The Value of User and Data Centricity Beyond IoT Devices: Stein Myrseth and Gerhard Zehethofer
0 likes346 views
The document discusses the shift from product-centric to user-centric business models in the context of IoT and data management. It emphasizes the importance of trust, privacy, and security in creating value through customer relationships and new business models. The integration of identity management across devices, services, and users is highlighted as essential for successful digital transformation and IoT security.
The Value of User and Data Centricity Beyond IoT Devices: Stein Myrseth and Gerhard Zehethofer
- 2. Silo Busters: The Value of User and Data Centricity beyond IoT Devices Stein Myrseth Senior Technology Solutions Director ForgeRock Gerhard Zehethofer VP, Industries (IOT & Manufacturing) ForgeRock
- 3. © 2017 ForgeRock. All rights reserved. The Value of User and Data Centricity beyond IoT Device Stein Myrseth & Gerhard Zehethofer Austin May, 2018
- 4. © 2018 ForgeRock. All rights reserved. 4
- 5. © 2017 ForgeRock. All rights reserved. … the data driven age ... … from product centric to customer / solution centricity … Security & privacy Scalability TrustBusiness Value Experience
- 6. © 2018 ForgeRock. All rights reserved. “ … market disruption has been found to be a function usually not of technology itself but rather of its changing application… ”Source: The innovators dilemma
- 7. © 2018 ForgeRock. All rights reserved. New Mobility Working Health & Life Traveling Automotive Connectivity Payment Government Insurance IoT/ Automation … … From Verticals to Horizontals
- 8. © 2018 ForgeRock. All rights reserved. Smart City and Mobility Automotive – build the Connected Car Services around Connected Cars New Mobility – Use cases of physical mobility Smart City - New Mobility & more ECUIDs->CarID ServiceID=CarID+UserID NewMobilityID=ServiceID+User’sPersonas SmartCityID=NewMobilityID+anyothereServiceID OEMSpaceEcosystemSpace
- 9. © 2018 ForgeRock. All rights reserved. Performance Customers Competition Trust 01 02 03 04 • Shifting from asset based to customer intimacy / service • Digital native demanding new experiences; Ease of use • Bespoke has become the norm Changing Customer Behavior • Mandate to reduce cost of operations • Good enough makes it hard to differentiate on product • Lack of product related differentiation • No low hanging fruits left Eroding Margins • Customer satisfaction measures are influenced by digital competition • Digital natives deploy disruptive business models • Digital rewards first movers and superfast followers New players disrupt the status quo • Privacy / New regulatory requirements on Data privacy (GDPR) • Protect IP • Trust / Image / Brand Security Trends That Force Change
- 10. © 2018 ForgeRock. All rights reserved. Performance Customers Competition Trust 01 02 03 04 • Shifting from asset based to customer intimacy / service • Digital native demanding new experiences; Ease of use • Bespoke has become the norm Changing Customer Behavior • Mandate to reduce cost of operations • Good enough makes it hard to differentiate on product • Lack of product related differentiation • No low hanging fruits left Eroding Margins • Customer satisfaction measures are influenced by digital competition • Digital natives deploy disruptive business models • Digital rewards first movers and superfast followers New players disrupt the status quo • Privacy / New regulatory requirements on Data privacy (GDPR) • Protect IP • Trust / Image / Brand Security Trends That Force Change Business Transformation • New revenue streams • New business models (transaction to service) • Value creation; value capture Customer 360 Business Optimization • Maximizing value of existing assets / investments • Increased / new efficiency • Incremental shift to OpEx Enterprise 360 The market is driven by two forces Trust creates value
- 11. © 2018 ForgeRock. All rights reserved. PWC Future of customer experience survey 2017/18 Q: When it comes to overall customer experience, how important do you think each of the following will be in the future? Which of the following things are worth paying for Attribute that can be categorized as Customer/enterprise 360 and trust are coming out on top ü Efficiency ü Convenience ü Knowledgeable Service ü Easy payment Followed by ü Up to date technology 11 What People Value Most In Their Customer Experience Source: PWC
- 12. IoT Convergence Identity Platform ASSETS ORGANIZATIONS USERS CONSUMERS
- 13. © 2018 ForgeRock. All rights reserved. Customer IAM Enterprise Supply chain FactoryReporting Audit RMA … Service Digital Identity for people Digital Identity for things ForgeRock trusted relationships IAMCIAM Audit No identity LegacyLegacy IOT point solutions (Silos) Industry specific
- 14. © 2018 ForgeRock. All rights reserved. Digital Business - With Identity as The Driver KNOW YOUR CUSTOMER SECURE DATA SHARING INTEROPERABILITY IOT SECURITY TRUSTED DIGITAL RELATIONSHIPS CUSTOMER EXPERIENCE Digital Identity
- 15. © 2018 ForgeRock. All rights reserved. Value Added Services - Leveraging Identities KNOW YOUR CUSTOMER SECURE DATA SHARING INTEROPERABILITY TRUSTED DIGITAL RELATIONSHIPS Digital Identity CUSTOMER EXPERIENCE IOT SECURITY
- 16. © 2018 ForgeRock. All rights reserved. ForgeRock Edge Security Suite
- 17. © 2018 ForgeRock. All rights reserved. © 2018 ForgeRock. All rights reserved. Why IoT Security Is Hard To Do Chip-2-Cloud Gateway Security End Node Security Application Security User Security BLE, Thread, ZWave TLS, SSL, PKI…. Application key uid, pwd, 2FA uid, pwd How to guarantee privacy and confidentiality ? Account Security
- 18. © 2018 ForgeRock. All rights reserved. #1 Top IoT Security Trends to Watch in 2018 The Identity of Things (IDoT) Trusted identity is the foundation of IoT security. It’s critical that traditional identity and access management (IAM) systems are extended to encompass all entities in IoT ecosystems— humans, devices, applications, and services.
- 19. © 2016 ForgeRock. All rights reserved. Evolution Of IoT & Internet Compared Through three phases Internet Real-time Secure encrypted transport and transactions. Two factor, biometric, password less authentication. Adaptive and context driven authorization, and user managed access. Interactive, co-creative web, interoperable profiles, integrated games, education and business, augmented reality, multi device support, federated and global identities. Share Two way, blogs, wikis, video, podcasts, sharing, personal publishing, social networks, Single Sign-On, SAML federation, transactional web, secure payments Presence Internet connected, retrieve data, multi-protocol, multi- vendor solutions Internet of Things Real-time Root of trust at the edge, onboard trusted identities, secure and trusted automation, data privacy, data encryption. Cross IoT ecosystems trust and sharing with a single security domain across IoT, consumer, customers and enterprise Share Single device identities, secure connect and onboard, connect or pair consumer devices and users, enterprise collect and share data across consumers, customers and enterprise. Closed ecosystems, disconnected security across users and IoT Presence Internet connected, retrieve data, multi-protocol, multi- vendor solutions
- 20. © 2018 ForgeRock. All rights reserved. © 2018 ForgeRock. All rights reserved. Extending the ForgeRock Platform To the Edge One single security domain BIG DATALittle Data End-to-End Security, Web, Data Objects & Management IP and Web to the edge Solutions Edge Identity Platform • Consumers • Customers • Partners • Contractors • Employees • … IoT Services Enterprise
- 21. © 2018 ForgeRock. All rights reserved. “A digital twin reflects physical objects like people or internet of things using a digital representation to better understand, predict, and control the cyber physical world.” Digital Twin
- 22. © 2018 ForgeRock. All rights reserved. Credentials - users & IoT Passport High assurance Driver’s License Medium assurance Conference Badge Low assurance Credential based on strong identity, from trusted authority Attestation based on chip-level credential security Credential only trusted within a given context Attestation given operating system level security Credential defined implicit Attestation using device-derived credential
- 23. © 2018 ForgeRock. All rights reserved. IEC – Southbound Services • Attestation, onboarding itself automatically at first boot (digital twin) • Service status • Attestation, onboarding of edge nodes & services (3rd party trust, digital twin) • Authorize itself and edge nodes/services - retrieve JWT token payload • JIT configuration – real time and context driven • Sign data key • Encrypt data key • Initiate device pairing/claim ownership - 2 step process • Token validation (offline support) • Token re-issuing (offline support) • Bidirectional channel to send action/message to edge like “update” For building secure OEM edge applications
- 24. © 2018 ForgeRock. All rights reserved. ForgeRock Identity Edge Controller Build trust into IoT systems from end to end Constrained Devices Unconstrained Devices Edge nodes Edge Gateway OEM service Edge Controller Embedded OS Core ZeroMQ* API Trustzone Trusted Agent Identity Message Broker MQTT client Identity Platform FIDO 2.0 Server FIDO - Relaying party FIDO Client *CurveZMQ NFC/BLE/Bluetooth… sensors & actuators smart devices S D K S D K
- 25. © 2018 ForgeRock. All rights reserved. Identity Edge Controller ForgeRock OP-TEE Intel SDO Samsung Trustware Infineon TPM HW root of trust integration layer (global platform) Yubico FIDO FIDO (Relaying party) A Pluggable HW Security Architecture Trustonic
- 26. Chain of Trust – Edge to Cloud Root of trust Signature Crypto key Second stage Boot loader Signature Crypto key Operating System Signature Crypto key Edge Controller Secure Execution Environment Signature Crypto key Access Management Cloud/Premise Identity Platform Signature Crypto key First stage Boot loader BIG DATALittle Data End-to-EndSecurity, Web, Data Objects & Management IP and Web to the edge Solutions Edge Identity Platform • Consumers • Customers • Partners • Contractors • Employees • … IoT Services Enterprise
- 27. © 2018 ForgeRock. All rights reserved. Data Control ZigBee,Z-Wave,Thread,6LowPAN, Sigfox,LoRaWAN,Bluetooth Identity Platform BIG DATALittle Data End-to-EndSecurity, Web, Data Objects & Management IP and Web to the edge Solutions Edge Identity Platform • Consumers • Customers • Partners • Contractors • Employees • … IoT Services Enterprise ForgeRock – Edge Security
- 28. © 2018 ForgeRock. All rights reserved. Identity Platform Hospitality IOT platform Identity Edge Controller Control plane • attestation • on-boarding • provisioning • authentication • authorization Data plane • authenticate • authorize • interaction • secure messaging • data encryption Guest • authenticate • authorize • hospitality application • loyalty program • Personalize, preferences Bluetooth/BLE • proximity based security • secure pairing/device relationships • offline mode support Service backend • backend operations • data access • data sharing and consumptions • access policies enforcement • data decryption Accountant Husband Insurance Hotel receptionist - access granted by owner
- 29. © 2018 ForgeRock. All rights reserved. Connected Car Ecosystem Control • attestation • on-boarding • provisioning • authentication • authorization Messaging • authenticate • authorize • interaction • secure messaging • data encryption Driver • authenticate • authorize • In-vehicle Application • manage data sharing • data capture Bluetooth/BLE • proximity based security • secure pairing/device relationships • offline mode support Devices • Operations • Data Service backend • backend operations • data access • data sharing and consumptions • access policies enforcement • data decryption Mechanic/specialist Husband Family Maintenance Portal - access granted by car owner Car Owner / Driver
- 30. ForgeRock Edge security • Enterprise Security for IoT • SCADA, Industrial Control Systems, Med-Tech and all embedded systems • Secure IoT Devices to Protect Against Attacks • Edge computing • Over the Air Update (OTA) • High performance secure messaging Value added partners at the edge
- 31. Protecting IP From Capturing To Consumption Root of trust Signature Crypto key Second stage Boot loader Signature Crypto key Operating System Signature Crypto key Edge Controller Secure Execution Environment Signature Crypto key OpenAM Cloud/Premise Identity Platform Signature Crypto key First stage Boot loader Trust IntegrityConfidentiality Security Data Quality User Privacy
- 32. Securing Digital Identities for People, Devices, and Things Copyright © 2018 ForgeRock. All Rights Reserved. • Privacy and Consent • Intelligent Authentication • Complex Relationships • Scalable, Unified Platform • Contextual Identity • A decade of innovation • ANY IDENTITY • ANY DEPLOYMENT • ANY SCALE - IoT NATIVE -