Jacob Kröger
email: kroeger@tu-berlin.de

Unexpected Inferences from Sensor Data: A Hidden Privacy Threat in the Internet of Things

Keywords: Privacy, Sensors, Internet of Things, Inference Attacks, Information Leaks

A growing number of sensors, embedded in wearables, smart electric meters and other connected devices, is surrounding us and reaching ever deeper into our private lives. While some sensors are commonly regarded as privacysensitive and always require user permission to be activated, others are less protected and less worried about. However, experimental research findings indicate that many seemingly innocuous sensors can be exploited to infer highly sensitive information about people in their vicinity. This paper reviews existing evidence from the literature and discusses potential implications for consumer privacy. Specifically, the analysis reveals that certain insufficiently protected sensors in smart devices allow inferences about users' locations, activities and real identities, as well as about their keyboard and touchscreen inputs. The presented findings call into question the adequacy of current sensor access policies. It is argued that most data captured by smart consumer devices should be classified as highly sensitive by default. An introductory overview of sensors commonly found in these devices is also provided, along with a proposed classification scheme.

Introduction

At the latest since the advent of smartphones, a variety of embedded sensors is constantly surrounding us -whether we are at work, in transit, or even within our own four walls. The emerging Internet of Things (IoT) is predicted to further increase the number of sensors in our everyday environment by many orders of magnitude [START_REF] Evans | The Internet of Things -How the Next Evolution of the Internet Is Changing Everything[END_REF]. New services and business models are enabled through the increasing pervasiveness and interconnection of sensors which promise to bring transformational improvements in many areas including health, safety, security, convenience, productivity and sustainability. At the same time, with sensing technologies reaching ever deeper into people's lives, there is growing concern about potential privacy violations. These concerns need to be addressed before IoT technologies are widely deployed -not only to protect the fundamental right to informational self-determination, but also to foster trust and acceptance among users.

While cameras, microphones and navigation systems like GPS are commonly perceived as privacy-sensitive [START_REF] Hnat | Doorjamb: unobtrusive room-level tracking of people in homes using doorway sensors[END_REF][START_REF] Klasnja | Exploring privacy concerns about personal sensing[END_REF] and require explicit user permission in current mobile operating systems [START_REF] Bai | Sensor Guardian: prevent privacy inference on Android sensors[END_REF], many inconspicuous sensors such as accelerometers, gyroscopes and barometers are less well-understood in terms of their privacy implications, and also less protected [START_REF] Xu | SemaDroid: A Privacy-Aware Sensor Management Framework for Smartphones[END_REF]. Countless embedded sensors in consumer electronics, such as smartphones, smartwatches, and smart home appliances, can be freely accessed by various possibly untrusted parties ranging from device manufacturers [START_REF] Notra | An experimental study of security and privacy risks with emerging household appliances[END_REF] and service providers [START_REF] Yang | Inferring occupancy from opportunistically available sensor data[END_REF] to third-party apps installed on mobile devices [START_REF] Bai | Sensor Guardian: prevent privacy inference on Android sensors[END_REF] and even website operators [START_REF] Bojinov | Mobile device identification via sensor fingerprinting[END_REF].

Numerous studies have shown that highly personal information can be inferred from seemingly innocuous sensor data. Accordingly, an international group of data protection and privacy commissioners argued in the Mauritius Declaration on the Internet of Things that all IoT sensor data should be treated as personal data [START_REF] Kohnstamm | Mauritius Declaration on the Internet of Things[END_REF]. This paper substantiates this view with empirical evidence from the existing literature and illustrates potential implications for consumer privacy.

2

Sensors in IoT Devices

Classification

A wide variety of sensors can be found in consumer IoT devices. Depending on the type of device and its field of application (e.g. home automation, fitness monitoring, gaming), sensor measurements fulfil many different purposes. In the context of IoT consumer privacy, sensors can be meaningfully classified according to the following properties:

Measured Variable. Sensors can be classified based on the specific physical or chemical property they measure (e.g. air pressure, temperature, acceleration), or -in the case of fusion sensors which combine the results of multiple underlying sensors -the computed result they provide (e.g. absolute orientation of a device).

In the privacy context, this seems more accurate and meaningful than the widespread classification of sensors based on their intended purpose. In Android, for instance, accelerometers are exclusively classified as motion sensors because their declared purpose is to monitor a device's motion [START_REF]Android Developers: Motion Sensors[END_REF]. More relevant for assessing their potential privacy impact, however, is the fact that accelerometers can also be used to infer much more sensitive information, including a user's location [START_REF] Han | Accomplice: Location inference using accelerometers on smartphones[END_REF][START_REF] Hua | We Can Track You If You Take the Metro: Tracking Metro Riders Using Accelerometers on Smartphones[END_REF], activities [START_REF] Thomaz | A practical approach for recognizing eating moments with wristmounted inertial sensing[END_REF], and login credentials [START_REF] Owusu | ACCessory: password inference using accelerometers on smartphones[END_REF]. Therefore, a classification of sensors based solely on their most common purpose can be misleading.

Internal or External Focus. It can be differentiated between sensors which measure internal properties of their encapsulating device (e.g. internal temperature) and sensors which measure environmental properties (e.g. ambient illumination).

Possible Deployments. Depending on their size, functionality and intended purpose, sensors can vary in mobility. While some sensors are usually stationary (e.g. carbon dioxide sensors) or even wall-mounted (e.g. passive infrared motion detectors), others can be carried around or even be embedded into mobile devices (e.g. microphones, gyroscopes, accelerometers).

Reporting Mode.

Sensors can be classified based on how frequently they generate events. Android, for instance, differentiates between continuous reporting (events are generated at a constant rate), on-change reporting (only if the measured values have changed), one-shot reporting (upon detection of a specific event) and special reporting (according to specific sensor requirements) [START_REF]Android Open Source Project: Reporting modes[END_REF].

Level of Protection. Depending on the assumed sensitivity of their data and other factors, sensors in IoT devices enjoy different levels of legal and technical protection. Specific protection mechanisms and access policies can vary significantly between devices of different manufacturers [START_REF] Bai | Sensor Guardian: prevent privacy inference on Android sensors[END_REF]. Further insights into the sensitivity and protection of different types of sensor data are provided in section 2.2.

Accuracy. The measurement accuracy of sensors can greatly differ and often depends on their technological complexity and production quality. Sometimes, the granularity of sensor data is intentionally reduced to enhance privacy [START_REF] Eibl | Influence of Data Granularity on Smart Meter Privacy[END_REF].

Visibility. Sensors can also be classified based on their degree of visibility. While some sensors can be completely hidden within a device (e.g. accelerometer) or even sense through walls (e.g. radio tomography), other sensors require visual contact to function (e.g. infrared). Also, the size and appearance of a sensor should be considered when assessing its degree of visibility.

Sensitivity and Protection of Sensor Data

There are considerable differences in the perceived privacy intrusiveness of different sensor types. Cameras, for instance, are commonly regarded as highly privacysensitive [START_REF] Krishnan | Activity Recognition on Streaming Sensor Data[END_REF] and therefore often rejected in private rooms [START_REF] Naeini | Privacy Expectations and Preferences in an IoT World[END_REF]. Similarly, microphones [START_REF] Cook | Mining the Home Environment[END_REF], biometrical sensors [START_REF] Naeini | Privacy Expectations and Preferences in an IoT World[END_REF], and GPS data [START_REF] Klasnja | Exploring privacy concerns about personal sensing[END_REF] are widely believed to intrude user privacy. By contrast, sensors that do not directly record or locate the user are often considered harmless. Examples include inertial sensors such as accelerometers [START_REF] Klasnja | Exploring privacy concerns about personal sensing[END_REF] and sensors capturing environmental data such as room temperature [START_REF] Naeini | Privacy Expectations and Preferences in an IoT World[END_REF]. This sentiment is reflected in the permission policies of current mobile operating systems. All mainstream platforms, including iOS, Android and Windows Phone, allow third-party apps to access various built-in sensors without requiring security permission [START_REF] Bai | Sensor Guardian: prevent privacy inference on Android sensors[END_REF]. An overview of common smartphone sensors and their permission requirements on Android is provided in Table 1. While Google's mobile operating system leaves numerous sensors unprotected, access to GPS, camera and microphone is restricted [START_REF] Lee | Multi-sensor authentication to improve smartphone security[END_REF].

It can be expected that the policies of technology and market leaders like Apple, Google and Microsoft will substantially inspire and shape data protection mechanisms in the future IoT. Apart from mobile devices, other IoT devices such as smart meters [START_REF] Eibl | Influence of Data Granularity on Smart Meter Privacy[END_REF][START_REF] Greveler | Multimedia content identification through smart meter power usage profiles[END_REF][START_REF] Yang | Inferring occupancy from opportunistically available sensor data[END_REF], motion detectors [START_REF] Hevesi | Monitoring Household Activities and User Location with a Cheap, Unobtrusive Thermal Sensor Array[END_REF][START_REF] Yang | Inferring occupancy from opportunistically available sensor data[END_REF] and smoke alarm systems [START_REF] Notra | An experimental study of security and privacy risks with emerging household appliances[END_REF] have also been shown to share potentially sensitive data with service providers and device manufacturers without privacy-related restrictions. It is therefore important to investigate whether the widely assumed innocuousness of certain sensors matches reality.

Localization

Indoor Localization and Occupancy Monitoring

Various unobtrusive sensors can be used for the purpose of monitoring room occupancy and locating people indoors. A technology commonly found in home security systems are passive infrared (PIR) sensors which detect moving objects based on changes in ambient temperature. Besides from binary room occupancy, PIR sensors have been used to infer the number of occupants and even to identify people [START_REF] Yang | Inferring occupancy from opportunistically available sensor data[END_REF].

Since humans naturally exhale carbon dioxide (CO2), the air composition in a room or building can also be an indicator of occupancy. CO2 sensors have already been exploited to estimate the number of room occupants with high accuracy [START_REF] Ang | CD-HOC: Indoor Human Occupancy Counting using Carbon Dioxide Sensor Data[END_REF]. Similarly, human presence can be detected through measuring other environmental parameters, such as ambient humidity, illumination, and sound rate [START_REF] Ang | Human occupancy recognition with multivariate ambient sensors[END_REF].

Even the on/off state of household appliances and their level of power consumption over time allow inferences about binary [START_REF] Eibl | Influence of Data Granularity on Smart Meter Privacy[END_REF] and ranged [START_REF] Yang | Inferring occupancy from opportunistically available sensor data[END_REF] room occupancy. The energy usage patterns required for such inferences can be derived from residential smart meter readings [START_REF] Fan | Privacy Disclosure Through Smart Meters: Reactive Power Based Attack and Defense[END_REF] which are commonly shared with electric utilities for the official purpose of demand-response management and billing [START_REF] Yang | Inferring occupancy from opportunistically available sensor data[END_REF].

Radio Tomographic Imaging is another technique that has been exploited for human presence detection. This approach is based on the fact that the human body absorbs and thereby weakens a radio signal between sender and receiver, which can be measured in terms of the received signal strength (RSS). Within wireless sensor networks, which are considered an enabling technology for IoT [START_REF] Shukri | Device free localization technology for human detection and counting with RF sensor networks: A review[END_REF], radio tomographic imaging can be used for indoor localization [START_REF] Cao | A Lightweight Robust Indoor Radio Tomographic Imaging Method in Wireless Sensor Networks[END_REF] and even multi-target tracking [START_REF] Nannuru | Radio-frequency tomography for passive indoor multitarget tracking[END_REF] without requiring any additional hardware.

Radar sensors have also been proposed for the purpose of indoor localization. Aside from just detecting human presence and motion, existing approaches can sense through walls [START_REF] Gennarelli | Real-Time Through-Wall Situation Awareness Using a Microwave Doppler Radar Sensor[END_REF] and investigate the physical characteristics of targets [START_REF] Kim | Human Detection Using Doppler Radar Based on Physical Characteristics of Targets[END_REF]. Other technologies that are being explored for unobtrusive indoor positioning and room-level tracking include ultrasonic sensors [START_REF] Hnat | Doorjamb: unobtrusive room-level tracking of people in homes using doorway sensors[END_REF], door-operated switches [START_REF] Kim | Improved occupancy detection accuracy using PIR and door sensors for a smart thermostat[END_REF], and pressure-sensing floors [START_REF] Shen | Distributed Sensing Floor for an Intelligent Environment[END_REF]. In contrast to some of the data sources mentioned earlier, sensors like radar and ultrasound are unlikely to be underestimated in terms of their sensitivity. However, these technologies may be completely invisible to the tracked person which could be utilized for covert intrusions of privacy.

Indoor location information can be highly privacy-sensitive. Among many other possible inferences, indoor location traces have been used to obtain personal properties of targets, such as age, work role, coffee consumption and smoking habits [START_REF] Matsuo | Inferring Long-term User Properties Based on Users' Location History[END_REF].

Geographical Localization

Studies have shown that sensors in mobile devices can be exploited for geographical user localization, even when GPS is disabled. For instance, accelerometers in smartphones can reveal the device's location while the user is driving a car [START_REF] Han | Accomplice: Location inference using accelerometers on smartphones[END_REF] or using a metropolitan train system [START_REF] Hua | We Can Track You If You Take the Metro: Tracking Metro Riders Using Accelerometers on Smartphones[END_REF]. These approaches are either based on supervised learning with labeled training data or on mapping the phone's motion trajectory to the shape of existing routes on a map through computing a similarity score. Smartphone owners can also be located while they are walking or travelling on a train or plane by exploiting a combination of easily accessible mobile sensor data and publicly available auxiliary data [START_REF] Mosenia | PinMe: Tracking a Smartphone User around the World[END_REF]. For this approach, neither training data nor prior knowledge about the user is required. Researchers have even shown that a smartphone's location can be learned from tracking its battery level over time [START_REF] Michalevsky | PowerSpy: Location Tracking using Mobile Device Power Analysis[END_REF]. This method builds on the fact that the level of power consumption is affected by the distance and any obstacles between a phone and its current cellular base station.

Highly sensitive information can be inferred from location traces. Through spatial clustering and the identification of temporal mobility patterns, it is possible to obtain the true identity as well as the home address and points of interest of a person from his or her location history [START_REF] Freudiger | Evaluating the privacy risk of location-based services[END_REF]. Spatio-temporal information can also be used to infer a person's mode of transportation and to predict where a driver will drive [START_REF] Krumm | Inference attacks on location tracks[END_REF]. It is important to understand that certain visited locations alone (e.g. betting office, mosque, vegetarian restaurant) can reveal sensitive personal properties such as habits, preferences or religious affiliation. In combination with various unprotected smartphone sensors, location data has even been used to draw inferences about a user's emotional state [START_REF] Lee | Towards unobtrusive emotion recognition for affective social communication[END_REF].

Activity Recognition

Data from various inconspicuous sensors in IoT devices can be used to infer information about basic physical activities (e.g. walking, running, climbing) and activities of daily living (e.g. grooming, cooking, washing dishes) of individuals in their vicinities.

Recent studies in the field of sensor-based human activity recognition have mostly focused on accelerometer data from wearable devices such as smartphones, smartwatches, or wrist-worn fitness trackers [START_REF] Chen | Performance Analysis of Smartphone-Sensor Behavior for Human Activity Recognition[END_REF]. In [START_REF] Thomaz | A practical approach for recognizing eating moments with wristmounted inertial sensing[END_REF], 3-axis accelerometry collected with an off-the-shelf smartwatch was successfully used to recognize eating moments of users in free-living conditions. Data from wrist-worn inertial sensors has also been used to recognize various other actions including drinking and cigarette smoking [START_REF] Parate | Designing Efficient and Accurate Behavior-Aware Mobile Systems[END_REF][START_REF] Tang | Automated Detection of Puffing and Smoking with Wrist Accelerometers[END_REF]. Whole-body motions, such as descending and ascending stairs, walking, jumping, and jogging, can be recognized with high accuracy from smartphone inertial sensor data [START_REF] Chen | Performance Analysis of Smartphone-Sensor Behavior for Human Activity Recognition[END_REF]. Motion sensors in smartphones have even been used for the assessment of driving behavior [START_REF] Júnior | Driver behavior profiling: An investigation with different smartphone sensors and machine learning[END_REF].

Another unobtrusive but revealing data source for activity recognition in an IoT environment are smart electric meters. Various behaviors of residents including bathroom activities, cooking, housework, sleep cycles, and meal times can be inferred from seemingly non-sensitive smart meter readings [START_REF] Eibl | Influence of Data Granularity on Smart Meter Privacy[END_REF]. It has been shown that even the current TV channel and specific audiovisual content displayed on a television can be identified based on the corresponding household's electricity usage profile [START_REF] Greveler | Multimedia content identification through smart meter power usage profiles[END_REF].

Data from infrared motion detectors, which is normally used for monitoring room occupancy and often shared with security companies [START_REF] Yang | Inferring occupancy from opportunistically available sensor data[END_REF], has also been exploited for activity recognition. In [START_REF] Hevesi | Monitoring Household Activities and User Location with a Cheap, Unobtrusive Thermal Sensor Array[END_REF], passive infrared sensors were used to detect the operation mode of kitchen appliances, such as water cooker and toaster, as well as human actions, such as opening a refrigerator and taking a shower. While many current techniques for automated activity recognition require pre-processing of collected data, approaches have already been presented for extracting activity-related information from infrared sensor data in real-time [START_REF] Krishnan | Activity Recognition on Streaming Sensor Data[END_REF].

In a smart home environment, data from multiple sources can be combined for improved recognition accuracy. Nef et al. [START_REF] Nef | Evaluation of Three State-of-the-Art Classifiers for Recognition of Activities of Daily Living from Smart Home Ambient Data[END_REF] used a set of sensors measuring several parameters including luminescence, temperature and ambient motion to recognize eight different activities of daily living such as grooming, cooking, eating, and watching TV.

User Input Inference

Among the most sensitive information in the context of consumer electronics is the input that users provide through touchscreens and keyboards, which includes personal notes, text messages, transaction details, and login credentials. Multiple so-called keystroke inference attacks have been developed for inferring such user inputs from seemingly innocuous sensor data. Most of these attacks are based on the observation that the keys typed into a device correlate with micro-motions of the user's hand, and -in the case of mobile devices -with micro-motions of the device itself. Owusu et al. [START_REF] Owusu | ACCessory: password inference using accelerometers on smartphones[END_REF] show that data from accelerometers in smartphones can be used to obtain entire sequences of text entered through the touchscreen, including passwords. The same kind of data can also be exploited to infer graphical password patterns [START_REF] Aviv | Practicality of accelerometer side channels on smartphones[END_REF]. As demonstrated by Spreitzer [START_REF] Spreitzer | PIN Skimming: Exploiting the Ambient-Light Sensor in Mobile Devices[END_REF], even ambient-light sensors in mobile devices may leak sensitive user inputs such as the personal identification number (PIN).

Not only can embedded sensors reveal user inputs to their encapsulating device, they can also allow inferences about what users type into other devices. Motion sensors in modern smartwatches, for instance, have been exploited to recover text typed on laptop and desktop keyboards [START_REF] Maiti | Smartwatch-Based Keystroke Inference Attacks and Context-Aware Protection Mechanisms[END_REF][START_REF] Wang | MoLe: Motion Leaks through Smartwatch Sensors[END_REF].

The possibility to infer user inputs from sensor data could enable malicious parties to gain insight into sensitive communications and transactions. Beltramelli [START_REF] Beltramelli | Deep-Spying: Spying using Smartwatch and Deep Learning[END_REF] even suggests that a user's entire technological ecosystem could be compromised when passwords are leaked through embedded sensors in consumer IoT devices. Although current keystroke inference attacks are mostly based on accelerometer and gyroscope data, it has been proposed that other potential side channels such as magnetic field sensors should also be investigated [START_REF] Wang | MoLe: Motion Leaks through Smartwatch Sensors[END_REF].

Identification

De-anonymization of Sensor Data

Sensor data collected through consumer IoT devices is particularly sensitive when it can be linked to the real identity of the user. In scenarios where data is accessed by untrusted service providers or device manufacturers, identifying information such as name, address and bank account is often already available to them from the respective service or purchase agreement. Even if this is not the case, the sensor data itself and inferred location information can often reveal a user's identity to the data controller. As detailed above, work and home addresses of individuals can be derived from their geographical location traces [START_REF] Freudiger | Evaluating the privacy risk of location-based services[END_REF]. Such information -even at coarse resolution -can be used in conjunction with employment directories, white pages, tax records, and other public or private datasets to uniquely identify a tracked person [START_REF] Golle | On the anonymity of home/work location pairs[END_REF]. Social networks have also been proven to be excellent sources of auxiliary data for the de-anonymization of smartphone sensor data [START_REF] Lane | On the feasibility of user de-anonymization from shared mobile sensor data[END_REF]. Some researchers even argue that no method exists to reliably prevent the deanonymization of location data [START_REF] Narayanan | No silver bullet: De-identification still doesn't work[END_REF].

The linkage of data sources has been recognized as one of the major privacy threats in IoT [START_REF] Ziegeldorf | Privacy in the Internet of Things: threats and challenges[END_REF]. The term quasi-identifier, coined by Dalenius [START_REF] Dalenius | Finding a Needle In a Haystack or Identifying Anonymous Census Records[END_REF], is generally used to describe pieces of information that are not personally identifiable when considered in isolation but can quickly become unique identifiers when combined with other data sources. When it comes to IoT sensor data, an adversary's auxiliary information does not even need to be drawn from external sources (e.g. information brokers, public datasets) but can also be collected from within a user's own ecosystem of connected devices. As shown in [START_REF] Lane | On the feasibility of user de-anonymization from shared mobile sensor data[END_REF], mobile sensor data can become personally identifiable through linkage with less protected data streams of the same user. Seemingly innocuous sensors could thus be used as gateways to de-anonymize sensitive streams of user activity.

Tracking and Profiling of Anonymous Users

Even in cases where an adversary is not capable of obtaining a target's real identity from collected IoT sensor data, substantial privacy issues may arise. For some of the most common intentions behind data misuse, such as price discrimination and targeted advertising, it can be fully sufficient to distinguish between anonymous individuals without ever learning their real names.

In the context of consumer IoT devices, unidentified users can be told apart based on their physical characteristics and movement patterns, which are often reflected in sensor data from mobile devices. According to Jain et al. [START_REF] Jain | An introduction to biometric recognition[END_REF], body movements can serve as biological fingerprints if they are universal, repeatable, collectible, and distinctive. It has been shown that head movements, as captured through the sensors of headworn IoT devices, fulfill these requirements [START_REF] Li | Whose move is it anyway? Authenticating smart wearable devices using unique head movement patterns[END_REF]. Similarly, users of sensing devices can be uniquely distinguished based on their typing motion behavior [START_REF] Gascon | Continuous Authentication on Mobile Devices by Analysis of Typing Motion Behavior[END_REF] and other natural gestures such as lowering/raising an arm [START_REF] Yang | MotionAuth: Motion-based authentication for wrist worn smart devices[END_REF]. The required motion data can be drawn from sensors in smartphones [START_REF] Buriro | Please hold on: Unobtrusive user authentication using smartphone's builtin sensors[END_REF] and wrist-worn devices [START_REF] Yang | MotionAuth: Motion-based authentication for wrist worn smart devices[END_REF] without requiring any permission or conscious participation from the user. Where accessible through IoT sensors, physical characteristics such as body weight may also be used to distinguish observation targets from one another [START_REF] Hnat | Doorjamb: unobtrusive room-level tracking of people in homes using doorway sensors[END_REF].

Following another approach called device fingerprinting, users can be told apart based on imperfections and specific features of their personal devices. Even calibration errors in sensors commonly regarded as non-sensitive, such as gyroscopes and accelerometers, have been exploited to uniquely identify IoT devices [START_REF] Bojinov | Mobile device identification via sensor fingerprinting[END_REF][START_REF] Das | Tracking Mobile Web Users Through Motion Sensors: Attacks and Defenses[END_REF].

The ability to recognize and track individuals through sensor data is a potential basis for behavioral profiling [START_REF] Ziegeldorf | Privacy in the Internet of Things: threats and challenges[END_REF] and can thus result in people being treated differently, even without names attached to the data .

Discussion and Implications

As shown in the previous sections, sensitive information regarding a user's location, activities and device inputs can be obtained from seemingly benign IoT sensor data. Through cross-linking different sources of sensor data with auxiliary information, an adversary can potentially identify the victim and draw further undesired inferences about his or her habits and preferences. Thus, even if an IoT device is not designed or expected to capture sensitive information, its data streams can indirectly enable serious invasions of user privacy.

It can be assumed that this threat will continue to grow with further improvements of sensor technologies in terms of size, cost and accuracy, further advances in machine learning methods, and -most importantly -the predicted rapid proliferation of consumer IoT devices [START_REF] Evans | The Internet of Things -How the Next Evolution of the Internet Is Changing Everything[END_REF]. Therefore, the privacy-intrusion potential of seemingly innocuous sensors needs to be addressed and dealt with urgently in order to effectively protect consumers' fundamental right to privacy.

The level of legal and technical protection of sensor data should always be chosen in consideration of all reasonably conceivable inferences that can be derived from the data, and not based on the sensor's official purpose. No distinct line can be drawn, for instance, between GPS data and currently less protected sensors such as accelerometers and gyroscopes when it comes to their potential of revealing sensitive information [START_REF] Han | Accomplice: Location inference using accelerometers on smartphones[END_REF][START_REF] Hua | We Can Track You If You Take the Metro: Tracking Metro Riders Using Accelerometers on Smartphones[END_REF]. Further research into the privacy impact of specific sensors is needed, taking into account state-of-the-art data mining and machine learning techniques. As it is extremely difficult, however, to meaningfully determine the limits of continuously advancing inference attacks, most types of IoT sensor data should be classified as highly sensitive by default.

Consumers need to be warned about the invisible privacy threats of IoT. Although surveys have shown that many individuals do not want IoT devices to record all of their inhome behaviors [START_REF] Choe | Living in a glass house: a survey of private moments in the home[END_REF] and worry about inferences from otherwise anonymous data [START_REF] Naeini | Privacy Expectations and Preferences in an IoT World[END_REF], people are not particularly concerned about unobtrusive sensors such as the ones discussed in this paper [START_REF] Klasnja | Exploring privacy concerns about personal sensing[END_REF][START_REF] Naeini | Privacy Expectations and Preferences in an IoT World[END_REF]. It seems apparent that the possibilities and implications of data linkage and pattern recognition are not well-understood by the average consumer. Thus, truly informed consent to data processing, as required by the EU's General Data Protection Regulation and other data protection laws, can often not be obtained. Improved education of consumers and their voiced objection against the insufficient protection of sensitive sensor data could also exert pressure on policy makers and device manufacturers to incorporate effective privacy preserving mechanisms in IoT systems and the corresponding regulation.

In order to enable consumers to remain in control of their personal data and understand the complex privacy implications of IoT sensor technology, information on data collection and processing must be presented in an intuitive and easily understandable manner. For this purpose, new tools and approaches need to be developed.

Conclusion

The emerging Internet of Things promises to improve our quality of life in many ways. However, the large variety of sensors embedded into connected devices also poses a rising threat to consumer privacy. The overview provided in this paper illustrates that even sensors that are generally thought to be harmless can be used to infer highly sensitive personal information, such as a user's location, activities and real identity, as well as keyboard and touchscreen inputs. Since the access to seemingly innocuous sensors is often unrestricted, various parties can regularly capture and use their potentially revealing data, including device manufacturers, service providers, and third-party apps installed on mobile devices. Many sensors discussed in this paper are usually hidden inside their encapsulating device and thus completely invisible to the user. Where no access permission is required, these sensors might enable fully covert surveillance of device owners and other people in their vicinity. Considering the extensive protection of sensors which are commonly believed to be privacy-sensitive, such as cameras, microphones and GPS, it is important to prevent malicious parties from using less-protected sensors as substitutional data sources.

Judging from the research findings presented in this paper, many disregarded types of sensor data in the IoT should be classified as sensitive by default and protected accordingly. Furthermore, improved consumer education and more intuitive ways of presenting privacy-related information are necessary to achieve true informational selfdetermination in an increasingly complex and diverse environment of sensing devices. This paper, however, provides only an initial exploration of the topic. Further empirical and conceptual research into the privacy implications of sensors in IoT devices is strongly encouraged.

Table 1 .

 1 Overview of common smartphone sensors

	Sensor type	Output	Restricted in
			Android [6, 38]
	Accelerometer	Acceleration of device	No
	Ambient Temperature Room / air temperature	No
	Camera	Recorded image or video	Yes
	GPS	Geographical location	Yes
	Gravity	Force of gravity	No
	Gyroscope	Device's rate of rotation	No
	Light	Level of ambient illumination	No
	Magnetometer	Ambient geomagnetic field	No
	Microphone	Recorded audio	Yes
	Orientation	Device's degrees of rotation	No
	Pressure	Ambient air pressure	No
	Proximity	Proximity of an object to the device's screen	No
	Relative Humidity	Relative ambient air humidity	No
	Temperature	Temperature of the device	No


Brenda Scholtz
email: brenda.scholtz@mandela.ac.za

Mando Kapeso
email: mando.kapeso@mandela.ac.za

Jean-Paul Van Belle

An Internet of Things (IoT) Model for Optimising Downtime Management: A Smart Lighting Case Study

Keywords: IoT, Smart Lightning, Design Science Research. 1

In today's global, competitive economy, downtime has been identified as a key performance indicator for field service organisations. The emergence of an Internet of Things (IoT) has brought new enhancement possibilities to various industries such as the manufacturing and field service industry. This paper provides a vision and motivation for using IoT in Field Service Management (FSM) in order to address data quality and service delivery issues. The theory of information quality was used to undergird the research and a model for the optimisation of downtime management in the field service industry using the IoT is proposed. The model was used to drive the design of a "proof of concept" prototype, the KapCha prototype. The paper also includes a report on an empirical study of the application of the proposed IoT model in FSM. The experiment findings showed that the prototype reduced the round trip delay time for sending and receiving data and was scalable. As a result, access to quality information supporting advanced data analytics and artificial intelligence was provided. Therefore, service technicians can be alerted more quickly as soon as any potential technical problems occur. In turn improved diagnostics and more efficient decision making can be achieved. The model and the lessons learned provide valuable guidance to other researchers and fill the gap in research of empirical studies conducted on IoT implementations.

Introduction

The lack of accurate, available and real-time information is a common challenge faced by field service organisations [START_REF] Lehtonen | Taking advantage of after-sales product information in a multicompany environment[END_REF]. As a result downtime, which is an important performance measure in this domain, is negatively impacted. Downtime is defined as the time between a customer's request for service and the completion of the service by the field service team to rectify the problem [START_REF] Agnihothri | Leveraging technology to improve field service[END_REF]. Field service management (FSM) refers to the support provided by hardware and software in the management of field service operations and involves the management of the activities and processes that are associated with field services. There is a need for solutions that efficiently address the challenges of FSM and downtime management and that support the provision of quality information and ultimately improved decision making and service delivery levels [START_REF] Petrakis | On the impact of real-time information on field service scheduling[END_REF].

One application of downtime management in the field service domain is that of the maintenance of smart lights. Smart lighting projects have been undertaken by municipalities as a result of a drive for improved energy management within cities [START_REF] Castro | Smart lighting solutions for smart cities[END_REF]. In the context of cities, streetlights are one of the most important assets to maintain as they provide safe roads and enhanced security for homes, businesses and city centres. However, they are costly to operate and account for an estimated 40% of the amount of electricity spent in an urban city [START_REF] Basu | Sensor-based predictive modeling for smart lighting in grid-integrated buildings[END_REF]. To address this issue, city managers are implementing smart lighting solutions. Smart lighting consists of heterogeneous and multidisciplinary areas of lighting management, with the possibilities of integrating a wide range of sensory and control technologies with ICTs. This integration can improve efficiencies in lighting products and lower the negative impact derived from the use of energy for illumination. Smart lighting provides intelligent features and interfaces for lighting solutions in the ambient, commercial and public domains [START_REF] Castro | Smart lighting solutions for smart cities[END_REF][START_REF] Koh | An energy-efficient low voltage DC grid powered smart LED lighting system[END_REF]. Smart lighting is linked to the concept of a smart city, which is an urban development that envisions the efficient management of a cities resources and services with the use of integrated ICT solutions [START_REF] Castro | Smart lighting solutions for smart cities[END_REF]. Smart cities play an important role in the sustainable economic development of countries or states seeking to attain environmental sustainability. Smart cities are made possible through the abundance of smart devices, smart objects and the emergence and rapid growth of technologies such as the Internet of Things (IoT). The IoT is described as a decentralised system of "smart" objects with sensing, processing, and network capabilities [START_REF] Kortuem | Smart objects as building blocks for the Internet of things[END_REF].

Extensive research has been conducted related to the IoT [START_REF] Bi | Internet of things for enterprise systems of modern manufacturing[END_REF][START_REF] Borgia | The internet of things vision: Key features, applications and open issues[END_REF][START_REF] Datta | A survey on IoT architectures, protocols, security and smart city based applications[END_REF]. In particular several studies have proposed various architectures for IoT, such as a general reference architecture [START_REF] Yaqoob | Internet of Things Architecture: Recent Advances, Taxonomy, Requirements and Open Challenges[END_REF] and others in certain domains such as smart metering [START_REF] Lloret | An integrated IoT architecture for smart metering[END_REF]. However, limited studies can be found that report on empirical studies of IoT applications in practice and findings and lessons learnt from these applications. There is a need for research into how technologies in the IoT can be applied to various business domains [START_REF] Hwang | Understanding Internet of Things (IoT) diffusion: Focusing on value configuration of RFID and sensors in business cases (2008-2012)[END_REF].

This paper addresses this gap by investigating an IoT application in the domain of smart lighting. The purpose of this paper is to propose an IoT model that addresses the challenges of information quality leading to poor downtime management. The paper reports on the application of this model in the smart lighting domain. The model includes IoT compatible technologies and techniques (protocols and formats) to support successful downtime management. To address this purpose, a critical analysis of the literature related to FSM, downtime management and IoT was conducted (Section 2). The context was a smart lighting organisation in South Africa (Section 3). From the literature and consideration of the context, a theoretical model was derived (Section 4). The model was used to design the architecture of and to implement a prototype for the case study (Section 5). The experiments conducted revealed that the new architecture and protocols implemented resulted in a lower Round Trip Delay time and was scalable (Section 6). The quality of information was improved and provided a foundation for advanced data analytics and artificial intelligence (AI), since the system provided intelligent information to technicians and managers; thereby improving diagnostic decision making, downtime management and service delivery.

There are several contributions and implications for future research that are identified from this study (Section 7). The practical contribution is the model, which can provide guidance to practitioners working in the field service domain and for system designers. On a theoretical level the model and the implementation issues identified contribute to the body of knowledge regarding the application of IoT models, architectures and network protocols.

2

Literature Review

Challenges in Field Service Management (FSM) and Downtime Management

In a competitive global economy where every organisation is looking at ways to cut costs, increase efficiency and gain a competitive advantage, organisations have become more customer-centric. The effectiveness of field services provided by technicians affects everything from the retention of customers and the profitability of the organisation [1][8]. With field-based services, customers receive either an on-site or a remote service [START_REF] Agnihothri | Leveraging technology to improve field service[END_REF]. FSM operations include tracking vehicles, scheduling and dispatching employees, and integration of these operations with a back-office system for inventory, logistics and marketing. FSM includes elements such as Enterprise Asset Management (EAM), maintenance support, sensor networks, Radio Frequency Identification (RFID) tags, technical support, contract management and product lifecycle management. The FSM market has seen a steady growth and evolution in the last 10 years [START_REF] Gartner | Magic Quadrant for Field Service Management[END_REF], which can be attributed to new technology developments, as technology is a driver in improved after-sales service innovations. Downtime management is an important measure of performance for field services for both the organisation providing the service and the customer [START_REF] Knotts | Civil aircraft maintenance and support[END_REF]. From the customer's perspective, that is the organisation undergoing downtime, the downtime period has operational implications such as reduced productivity levels and delayed delivery of services to the organisation's clientele. It is therefore imperative that downtime is kept to a minimal period. Service providers have to adequately manage downtime in order to satisfy its customers and by doing so efficiently they may gain a competitive advantage. Agnihothri [START_REF] Agnihothri | Leveraging technology to improve field service[END_REF] classified downtime into two subcategories, response time and on-site time. Response time is the time between the customer's request and the service team's arrival on-site. On-site time is the duration of time taken between the service team's arrival at the customer's site and the rectification of the problem. Corrective maintenance occurs when the machinery breaks down and includes activities undertaken to diagnose and rectify a fault so that the failed machine, equipment or system can be restored to its normal operational state, thus reducing the extent of downtime.

A lack of information related to a technical breakdown can result in longer cycle times and possibly a second service visit, thus resulting in longer periods of downtime for customers [START_REF] Jose | Optimize Field Service Management through Analytics[END_REF]. A malfunctioning piece of industrial machinery on a manufacturing floor can translate into tens of thousands of dollars per minute. It is important to make critical information immediately available to field technicians and management with high levels of accuracy. Critical data related to the problem must be accurate, available anywhere, and dynamically changing along with the day-to-day operations of field service teams. Access to this information can assist with optimising the problem detection step in FSM and field service providers can determine strategies to ensure that downtime is minimised and managed with optimal efficiency. Within IS literature, information quality (IQ) can be used as a dimension of IS success [START_REF] Delone | The DeLone and McLean model of information systems success: a ten year update[END_REF]. Knowledge is functionally related to data and information, thus it follows a hierarchy (data -> information -> knowledge), termed as the knowledge hierarchy 11]. Our study classified the problems in FSM related to information that impact downtime management according to six of the attributes of IQ proposed by [START_REF] Delone | The DeLone and McLean model of information systems success: a ten year update[END_REF]. These are:

• Timeliness: lack of access to real-time information [START_REF] Lehtonen | Taking advantage of after-sales product information in a multicompany environment[END_REF];

• Completeness: missing information [START_REF] Lehtonen | Taking advantage of after-sales product information in a multicompany environment[END_REF][START_REF] Petrakis | On the impact of real-time information on field service scheduling[END_REF][START_REF] Jose | Optimize Field Service Management through Analytics[END_REF];

• Accuracy: inaccurate information [START_REF] Lehtonen | Taking advantage of after-sales product information in a multicompany environment[END_REF];

• Relevance: aggregated or de-aggregated information [START_REF] Schneider | Asset management techniques[END_REF][START_REF] Przydatek | SIA: Secure Information Aggregation in Sensor Networks[END_REF]; • Consistency: lack of integration between enterprise and FSM systems [START_REF] Schneider | Asset management techniques[END_REF]. This analysis also confirmed the findings of [START_REF] Delone | Information Systems Success: The Quest for the Dependent Variable[END_REF] showing a significant relationship between IQ and individual impact. Individual impact is measured in terms of decisionmaking performance, job effectiveness, and quality of work. Challenges faced by FSM organisations with regards to IQ resulted in negative impact on decision making and service delivery. Inaccurate or missing information and a lack of real-time availability of information to employees onsite in the field (for example dispatchers and service technicians) resulted in operational challenges [START_REF] Lehtonen | Taking advantage of after-sales product information in a multicompany environment[END_REF][START_REF] Petrakis | On the impact of real-time information on field service scheduling[END_REF][START_REF] Jose | Optimize Field Service Management through Analytics[END_REF]. Information related to the customer or the equipment under maintenance or repair is not always readily available to field service employees, resulting in the poor scheduling of field employees, the ineffective management of field service resources such as service parts [START_REF] Petrakis | On the impact of real-time information on field service scheduling[END_REF] and ultimately in poor service delivery. In a study by Lehtonen [START_REF] Lehtonen | Taking advantage of after-sales product information in a multicompany environment[END_REF], it was reported that service teams could not provide a service due to missing spare parts. The main reason for this was the inaccurate information on the spare parts that was taken to the client at the time of repair. Challenges in FSM within Enterprise Systems may also arise due to the lack of accessibility and integration of various systems [START_REF] Schneider | Asset management techniques[END_REF]. For example, geographical data is found in Geographical Information Systems (GIS), whilst maintenance-related data and reports are often stored in an Enterprise Resource Planning (ERP) system, thus resulting in integration and consistency issues. Schneider [START_REF] Schneider | Asset management techniques[END_REF] reported issues related to the use of aggregated data within an ERP system. For example, in an ERP system electricity usage data for a manufacturing plant is usually stored as an aggregated figure for all work centres within the plant. Aggregated data makes the operational performance monitoring of a single work centre or equipment within the plant difficult.

Access to real-time information aids organisations in optimising FSM since it can minimise the time for the service team to locate a client location by using GPS services and can reduce the on-site time spent servicing a clients' request [START_REF] Lehtonen | Taking advantage of after-sales product information in a multicompany environment[END_REF][START_REF] Agnihothri | Leveraging technology to improve field service[END_REF]. Real-time access to the clients' location eliminates the need for the service team to return to the service provider's facilities in order to get information about a new client's request, thereby optimising the scheduling element [START_REF] Petrakis | On the impact of real-time information on field service scheduling[END_REF].

Applications of the IoT

The IoT has brought new functionality possibilities for many industries such as manufacturing and field services [START_REF] Bi | Internet of things for enterprise systems of modern manufacturing[END_REF][START_REF] Coetzee | The Internet of Things -Promise for the Future ? An Introduction[END_REF]. It is expected that soon more than fifty billion devices ranging from smart phones, laptops, sensors and game consoles will be connected to the Internet through heterogeneous access network technologies [START_REF] Borgia | The internet of things vision: Key features, applications and open issues[END_REF]. However, the successful implementation of an IoT system introduces several other challenges. The abundance of data provided by sensors can introduce inefficiencies in data transfer and a need for aggregated data since sensor nodes are constrained by limited resources, for example computational power, memory, storage, communication, and battery energy [START_REF] Przydatek | SIA: Secure Information Aggregation in Sensor Networks[END_REF]. These constraints provide an important challenge to design and develop approaches to information processing and aggregation that are efficient and make effective use of the data. For a given query, it may not be necessary or efficient to return all the raw data collected from every sensor -alternatively information should be processed and aggregated within the network and only processed and aggregated information returned. From a system level perspective, the IoT can be viewed as a dynamic, radically distributed, networked system, consisting of many smart objects that produce and consume information [START_REF] Miorandi | Internet of things: Vision, applications and research challenges[END_REF]. It can optimise business processes by leveraging on advanced analytics techniques applied to IoT data streams [START_REF] Miorandi | Internet of things: Vision, applications and research challenges[END_REF]. Thus, it provides good potential for addressing the downtime problem, if successfully implemented.

Although technology advances enable the possibility of the IoT, it is the application of the IoT which is driving its evolution [START_REF] Borgia | The internet of things vision: Key features, applications and open issues[END_REF]. The potential social, environmental and economic impact that the IoT has on the decisions we make and the actions we take is its main driving force. For example, having accurate information about the status, location and identity of things which are part of our environment opens the way for making smarter decisions. The application domains that the IoT includes can provide a competitive advantage beyond current solutions. In its inception the IoT was used in the context of supply chain management with RFID tags as the enabling technology [START_REF] Kortuem | Smart objects as building blocks for the Internet of things[END_REF]. However, in the past decade its applications have covered a wide range of industries, including transportation and utilities, to name just a few. Hwang et al. [START_REF] Hwang | Understanding Internet of Things (IoT) diffusion: Focusing on value configuration of RFID and sensors in business cases (2008-2012)[END_REF] classified the potential business contexts of IoT into three different factors: industry applications (for example government, education and finance); service domains (for example transportation, asset management) and value chain activities (for example sales and marketing, service or procurement). On the other hand, Borgia et al. [START_REF] Borgia | The internet of things vision: Key features, applications and open issues[END_REF], classified the IoT into three application areas: industrial (for example agriculture, logistics or other industrial applications), health/well-being and smart city. The smart city factor includes safety, mobility, buildings, road conditions, waste collection and public lighting.

Context of Research: Smart Lighting

The case study used in this research is a smart lighting system that is maintained at an engineering consulting and research organisation in South Africa. For purposes of anonymity, the organisation will be called LightCo. The smart lights that are used as outdoor luminous equipment for parking bays and security lights for building facilities and are grid independent; meaning they are not connected to a local or municipal electricity provider for the energy needed to light them. An interview was conducted with one of the senior engineers at LightCo in order to establish an overview of the environment as well as the challenges faced by the organisation in delivering maintenance services for the smart lighting environment. Smart lighting consists of the integration of intelligent functionalities and interfaces at four complementary levels [START_REF] Castro | Smart lighting solutions for smart cities[END_REF], namely: the embedded level; system level; grid level and communication and sensing level. The embedded level is the lighting engine or the light itself, whilst the system level is the luminaries and lighting systems. The grid level consists of the management and monitoring of the power sources, energy generation and plants and the distribution of utilities and appliances. The final level is the communication and sensing level, which provides complete lighting solutions with monitoring, control and management of the applications.

The smart light unit at LightCo consists of an on board 48-voltage battery pack that is used as an energy storage unit. The solar panel is used to harness solar energy and the wind turbine generates electricity by the turning of a generator. The architecture of the smart lighting system allows for remote monitoring. The smart light also contains sensors and actuators that enable it to measure environmental variables and to respond to specific conditions by means of the actuators. The sensors include ambient sensors on the solar panel and voltage and current sensors on the circuit board of the smart light. Furthermore, the smart light is uniquely identifiable and contains on-board microcontrollers that provide computational and communication capabilities. The microcontrollers receive voltage and current data readings from the solar panel and wind turbine and also record the voltage and current that is outputted to the LED light. The battery management system manages the flow of current to the battery. Once these readings have been recorded they are then sent to a remote server for processing.

Prior to starting this study, the smart lighting system at LightCo did not provide for efficient or effective downtime management. Technical problems with the lights were not being reported timeously and were not correctly diagnosed due to IQ issues reported in literature [START_REF] Lehtonen | Taking advantage of after-sales product information in a multicompany environment[END_REF][START_REF] Schneider | Asset management techniques[END_REF]. These problems could be for example, an LED light or circuit board is damaged. The system that was in place for detecting technical problems with their lights used a Global System for Mobile Communications (GSM) SMS-based messaging/polling protocol to transfer data from a smart light to a server at a remote location. This protocol was reported as inefficient due to its high latency times and high data costs affiliated with the sending and receiving of SMS messages. Increasing the latency was not an option, since it would increase the data costs. Data transmission was not bi-directional and data was merely recorded in a CSV file, with no processing performed on it. An Arduino microcontroller was situated in each smart light with a GSM Shield, which allowed the Arduino board to send and receive an SMS as well as connect to the Internet using the GSM library. However, the system did not use the GPRS wireless component that would enable the Arduino to connect to the Internet. Technicians had to manually peruse the data to diagnose any issues or potential issues.

4

IoT Model for Downtime Management

The Three Phase Data Flow Process model proposed by Borgia et al. [START_REF] Borgia | The internet of things vision: Key features, applications and open issues[END_REF] (Figure 1), the four layers of IoT [START_REF] Xu | Internet of things in industries: A survey[END_REF], and IQ theory were used as the main guiding theories for the proposed IoT Model for Downtime Management (Figure 2). The model describes the flow of data in the IoT over three phases [START_REF] Borgia | The internet of things vision: Key features, applications and open issues[END_REF], namely the Collection Phase; the Transmission Phase; and the Process Management and Utilisation phase and four layers [START_REF] Xu | Internet of things in industries: A survey[END_REF] (the Sensing Layer; the Networking Layer; the Service layer; and the Interface layer). The Sensing Layer consists of hardware that senses and controls the physical world and data. Examples are RFID, sensors and actuators. The Network Layer provides networking support and transfers data over either a wireless or a wired network. The Service Layer is responsible for the provision of services to satisfy the user needs and creates and manages services. The Interface Layer (or Application Layer) interacts with other applications and users.

Figure 1. The Three Phase Data Flow Process [START_REF] Borgia | The internet of things vision: Key features, applications and open issues[END_REF] The Collection Phase reports on the event driven processes during the collection and acquisition of the data from the environment [START_REF] Borgia | The internet of things vision: Key features, applications and open issues[END_REF]. Data acquisition technologies attached to sensors and cameras collect information about the physical environment (temperature, humidity and brightness), or about the objects (identify and state) in realtime; while data collection is accomplished by short range communications, which could be open source standard solutions or proprietary solutions. In the FSM context these would be integrated into the equipment or assets in the field, for example the smart light. The Transmission Phase involves mechanisms that deliver collected data to various applications and external servers [START_REF] Borgia | The internet of things vision: Key features, applications and open issues[END_REF]. Once data has been collected it must be transmitted across the network so that it can be consumed by applications. For wired technologies the standard is Ethernet IEEE802.3. The primary advantage that wired networks have for data transmission is that they are robust and less vulnerable to errors and interference. However, they are costly. Therefore Wireless LAN (WLANs) are often used to access the network. Due to the flexibility of WLANs, it is believed that they will be the main communication paradigm of the IoT. However, the restricted wireless spectrum available for cellular networks is a major limitation to their widespread use.

Figure 2. IoT Model for Downtime Management

The Processing, Management and Utilisation Phase incorporates the processing and analysing of information flows, data forwarding to services and applications and the provision of feedback to control applications [START_REF] Borgia | The internet of things vision: Key features, applications and open issues[END_REF]. It also involves device discovery and management, data filtering, aggregation and information utilisation. The Service Platform & Enabler sub-phase covers an important role for managing these functions and is necessary in order to hide the heterogeneity of hardware, software, data formats, technologies and communication protocols that are a key feature of the IoT. Its responsibility is to abstract all the features of objects, networks and services, and to provide a loose coupling of components.

5

Methodology and Development of the Prototypes

Methodology

The Design Science Research (DSR) methodology [START_REF] Hevner | Positioning and Presenting Design Science Research for Maximum Impact[END_REF] was adopted in this study to create and evaluate the artefacts (model and prototype). The model was derived from a systematic literature review as well as from the case study of smart lighting maintenance, which was used for implementing and evaluating the model. The Technical and Risk efficacy evaluation strategy from the Framework for Evaluation of Design Science (FEDS) is used in the DSR methodology for evaluations conducted in the design cycle of DSR and was used in this study to evaluate both the model and the KapCha prototype [START_REF] Venable | FEDS: a Framework for Evaluation in Design Science Research[END_REF]. An artificial-summative evaluation was used to evaluate the design of the model, but due to space limitations these results are not reported on in this paper but are available on request. Iterative formative evaluations were conducted during the development of the prototype; after which a summative-naturalistic evaluation was conducted in order to determine the performance of the prototype under real-world conditions.

The Prototypes and Their Mapping to Requirements

The KapCha prototype was developed using an incremental prototyping process comprising of three prototype components (Table 1). ProWebSoc is the web socket protocol; ProObjWeb is the web socket client; and ProDT is the interface layer and web socket server. The IoT Model for Downtime Management (Figure 2) was used to design the architecture of the prototypes.

Collection and Transmission Phases (ProWebSoc and ProObjWeb)

As an alternative to the SOAP/XML data transmission protocols used by LightCo prior to this intervention, a protocol based on JavaScript Object Notation (JSON) was implemented. JSON, is a text-based open standard format that is designed for humanreadable data interchange and used for the serialisation of structured data making it easy for machines to parse and generate it. JSON is ideal for low processing computational capabilities (such as the smart light) and can result in less data that needs to be generated as compared to SOAP/XML.

ProObjWeb, through the web-socket client, enabled the smart light in the case study, as an OEM, to interface with a remote web-server using the KapCha web-socket protocol and to transmit data over a web socket protocol (ProWebSoc). Web sockets enable bi-directional communication (upstream and downstream) through the introduction of an interface and the definition of a full-duplex single communication channel that operates through a single socket [START_REF] Fette | The WebSocket Protocol[END_REF]. They provide a reduction in network traffic and latency as compared to polling and long-polling solutions that are used to simulate a full-duplex connection by maintaining two connections. They also reduce the amount of port openings on the server side, as compared to the traditional means of retrieving resources such as polling. This reduction also reduces maintenance of connection channels from the server side, therefore decreasing the overhead network traffic. The web socket protocol also has the ability to traverse firewalls and proxies, which is a problem for other protocols. The protocols provide real-time communication (RTC) between a smart object and a central system or other smart objects and supports ad hoc and continuous data transfer as well as operational status communication and Remote Procedure Calls (RPCs).

A GPRS wireless component was used to enable the Arduino to make use of web socket technology. The web socket client was developed on the Arduino board using the Arduino open source software and several web socket methods. During connection, the web socket detects the presence of a proxy server and automatically establishes a tunnel to pass through the proxy. The tunnel is established through the opening of a TCP/IP connection. The connection is established by the client issuing an HTTP connect statement to the proxy server for a specific host and port. Upon the tunnel being set up communication flows uninterrupted through the proxy.

The web socket protocol (ProWebSoc) was designed to work with existing web infrastructure, therefore the protocol specification defines that the web socket connection starts as an HTTP connection [START_REF] Lubbers | HTML5 web sockets: A quantum leap in scalability for the web[END_REF]. This guarantees full backwards compatibility with HTTP based communication protocols. The upgrade from an HTTP to web socket is referred to as a handshake. In this process the client sends a request to the server indicating that it wants to switch protocols from HTTP to Web sockets, by means of an upgrade header. During the handshake process the server accepts the request and responds with an upgrade switch header. The server acknowledges receipt of the client's request by taking the |Sec-Web socket-Key| value and concatenating it with a Globally Unique Identifier (GUID) in string form. An SHA-1 hash (160 bits) base64-encoded of this concatenation is then returned in the server's response. This prevents an attacker from tricking a web socket server by sending it carefully crafted packets using XMLHttpRequest or a form submission.

Web sockets are ideal due to the ability to use customised protocol calling depending on the service being offered [START_REF] Fette | The WebSocket Protocol[END_REF]. In ProObjWeb, when the client receives a response with no errors the connection is upgraded to a web socket over the same TCP/IP connection. Once the connection is established data frames between clients and servers can be transferred. Once the web socket client application connects to the webserver, the webserver initiates an upgrade sequence to upgrade the connection from an HTTP connection to a web socket server. ProObjWeb was functionally tested using the web socket.org echo server, which allows developers of web socket applications to test the ability of their applications to successfully upgrade the connection from HTTP to a web socket protocol. The test results showed that ProObjWeb successfully managed to connect to the web.org server and upgrade from HTTP to web sockets.

Management and Utilisation Phase

The third prototype (ProDT) focused on the development of the web-socket server application, a decision tree algorithm implementation and a REST (Representational State Transfer) API web interface. REST APIs with web socket Requests/Responses were used to form an intermediate layer between a client and the database, translate the raw data from the database to a format that the client requests and transmit the data. Most databases provide real-time notifications for added or updated data. However, real-time notification passage between the database and the client was required, therefore an Interface Layer was created in ProDT using a web socket server. The websocket server also handled communication with the database, which is the core of the application architecture. These techniques (including the protocols) provided real-time notification between the database and the client, eliminating the need for the Ajax techniques of polling. The database contained information about each smart light such as the date of manufacture and installation, its GPS location, object data sent by the Smart Light, the fault issue result after data analysis and job card data.

In order to generate an issue, data analysis using a decision tree learning algorithm was implemented. A decision tree is a tree structure consisting of nodes that each represent a test of an attribute with each branch representing a result of the test [START_REF] Kohavi | Data mining tasks and methods: Classification: decision-tree discovery[END_REF]. The tree splits observations into mutually exclusive subgroups until observations can no longer be split. The ID4.5 is a popular splitting algorithm that builds a decision tree by employing a top-down, greedy search through the given sets of training data to test each attribute at every node. Decision trees require little effort for data preparation unlike some statistical techniques and they are easy to interpret. The data collected was categorised data and therefore is ideal for decision tree. Furthermore, as there was no historical information on the diagnosis of faults or issues the decision tree was the ideal AI technique to be used as the classifier would be developed from the expert's opinion of plausible issues. The diagnosis of a set of problems based on these opinions was determined as a classification problem.

The improvements in the quality of information provided by these techniques thus allowed for advanced data analytics and intelligent algorithms (such as decision trees) to be conducted on the IoT data streams. The ability to interface with mobile technologies was also provided.

Experiment Procedure and Findings

The aim of the experiments was to evaluate the Round-Trip Delay time (RTD) of messages, latency, accuracy of the decision tree analysis and scalability. Due to space constraints this paper only provides details of the RTD and accuracy experiments.

Round-Trip Delay time (RTD).

The RTD experiment measures the time taken for a client to send a signal to a server and the time it takes for the server to acknowledge the signal and send a response [START_REF] Venable | FEDS: a Framework for Evaluation in Design Science Research[END_REF]. In this context the client was the smart light and the server was the remote web socket server application. For the RTD experiment a connection had to be established between the smart light and the web socket server application. The experiment procedure involved running the applications in three cycles; the first cycle involved sending a data packet 10 times, then the second cycle 100 times and the third cycle 1000 times. The data packet was an array data object that was instantiated and sent to the server. Two phases of experiments were performed: the first phase (local testing) consisted of running the server applications on a local host machine; and the second phase (remote testing) of the experiment involved running the server applications on a remote server. The performance metrics for the RTD evaluation were delay time and messages per second.

From the results of all three cycles it is evident that the KapCha web socket had a lower RTD time as compared to the Ajax protocol (Table 2). The results can be attributed to the fact that there are fewer HTTP overheads when using web sockets as compared to Ajax requests. Upon the connection being established all messages are sent over the single socket connection rather than the creation of new connections for new HTTP request and response calls created every time a message is sent over the Ajax protocol.

Furthermore, the web socket protocol had more messages sent per second as compared to that of the Ajax protocol. The messages per second for web sockets are higher because the web sockets establish the connection once over a single socket, unlike Ajax techniques that require multiple connections to be opened and closed during request/response calls. Therefore, web sockets do not have messages delayed during the connection process and can send more messages per second. The messages sent per second over the web socket protocol increased exponentially with the number of iterations completed. The results from the remote testing set of experiments revealed that the web socket protocol had a lower RTD time as compared to the Ajax protocol when the number of packets was lower than a certain level. This result could be due to the upgrade sequence overhead during the web socket handshake process. The additional overhead connection, however, is not significant as the number of iterations increase due to the maintenance of the single socket connection. The RDT results highlighted the advantages of applications that use web sockets have over HTTP polling mechanisms. The advantages are lower latency and the provision of a single socket connection that enables the web server to push data to the client at will, creating a fully duplex bidirectional data exchange web-protocol. Accuracy of decision tree: Prior to the development of the prototype there wasn't any data stored regarding the cause of a fault or the documentation of the diagnosis of a fault at LightCo. Therefore, the accuracy of the training dataset created was based on the expert's verification. The C4.5 decision tree algorithm was used to analyse the data and deduce the cause of the faults that occurred. For the experiment, the algorithm was deployed/executed to analyse three data set sizes of 50, 100 and 175. The number of correct predictions after each execution was recorded and verified by an expert at LightCo. This process was undertaken to establish the accuracy of the algorithm in diagnosing faults. The execution time of the algorithm was also recorded to determine the turnaround time of the fault diagnosis. The formula used for determining the accuracy percentage was: Equation 1:

The accuracy results are summarised in Table 3. The sample size of fifty (n=50) resulted in a percentage accuracy of 82.2% meaning that 41 out of the 50 predictions were correct. The sample size of 100 had 79 correctly predicted faults with a percentage accuracy of 79%. The final sample size had an accuracy percentage of 77% that is 96 faults were correctly predicted. Whilst the accuracy results were all above 70% additional testing is required to determine accuracy of larger datasets. However, this could not be done since previous records were non-existent and the training set was small. This is a limitation of this study. Future studies should perform the accuracy tests on the larger data set, which will increase rapidly with time. However, in spite of this limitation useful results and lessons learned were obtained regarding the IoT techniques used in the model.

Conclusions

In this paper a theoretical prescriptive model for optimising downtime management is proposed that was derived from a systematic literature review of FSM, IoT and IQ theory. The use of intelligent algorithms and data accessibility are features of the model that can aid in the reduction of downtime. The model also supports geographically dispersed devices and clients. From a practical viewpoint, an organisation in the smart lighting industry was used to test the model as a proof of concept. In the case of the smart lighting scenario, prior to the intervention of our study, an SMS/Ajax polling system was used that was slow and expensive due to the data costs. As a results insufficient data was provided to assist with detecting and diagnosing problems. The solution lacked real-time information and field service technicians had to rely on human 'diagnostics' and sometimes travelling to the smart lights in to physically detect problems. The proposed IoT model for downtime management was used to design an architecture and to develop and implement a system prototype for optimising downtime management in the smart lighting environment.

The evaluations of the prototype revealed that web-sockets are more efficient and cost-effective than other web-based data transfer protocols such as Ajax. The implementation of a web-socket based protocol provided a low-cost data communication protocol with real-time bi-directional capabilities and fully duplex communication between a smart light and a remote server. The use of IoT-enabled communication protocols reduced the latency time and data exchange costs. Furthermore, the web-socket server implements an expert system mechanism using intelligent algorithms for data analysis. The intelligent algorithm, a C4.5 decision tree, automates fault detection and provides an issue report. The intelligent algorithms can assist service technicians to identify and diagnose problems. The practical contributions of this research are therefore the model, which can be used by FSM organisations in the implementation of IoT. The results of the evaluations revealed that the implementation of the various techniques and features of the model optimised downtime within the smart lighting environment. A problem encountered during the study related to restrictions on GSM protocols by the mobile service providers, some of which do not support the use of web-socket connections. Another challenge was inventor patents on the smart lights in the case study that restricted testing of the prototype in its natural environment. As a result only historical data was used for testing. A further limitation was that not all elements of the model could be tested due to time and resource constraints. However, the findings of this study can still be used by other researchers as a valuable source of reference when conducting similar research. The lessons learnt can be useful to other researchers and practitioners working in FSM and similar industries that can benefit from IoT.

The combination of advanced big data analytics, cloud-computing and IoT enables users to not only gather vast amounts of data but also enable them to process it without having to acquire high infrastructural costs. This leads to several opportunities for researchers in these fields. Future research directions could extend the study to include functionality such as predictive maintenance. AI mechanisms can be implemented in the model to support the prediction of faults before they occur. Additional intelligence can be achieved by interacting with other systems in the same environment that have a direct impact on the equipment's performance. The addition of predictive mechanisms as well as enabling object interaction with other systems will transform regular equipment into a self-aware and self-learning machines, and consequently improves overall performance and maintenance management. The model serves as a reference model for standards and protocols in an IoT-based implementation in the field of downtime management within the after-sales industry. Although the study was limited to evaluating the prototype in only one environment it provided valuable lessons that could be used by other practitioners and researchers to guide the implementation of IoT in FSM.

Table 1 .

 1 Prototype components

	Collection and Transmission Phases	Process Management and
			Utilisation Phase
	ProWebSoc	ProObjWeb	ProDT (Interface Layer)
	web socket protocol	web socket client	Web socket server
	Data transmission protocols;	Transmission of data	Intelligent algorithms,
	security and standardisation.	from the smart light and	advanced analytics and
		integration of CPS	interfacing with applications
		principles.	and mobile technologies.

Table 2 .

 2 Experiment Results -RDT and Messages per second

		FIRST PHASE: LOCAL HOST
	Cycle	Num Packets	Time (Sec) Ajax Kapcha	Messages Ajax Kapcha
	1	10	0.130	0.082	80.135	150.235
	2	100	0.435	0.082	301.720	1502.235
	3	1000	3.104	0.558	340.832	2215.621
		SECOND PHASE: REMOTE TESTING
			Time (Sec)	Messages
	Cycle	Num Packets	Ajax	Kapcha	Ajax	Kapcha
	1	10	1.241	3.705	3.212	1.752
	2	100	22.016	17.213	2.907	3.352
	3	1000	153.352	147.25	3.191	3.714

Table 3 .

 3 Accuracy Results

	Size of dataset	Accuracy (%)
	50	82
	100	79
	125	77
	Mean	79

Acknowledgements

The financial assistance of the National Research Foundation (NRF) towards this research is hereby acknowledged. Opinions expressed and conclusions arrived at are those of the author and are not necessarily to be attributed to the NRF.