The Internet of Things in a Smart Home

The Internet of Things, or IoT, is the idea of linking everyday objects to a network. Once linked, they can share data and act on it. The best-known formal definition comes from the International Telecommunication Union (ITU).

What is the official definition?

ITU-T Recommendation Y.2060 was approved on 15 June 2012. It defines IoT as “a global infrastructure for the information society”. It adds that this infrastructure works by “interconnecting (physical and virtual) things”.

The same text says the IoT makes use of identification, data capture, processing and communication. It also says security and privacy requirements must be fulfilled.

What is a “thing” and what is a “device”?

ITU keeps these two words apart.

• A thing is an object of the physical world or the information world. It can be identified and joined to a network.
• A device is a piece of equipment. Communication is a mandatory capability for it.
• Sensing, actuation, data capture, storage and processing are optional capabilities of a device.

Actuation means making something happen, such as switching a geyser on.

Has the number changed?

Y.2060 was renumbered as Y.4000 on 5 February 2016. The text was not changed.

What should you remember?

IoT is not one gadget. It is a system of things, networks and services. The smart home is only one example of it.

The scenario has many gadgets. Each one plays a simple role. Once you see the roles, the answer is easy.

What are the building blocks?

ITU’s reference model has four layers.

• The application layer holds the IoT applications.
• The service support layer gives common help, such as data processing and storage.
• The network layer handles connectivity and transport of data.
• The device layer holds the devices and gateways.

ITU adds management and security capabilities that cut across all four layers.

What can a device do in the device layer?

• It can talk to the network directly.
• It can talk through a gateway instead.
• It can form ad-hoc networks where quick set-up is needed.
• It can “sleep” and “wake up” to save energy.

A gateway is a helper that links simple devices to the wider network. A smart-home hub often plays this role.

How does the scenario map to these ideas?

• The alarm and the geyser show actuation. A signal on the phone makes a heater switch on.
• The smart mirror shows weather and tank level. It receives data from other systems and from a sensor.
• The fridge notices low stock and places an order. It senses and then calls a service.
• The lights, fans and AC switch off when you lock the door. One event triggers many actions.
• The car gets live traffic data and sends a message. Here the car is a device in a wider network.

What traits make IoT different from the plain internet?

ITU lists four.

• Interconnectivity: anything can join the global network.
• Heterogeneity: devices use different hardware and networks.
• Dynamic changes: devices sleep, wake, connect and disconnect.
• Enormous scale: the number of devices will far exceed today’s internet devices.

The three wrong options are real, important terms. That is what makes the question tricky. None of them describes a household of devices acting together.

What is the Border Gateway Protocol?

BGP is an inter-Autonomous System routing protocol. Its main job is to exchange network reachability information between BGP systems. The big networks of the internet use it to learn which paths exist.

What is the Internet Protocol?

The Internet Protocol carries blocks of data, called datagrams, from a source to a destination. Hosts are identified by fixed-length addresses. It does not decide what a fridge or a geyser should do.

A common slip is to call both BGP and IP “routing standards”. BGP is the routing protocol. IP is the protocol that addresses and delivers datagrams.

What is a Virtual Private Network?

A VPN gives private communication over a shared network. NIST describes IPsec VPNs as a way of “ensuring private communications over Internet Protocol (IP) networks”. It protects the link, not the behaviour of household appliances.

How do you spot the answer quickly?

• Read the verbs in the scenario: alarm, order, switch off, warn.
• These are devices acting on their own, without a person in the loop.
• Only the Internet of Things describes that.

A smart home mixes radios. A phone may use Wi-Fi, a door lock may use Bluetooth, and a sensor may use a low-power mesh. Matter is the newer standard that tries to make them work together.

Which radio technologies are common?

• Wi-Fi is one of the two network layers that Matter runs on, along with Thread.
• Zigbee is a low-power mesh. The Connectivity Standards Alliance (CSA) calls it self-healing, with no single point of failure.
• Thread is a low-power, low-latency wireless mesh. It uses the IEEE 802.15.4 radio layer and carries IP traffic.
• Bluetooth Mesh suits systems where hundreds or thousands of devices must talk to each other.
• NFC works at a base frequency of 13.56 MHz. The NFC Forum gives a typical range of up to 2 cm.

IEEE 802.15.4 is the standard for low-data-rate wireless links. It is meant for devices with no battery or very limited battery use.

What is a mesh network?

In a mesh, devices pass messages along for each other. If one device fails, the others find another path. That is why meshes suit many small sensors.

What is Matter?

Matter is a smart-home standard from the Connectivity Standards Alliance. It is built on the Internet Protocol. CSA says it lets devices from many brands work together natively.

CSA lists four promises: simplicity, interoperability, reliability and security.

How has Matter grown recently?

• 11 August 2025: Matter 1.4.2 added Wi-Fi-only commissioning. A device no longer needs a Bluetooth radio just for set-up.
• 11 August 2025: the same release set tougher rules for routers. A Thread Border Router built into a router or access point must support at least 150 devices.
• 20 November 2025: Matter 1.5 added cameras, closures and soil sensors, plus new energy features.

Matter cameras stream live video and audio using WebRTC. They also support privacy zones and local or cloud recording.

Is Matter a new internet?

No. Matter sits on top of existing radios such as Wi-Fi and Thread. It is a shared language for devices, not a new network.

India treats IoT as a mix of telecom, electronics and urban policy. Different bodies look after different parts.

What has the Department of Telecommunications done?

DoT calls M2M and IoT one of the fastest emerging technologies. M2M means machine-to-machine communication.

• It issued guidelines on 8 February 2022 to register M2M Service Providers and WPAN/WLAN Connectivity Providers.
• It added 1 MHz to the unlicensed 865-867 MHz band, making it 865-868 MHz, for M2M and IoT use.
• It released a 13-digit numbering plan just for M2M devices on mobile networks.
• It allowed embedded SIMs that telecom operators configure over the air.
• On 7 January 2024 it extended registration to all entities, through the SaralSanchar portal.

DoT says registration addresses worries about KYC, traceability, security and encryption.

What does the Telecommunication Engineering Centre add?

TEC is the technical wing of DoT. It adopted oneM2M Release 2 as a national standard in January 2020. By July 2023 it had released 19 technical reports on M2M and IoT.

The National Digital Communication Policy 2018 aims for a secure ecosystem for 5 billion connected devices. It names smart cities and smart electricity meters among the target uses.

What has MeitY done?

Under Digital India, MeitY set up Centres of Excellence on IoT with NASSCOM and state governments. They are at Bengaluru, Gurugram, Gandhinagar and Visakhapatnam. In January 2024 a Centre of Excellence in Intelligent IoT Sensors opened at Maker Village, Kochi.

Where do you see IoT at scale?

• All 100 Smart Cities have Integrated Command and Control Centres. They use data to manage traffic, water and waste. The Smart Cities Mission began on 25 June 2015.
• By 31 December 2025, India had installed 5.28 crore smart meters. Of these, 3.90 crore came under the Revamped Distribution Sector Scheme.
• The scheme was launched in July 2021. Its sanctioned works cover 19.79 crore consumers.

Each new device is a new door into the home network. Many devices are small and cheap. Some ship with weak passwords and never get updates.

What happened with Mirai?

In September 2016 a botnet called Mirai hit a security blogger’s website. The attack exceeded 620 gigabits per second. A botnet is a network of infected devices that attackers control.

Mirai scanned the internet for vulnerable IoT devices. It tried a short list of 62 common default usernames and passwords. The US cyber agency CISA says this let it reach hundreds of thousands of devices.

India’s CERT-In FAQ also names Mirai. It says IoT devices such as cameras, routers and wearables are being attacked more often. A hacked device can become an entry point into an organisation’s internal network.

What does good practice look like?

ETSI EN 303 645 is a European standard for consumer IoT security. Its scope names smart cameras, speakers, door locks, baby monitors and connected fridges. Two of its provisions matter most.

• No universal default passwords: passwords must be unique per device or set by the user.
• Keep software updated: all software components should be securely updateable.

Why do these two matter?

Mirai worked because of shared default passwords. Unpatched software stays open to known attacks. So these rules close the two easiest doors.

What can a household do?

• Change default passwords when you set up a device.
• Install updates when the maker offers them.
• Keep cameras and speakers on a separate guest network if the router allows it.
• Do not buy devices that have no update support.

India has no single IoT law. Protection comes from several instruments. Each covers one side of the problem.

What do the CERT-In Directions say?

CERT-In issued Directions on 28 April 2022 under section 70B(6) of the IT Act, 2000. They apply to service providers, intermediaries, data centres, body corporates and government organisations.

• Cyber incidents listed in Annexure I must be reported within 6 hours of noticing them.
• Annexure I includes attacks on IoT devices and their associated systems.
• Entities must keep logs of ICT systems for a rolling 180 days, inside India.
• They must sync system clocks with NTP servers of NIC or NPL.
• The Directions became effective 60 days after issue. Non-compliance can invite action under section 70B(7).

If full details are not ready in six hours, entities report what they have. They can add more later.

What does STQC do?

The Standardisation Testing and Quality Certification (STQC) Directorate of MeitY runs the IoT System Certification Scheme. It tests the security of IoT devices and systems.

For CCTV cameras, the scheme tests against the Essential Requirements in MeitY’s notification of 6 March 2024. One test checks that a camera does not boot when given a tampered boot image. This is called secure boot.

What does the DPDP Act add?

The Digital Personal Data Protection Act was enacted on 11 August 2023. The Rules were notified on 14 November 2025, with 18 months for phased compliance.

A smart camera or speaker can collect personal data. So the Act’s duties apply to whoever decides why and how that data is used.

• Failing to keep reasonable security safeguards can attract a penalty up to Rs 250 crore.
• Not telling the Board or the people affected about a breach can attract up to Rs 200 crore.
• The Data Protection Board of India oversees compliance.

How do the three fit together?

CERT-In asks for fast reporting. STQC tests the product itself. The DPDP Act protects the data it produces.

UPSC Prelims 2018, GS Paper I, Series A, Q66, gave a long morning-routine story. The candidate had to name the technology.

What was the question?

When the alarm of your smartphone rings in the morning,
you wake up and tap it to stop the alarm
which causes your geyser to be switched on automatically.
The smart mirror in your bathroom shows the day’s weather and also indicates the level of water in your overhead tank.
After you take some groceries from your refrigerator for making breakfast,
it recognises the shortage of stock in it
and places an order for the supply of fresh grocery items.
When you step out of your house and lock the door, all lights, fans, geysers and AC machines get switched off automatically.
On your way to office,
your car warns you about traffic congestion ahead
and suggests an alternative route,
and if you are late for a meeting, it sends a message to your office accordingly.

In the context of emerging communication technologies, which one of the following terms best applies to the above scenario ?

• (a) Border Gateway Protocol
• (b) Internet of Things
• (c) Internet Protocol
• (d) Virtual Private Network

The official key for Series A gives (b).

Why is (b) right?

Every action in the story is a connected object sensing, deciding or acting on its own. That matches ITU’s idea of interconnecting things to offer services.

Why are the others wrong?

• BGP is a routing protocol between networks.
• IP delivers datagrams. It is the carrier, not the behaviour.
• A VPN protects a link. It does not automate a home.

How do you answer such a question fast?

Ignore the length. Look at the last line. It asks for the emerging technology that fits the whole scene. Only (b) names a technology about devices.