IoT Security

© Waher Data AB, 2019.
IoT Security

1. Introduction

Ex-Director of National Intelligence
James R. Clapper
http://www.popsci.com/clapper-americas-greatest-threat-is-internet-things
”America's greatest
threat is the
Internet of Things”
Feb 9, 2016

IoT systems particularly vulnerable
 Long-term operation
 Technologies become obsolete
 Lack of updates
 Invisible operation
 No visible clues something is wrong
 No human operator (for normal use case)
 Lack of supervision
 Larger scale
 More units and attack surfaces
 Consumers don’t pay for security
Check with https://www.shodan.io/

2. Problem Domain

Transport Security ≠ Security
Just one aspect

Security ≠ Privacy
Privacy
Subject
perspective
Security
Operator
perspective
MQTT
BlockChain
CoAP
LWM2M
XMPP
HTTPS

Security must encompass entire Life-Cycle
 Production
 Installation
 Configuration (zero-configuration)
 Discovery / Ownership
 Normal Operation / Interoperability
 Discovery / Usage
 Provisioning / Decision Support
 Smart Contracts / Usage
 Economic Feedback
 Transfer of Ownership
 Decommissioning
Life-Cycle
Just one aspect

Open & Transparent Networks
Sealed secure systems?
or
Open, Interoperable, but vulnerable
systems?
or is it possible to have:
Open, Interoperable & secure systems?

3. Design Choices

Protocol choices affect
 Flexibility
 Network topology
 Interoperability
 Scalability
To overcome limitations in protocols,
vulnerabilities are often built in.

Examples of Technology-induced problems
 Topology problem
 Client/Server
 Firewalls
 Centralized Middleware
 Scalability problem
 C10K
 Identity problem
 Reversed roles

Identity Problem
 Identity basis for security decisions
 Problematic with centralized technologies
 Good security/privacy require identity scheme
 Interoperability require federation
Server
Client
Client
Client
Client Client
Server
Server
Server
Server

Federation
 No single centralized authority
 Domains cooperate
 Improves
 Scalability
 Resilience
 Reduces
 Risk

Centralized processing
 Less attack surfaces
 Value of central nodes is huge
 Value/Effort ratio large
 Difficult to protect
External use
Internal use
 Consequences huge
Massive leaks

Decentralization & security
Decentralization has security implications:
 More attack surfaces.
 But value of each node is small.
 Value/Effort ratio small.
 Easier to protect.
 Massive data breaches difficult.
 You don’t put all your eggs into the same basket.
 More resilient.
 End-to-end encryption.

4. Industrial IoT

Industry 4.0
CPS triggers 4th industrial revolution

Paradigm Shift
Industry 3.0 (Automation) Industry 4.0 (CPS)
Centralized (decisions) Decentralized (decisions)
Pre-Planned Ad hoc
Isolated Cross-domain
Local connectivity Inter-connectivity
Proprietary (closed) Interoperable (open)
Reactive Proactive

Motivations
 Adapting processes to current demand
 Interconnecting processes
 Better cooperation between companies
 Better overview
 Shorter downtimes
 Energy efficiency
 Distribution of limited resources

Examples
 Predictive maintenance reduces downtime
 Local cross-domain cooperation
 Advanced logistics include many parties
 Exchange of interoperable information
 Ad hoc networks
 Processes adapt to current demand
 Open markets for services/operations
 Mining
 Transport
 Agriculture
 Increasing energy efficiency
 Distributed information processing (analytics)

Challenges
 Security
 Reliability
 Resilience
 Protection of Intellectual Property
 Standards
 Open Markets
 Decision Support
 Provisioning

5. Smart City/Society

Vision of a Smart City/Society
 Ubiquitous access to interoperable
sensors and things.
 Ubiquitous access to data and
information from society’s authorities.
 Access to smart services in all niches of
society.
 Definition of ownership of information.
 Protection of Privacy, by design and by
default.
 Market for access to things and data.

6. IEEE 1451.99
IoT Harmonization
Open, Interoperable & Secure

IoT Harmonization (IEEE 1451-99)
 Sensor Data
 Control Operations
 Localization (M2M, M2H)
 Tokens for distributed transactions
 Decision Support (for devices)
 Provisioning (for owners)
 Peer-to-Peer communication
 End-to-end encryption
 Concentrator/Bridge (“Thing of things”)
 Discovery
 Ownership
 Clock Synchronization
 Secure Account Creation
 Legal Identities
 Contracts
 Automated provisioning
 Economic feedback
https://gitlab.com/IEEE-SA/XMPPI/IoT

Smart City Lectures*
1. How to build a Smart City
2. Privacy in the Smart City
3. An Open and/or Secure Smart City
4. Harmonizing the Internet of Things
5. Introduction to Encryption
6. Earning by Sharing in the Smart City
https://www.youtube.com/watch?v=8G8ewFxE_V8&index=6&l
ist=PLVYZOLUlo74p7I348560JztHN9NaU51Xg
(*) Funded by Swedish Internet Fund.

 Raspberry Pi & Arduino
 Sensors, Actuators, Controllers,
Concentrators, Bridges
 Protocols:
MQTT, HTTP, CoAP, LWM2M, XMPP
 Social Interaction
 Decision Support
 Product Lifecycle
 IoT Service Platforms
 IoT Harmonization
 Security
 Privacy
Amazon
Packt
Microsoft Store
Contact: https://waher.se/, https://littlesister.se/
Mastering Internet of Things

IoT Security

More Related Content

What's hot (20)

Similar to IoT Security (20)

More from Peter Waher (20)

Recently uploaded (20)

IoT Security