Internet of Things Security and Privacy Concerns

Internet of Things

Security and Privacy Concerns

“Internet of Things” was first coined by the co-founder and Executive Director of MIT’s Auto-ID lab, Kevin Ashton in the mid-1990s¹. Major vendors and technology leaders are announcing initiatives to leverage the Internet of Things’ opportunities, and define IoT differently, according to each of their area of specialty. Nevertheless, there are salient attributes across array of definitions, such as sensors, things, people, process, automation, data, network, connectivity, convergence, and intelligence. Hence, Internet of Things can be defined as “Intelligent interactivity between human and things to exchange information & knowledge for new value creation”.

Characterising IoT by referencing the number of connected devices or connection is oversimplifying the phenomenon. IoT is a complex eco-system encompassing all aspects of the Internet, including analytics, the cloud, application, security and much more. Technologically, connecting things to the Internet can be accomplished with the existence of three main technology components (Figure 1), namely physical devices and sensors (connected things), connection and infrastructure, and analytics and applications.

• 
  Physical devices and sensors
  

• 
  Connection and infrastructure
  

• 
  Analytics and applications
  

Analytics and applications transform sensor-generated information to a new and key source of knowledge for action-taking. They enable users to leverage the large amount of data gather, converge information for further analysis provides actionable insight for the enterprise for productivity enhancement, offer unique solutions, and enhance life experience.

The Internet has evolved (Figure 2) to become an ever more pervasive and critical infrastructure underpinning society and commerce around the globe. In 1990, with the creation of worldwide web (a method of publishing information on the Internet) by Tim Berners-Lee, Internet became the richest source of information, and since then the number of websites has exploded.

Yesterday’s Internet was a universe of interlinked human and creates new generations of interactive experiences. Internet usage had exploded since 1995 to reach the first billion users in 2005. The second billion was in 2010, and the third billion is expected to be reached by the end of 2014².

The next phase of the Internet will be IoT: a world of networked smart devices equipped with sensors, connected to the Internet, all sharing information with each other without human intervention.

With the rise of connected devices and connected individuals, technology experts forecast four interwoven and interaction technology pillars which will fuel and shape the IoT, namely big data, cloud, social media, and mobile devices and things.

• 
  Big Data
  

• 
  Cloud
  

• 
  Social media
  

• 
  Mobile devices/things
  

Several challenges need to be addressed in order to encourage higher growth rate of IoT and subsequently provide opportunities for Universities and the industry to capture new competencies and capacities Several thematic challenges have been identified from various stakeholders of the IoT ecosystem.

• 
  Infrastructure
  

• 
  Data & Information
  

• 
  Security & Privacy
  

• 
  Ecosystem
  

As more connected devices join the IoT ecosystem, researchers has run a range of security tests to expose IoT vulnerabilities, and make the world aware of the potential security concerns of connecting devices without proper security measures. The key threat vectors are described as below:

• 
  Threat Posed by Compromised Devices
  

• 
  Threat over Communication Link
  

Threats against IoT device manufacturer and cloud service providers have the potential to compromise the entire IoT ecosystem, as manufacturer and IoT cloud are entrusted with hosting trillions amount of data, some of which is highly sensitive by nature. This data is important because it represents an analytics, which is a core, strategic asset, it is a significant amount of competitive information in the eyes of underground APT group if exposed. If the Master is compromised, this would give the attacker opportunity to manipulate many devices at once, some of which may have already been deployed in the field. For example, if a provider who issues frequent firmware / software have the mechanism compromised, malicious code could be introduced to the devices.

IoT will be a game changer in many aspects. At the fundamental level, IoT security depends on the ability to identify devices, protect IoT hosting platform, and protect the data that the devices capture and share:

• 
  The Trusted IoT Device
  

• 
  The Trusted IoT Master
  

• 
  Data Integrity
  

Given that the IoT is built on a network of uniquely identifiable devices, public key cryptography plays a huge role in establishing trusted identities in the IoT.

Similarly, a digital certificate contains several fields that help to establish and validate the identity of a device or system as it relates to a corresponding public key. These certificates will be used to identify devices, sign firmware / software updates, and facilitate encrypted communications.

The secure generation and storage of these keys is therefore paramount (Figure 3). PKI should be secure by design and ideally implemented in or protected by tamper-resistant hardware. A root of trust effectively creates a barrier between software on the server and cryptographic key material. This approach greatly mitigates the attack vector which seeks to access sensitive cryptographic keys.

• Data-at-Rest Protection

Encrypting data is all about providing scalable, cost-effective storage, and fast processing of large data sets that facilitates the availability and usage of the said data. Typically, this data will be stored in clusters spread across hundreds to thousands of data nodes. This data is largely unprotected, making each data node a potential entry point for a rogue insider or malicious threat, and leaves sensitive data in clear view should an unauthorised user or service gain access. This presents a tremendous, and potentially costly, risk for organizations.

To overcome this challenge, organizations need to be able to lock down sensitive data at rest in big data clusters without impacting performance. Doing so requires transparent and automated file-system-level encryption that is capable of protecting sensitive data at rest on these distributed nodes.

• 
  Data-in-Motion Protection
  

IoT communication over public networks will need to be secured in much the same way we protect other communications via the Internet. Transport layer security (TLS)²⁰ is a good example of encryption protocols that could be used for this purpose. Encryption is also needed at the back-end infrastructure level of manufacturers, cloud service providers, and IoT solution providers.

Security at the device level, protecting the master, and encrypting communication links are critical to the secure operations of IoT. In addition, leveraging PKI for the IoT ecosystem will allow devices to implement uniquely authentication in order to counteract counterfeits. Securing IoT ecosystem does not require a revolutionary approach. The techniques that have proven success in modern IT environment can be adapted to address the challenges brought by IoT. Instead of searching for a new method, or proposing a revolutionary approach to security, universities and the industry should focus on delivering the current state-of-the-art security controls, and optimise the new and complex embedded applications to drive the further adoption of IoT.