Security Vulnerability Analysis and Secure Architecture Design for Low-Cost IoT-Based Smart Home Systems: A Case Study from Sub-Saharan Africa

This working paper presents a systematic security vulnerability analysis of a low-cost, voice-controlled IoT-based smart home monitoring system built with Arduino UNO, ESP8266, Amazon Alexa, and serverless cloud platforms (ThingSpeak, Backendless, PushingBox), originally deployed and tested in Bujumbura, Burundi. Using the STRIDE threat-modeling framework and attack-surface analysis, the study identifies twelve vulnerabilities — four critical, five high, and three medium severity — across the system's three-tier architecture, including unencrypted HTTP communications, hardcoded API credentials, absence of mutual authentication, cloud-platform single points of failure, and lack of firmware integrity verification. For each vulnerability, a qualitative severity assessment and a concrete mitigation strategy are proposed. Building on this analysis, an enhanced secure architecture is designed, incorporating TLS/SSL encryption, MQTT over TLS with certificate-based authentication, API key rotation, a local edge-computing gateway (Raspberry Pi), and firmware over-the-air (OTA) update with integrity verification. The proposed architecture preserves cost-effectiveness (approximately 85 USD for the core secure design; about 90 USD with optional tamper-evident hardware) while substantially strengthening the system's security posture. This is a design-level analysis; empirical penetration testing and full implementation are identified as future work. This is a thesis-derived working paper, self-archived by the author and not peer-reviewed. It is a companion security analysis to the author's system-design working paper (Zenodo DOI: https://doi.org/10.5281/zenodo.21188655), and derives from the author's 2021 bachelor's degree project at the International University of Equator (IUE), Bujumbura.