Presentation about Security for Internet of Things, Industrial Internet of Things, Industry 4 and Smart Cities & Societies held at IEEE P2668.

1. © Waher Data AB, 2019.
IoT Security

2. © Waher Data AB, 2019.
1. Introduction

3. Ex-Director of National Intelligence
James R. Clapper
http://www.popsci.com/clapper-americas-greatest-threat-is-internet-things
”America's greatest
threat is the
Internet of Things”
Feb 9, 2016

4. © Waher Data AB, 2019.
IoT systems particularly vulnerable
 Long-term operation
 Technologies become obsolete
 Lack of updates
 Invisible operation
 No visible clues something is wrong
 No human operator (for normal use case)
 Lack of supervision
 Larger scale
 More units and attack surfaces
 Consumers don’t pay for security
Check with https://www.shodan.io/

5. © Waher Data AB, 2019.
2. Problem Domain

6. © Waher Data AB, 2019.
Transport Security ≠ Security
Just one aspect

7. © Waher Data AB, 2019.
Security ≠ Privacy
Privacy
Subject
perspective
Security
Operator
perspective
MQTT
BlockChain
CoAP
LWM2M
XMPP
HTTPS

8. © Waher Data AB, 2019.
Security must encompass entire Life-Cycle
 Production
 Installation
 Configuration (zero-configuration)
 Discovery / Ownership
 Normal Operation / Interoperability
 Discovery / Usage
 Provisioning / Decision Support
 Smart Contracts / Usage
 Economic Feedback
 Transfer of Ownership
 Decommissioning
Life-Cycle
Just one aspect

9. © Waher Data AB, 2019.
Open & Transparent Networks
Sealed secure systems?
or
Open, Interoperable, but vulnerable
systems?
or is it possible to have:
Open, Interoperable & secure systems?

10. © Waher Data AB, 2019.
3. Design Choices

11. © Waher Data AB, 2019.
Protocol choices affect
 Flexibility
 Network topology
 Interoperability
 Scalability
To overcome limitations in protocols,
vulnerabilities are often built in.

12. © Waher Data AB, 2019.
Examples of Technology-induced problems
 Topology problem
 Client/Server
 Firewalls
 Centralized Middleware
 Scalability problem
 C10K
 Identity problem
 Reversed roles

13. © Waher Data AB, 2019.
Identity Problem
 Identity basis for security decisions
 Problematic with centralized technologies
 Good security/privacy require identity scheme
 Interoperability require federation
Server
Client
Client
Client
Client Client
Server
Server
Server
Server

14. © Waher Data AB, 2019.
Federation
 No single centralized authority
 Domains cooperate
 Improves
 Scalability
 Resilience
 Interoperability
 Reduces
 Risk

15. © Waher Data AB, 2019.
Centralized processing
 Less attack surfaces
 Value of central nodes is huge
 Value/Effort ratio large
 Difficult to protect
External use
Internal use
 Consequences huge
Massive leaks

16. © Waher Data AB, 2019.
Decentralization & security
Decentralization has security implications:
 More attack surfaces.
 But value of each node is small.
 Value/Effort ratio small.
 Easier to protect.
 Massive data breaches difficult.
 You don’t put all your eggs into the same basket.
 More resilient.
 End-to-end encryption.

17. © Waher Data AB, 2019.
4. Industrial IoT

18. © Waher Data AB, 2019.
Industry 4.0
CPS triggers 4th industrial revolution

19. © Waher Data AB, 2019.
Paradigm Shift
Industry 3.0 (Automation) Industry 4.0 (CPS)
Centralized (decisions) Decentralized (decisions)
Pre-Planned Ad hoc
Isolated Cross-domain
Local connectivity Inter-connectivity
Proprietary (closed) Interoperable (open)
Reactive Proactive

20. © Waher Data AB, 2019.
Motivations
 Adapting processes to current demand
 Interconnecting processes
 Better cooperation between companies
 Better overview
 Shorter downtimes
 Energy efficiency
 Distribution of limited resources

21. © Waher Data AB, 2019.
Examples
 Predictive maintenance reduces downtime
 Local cross-domain cooperation
 Advanced logistics include many parties
 Exchange of interoperable information
 Ad hoc networks
 Processes adapt to current demand
 Open markets for services/operations
 Mining
 Transport
 Agriculture
 Increasing energy efficiency
 Distributed information processing (analytics)

22. © Waher Data AB, 2019.
Challenges
 Security
 Reliability
 Resilience
 Protection of Intellectual Property
 Standards
 Interoperability
 Open Markets
 Decision Support
 Provisioning

23. © Waher Data AB, 2019.
5. Smart City/Society

24. © Waher Data AB, 2019.
Vision of a Smart City/Society
 Ubiquitous access to interoperable
sensors and things.
 Ubiquitous access to data and
information from society’s authorities.
 Access to smart services in all niches of
society.
 Definition of ownership of information.
 Protection of Privacy, by design and by
default.
 Market for access to things and data.

25. © Waher Data AB, 2019.
6. IEEE 1451.99
IoT Harmonization
Open, Interoperable & Secure

26. © Waher Data AB, 2019.
IoT Harmonization (IEEE 1451-99)
 Sensor Data
 Control Operations
 Localization (M2M, M2H)
 Tokens for distributed transactions
 Decision Support (for devices)
 Provisioning (for owners)
 Peer-to-Peer communication
 End-to-end encryption
 Concentrator/Bridge (“Thing of things”)
 Discovery
 Ownership
 Clock Synchronization
 Secure Account Creation
 Legal Identities
 Contracts
 Automated provisioning
 Economic feedback
https://gitlab.com/IEEE-SA/XMPPI/IoT

27. © Waher Data AB, 2019.
Smart City Lectures*
1. How to build a Smart City
2. Privacy in the Smart City
3. An Open and/or Secure Smart City
4. Harmonizing the Internet of Things
5. Introduction to Encryption
6. Earning by Sharing in the Smart City
https://www.youtube.com/watch?v=8G8ewFxE_V8&index=6&l
ist=PLVYZOLUlo74p7I348560JztHN9NaU51Xg
(*) Funded by Swedish Internet Fund.

28. © Waher Data AB, 2019.
 Raspberry Pi & Arduino
 Sensors, Actuators, Controllers,
Concentrators, Bridges
 Protocols:
MQTT, HTTP, CoAP, LWM2M, XMPP
 Interoperability
 Social Interaction
 Decision Support
 Product Lifecycle
 IoT Service Platforms
 IoT Harmonization
 Security
 Privacy
Amazon
Packt
Microsoft Store
Contact: https://waher.se/, https://littlesister.se/
Mastering Internet of Things