2. CoAP: a light, REST-style protocol for constrained devices.
3. HTTP / XMPP / AMQP: web requests, real-time messaging and reliable queues.

MQTT (Message Queuing Telemetry Transport) is a lightweight publish and subscribe messaging protocol for devices with little power, memory and bandwidth. It runs over TCP (port 1883, or 8883 with TLS).

Working:

1. Clients connect to a central broker (such as Mosquitto or HiveMQ).
2. A publisher sends a message on a topic, such as home/temp.
3. Subscribers that asked for that topic receive the message from the broker. The publisher and the subscribers never talk directly.

Features:

• Small header, only 2 bytes, so little bandwidth.
• Quality of Service: QoS 0 (at most once), QoS 1 (at least once), QoS 2 (exactly once).
• Retained messages: the broker keeps the last message for new subscribers.
• Last Will and Testament: the broker tells others if a client disconnects suddenly.
• Keep alive messages and persistent sessions.
• Security with username, password and TLS.

CoAP (Constrained Application Protocol) and HTTP (Hypertext Transfer Protocol) are both request and response, REST-style protocols using methods such as GET, POST, PUT and DELETE. CoAP was designed by the IETF as a light version of HTTP for small, battery-powered devices.

Comparison

Message types in CoAP

1. Confirmable (CON): needs an acknowledgement; it is resent if lost.
2. Non-confirmable (NON): sent without acknowledgement, for repeated readings.
3. Acknowledgement (ACK): confirms a CON message.
4. Reset (RST): shows that a message could not be handled.

Which to use

• CoAP is better for small, battery-powered devices on low-bandwidth networks, because it uses less power and data.
• HTTP is better for gateways, servers and web integration, where power and bandwidth are not limited and every browser and server understands it.
• A CoAP-to-HTTP proxy at the gateway lets a CoAP sensor network talk to normal web services.

Major security concerns in IoT networks:

1. Weak authentication: default or weak passwords let attackers take control (the Mirai botnet used this).
2. Unencrypted data: data sent in plain text can be read or changed (eavesdropping, man-in-the-middle).
3. No firmware updates: known bugs stay open for years.
4. Botnets and DDoS: hacked devices are used to attack servers.
5. Physical tampering: devices in open places can be stolen or opened.
6. Privacy leaks: personal data such as location and health is exposed.
7. Insecure APIs and cloud interfaces.

Key management is the creation, distribution, storage, use, renewal and removal of the cryptographic keys that IoT devices use to encrypt data and prove their identity.

Why it matters: encryption is only as strong as its keys. If a key is stolen or shared by all devices, the attacker can read data or pose as a device.

Role in IoT security:

1. Key generation: strong random keys (symmetric, such as AES, or public/private pairs, such as RSA or ECC).
2. Key distribution: keys or certificates are placed in the device safely, during manufacture or through a secure protocol (such as TLS handshake, Diffie-Hellman).
3. Secure storage: keys are kept in a secure element, TPM or trusted execution area, not in plain memory.
4. Authentication: devices use their keys or certificates to prove who they are to the gateway and cloud.
5. Key renewal (rotation): keys are changed regularly, to limit damage if one leaks.
6. Revocation: keys of stolen or retired devices are cancelled.

IoT devices have little memory and power, so light methods such as ECC and pre-shared keys are often used.

IoT systems face many security problems. Three main challenges and their solutions are given below.

Challenge 1: Weak authentication and access control

Problem:

• Many devices ship with default passwords (such as admin/admin), which users never change.
• Some devices have no proper authentication at all.
• Attackers scan the Internet, log in and take control. The Mirai botnet (2016) took over about 600,000 cameras and routers this way and used them for huge DDoS attacks.

Solutions:

• Force a unique password at first setup, and block repeated wrong logins.
• Use certificates or keys for device authentication, not passwords alone.
• Use multi-factor authentication for user apps.
• Apply role-based access control, so each user or service gets only the access it needs.

Challenge 2: Insecure communication (data in transit)

Problem:

• Small devices often send data in plain text because encryption needs processing power.
• Attackers can eavesdrop, change data (man-in-the-middle) or replay old commands, for example to unlock a smart lock.

Solutions:

• Encrypt all traffic with TLS (for TCP, such as MQTT and HTTP) or DTLS (for UDP, such as CoAP).
• Use lightweight cryptography such as AES-128 and ECC, which suit small devices.
• Add message authentication codes, time stamps or counters to stop replay attacks.
• Use VPNs or private networks for critical systems.

Challenge 3: Lack of updates and software flaws

Problem:

• Devices are often never updated after sale. Known bugs stay open.
• Updates sent without checks can be faked, so attackers install malicious firmware.
• Devices may live 10 years or more in the field.

Solutions:

• Provide secure over-the-air (OTA) updates that are digitally signed and checked by the device before installing.
• Use secure boot, so the device runs only signed firmware.
• Have a clear update policy and support period from the maker.
• Monitor devices for unusual behaviour and patch quickly.

Other challenges

Physical tampering, privacy of personal data, insecure cloud APIs and the huge variety of devices also need care. Security by design, built in from the start, is the best approach.

Three real-life applications of Consumer IoT:

1. Smart home: smart lights, plugs, thermostats, door locks and cameras controlled from a phone or by voice (Alexa, Google Home).
2. Wearables: smart watches and fitness bands that track steps, heart rate and sleep and sync with a phone app.
3. Smart appliances: refrigerators, washing machines and air conditioners that can be started, monitored or diagnosed remotely.

Others include smart TVs, voice assistants and connected pet trackers.

Industrial IoT (IIoT) is the use of IoT in industry: sensors, machines, controllers and software in factories, plants and utilities are connected, so that data can be collected and analysed to improve productivity, safety and maintenance. It is a key part of Industry 4.0.

Main features: high reliability, real-time data, rugged devices, and protocols such as OPC UA, Modbus, MQTT and industrial Ethernet.

Use case: predictive maintenance of a motor in a factory

1. Sensors on the motor measure vibration, temperature and current all the time.
2. An edge gateway collects the data and sends it to the cloud or a local server.
3. Analytics or machine learning compare the readings with normal patterns. A rise in vibration shows bearing wear.
4. The system alerts the maintenance team, and the part is replaced before the motor fails.

Benefits: less unplanned downtime, lower repair cost, longer machine life and better safety.

Other uses: asset tracking, energy monitoring, quality control and remote monitoring of pipelines.

Case study: IoT in a smart city

A smart city uses IoT sensors, networks and data analytics to manage city services (traffic, water, power, waste, safety) efficiently and improve the quality of life of citizens. India's Smart Cities Mission includes cities such as Surat, Ahmedabad, Pune and Bhubaneswar.

Architecture

Main smart city services

1. Smart traffic management

• Cameras and sensors at junctions count vehicles.
• Adaptive traffic signals change their timing based on real traffic, which cuts waiting time.
• Smart parking sensors show free spaces on an app.

2. Smart street lighting

• LED lights with sensors dim when no one is around and brighten when people or vehicles pass.
• Faults are reported automatically. Energy savings of 40 to 60 percent are common.

3. Smart waste management

• Fill level sensors in dustbins tell the system when a bin is full.
• Trucks follow optimised routes and empty only full bins, which saves fuel and keeps streets clean.

4. Smart water supply

• Smart meters and pressure sensors find leaks and measure use.
• Water quality sensors check pH and turbidity.

5. Public safety and surveillance

• CCTV with video analytics, emergency call boxes and flood and fire sensors give quick alerts to police and disaster teams.

6. Environment monitoring

• Air quality sensors measure PM2.5, CO2 and noise, and show the levels on public displays.

Integrated Command and Control Centre (ICCC)

All the data comes to one command centre, where officials see live dashboards, coordinate departments and respond to events. Many Indian smart cities run an ICCC.

Benefits

1. Less traffic congestion and pollution.
2. Savings in energy, water and fuel.
3. Faster emergency response and better safety.
4. Data-driven planning and better citizen services.

Challenges

• High cost of setup and maintenance.
• Security and privacy of the huge amount of citizen data.
• Interoperability of devices from many vendors.
• Need for reliable power and network coverage.