Securing the IoT is complex given that the the devices are constrained and applications are deployed to work with the physical world. In this, presentation, I have proposed a set of design guidelines for securing the IoT Applications

1. SECURING THE INTERNET OF THINGS
SYAM MADANAPALLI | CHAIR, IEEE P1931.1

2. THE INTERNET OF THINGS
The Context Data & Analytics Information & ActionsThe State
BLE,ZigBee,WiFi
TheEnvironment
Insights&Workflow
Ethernet/LTE/FTH
RESTAPI
The Roof The CloudThe Things The Apps & Services
2

3. IOT SECURITY IS COMPLEX
3
Constrained
Devices
Big Scale
Tech Illiterates
Lack of UI & challenging
to configure, prone to
errors and easy to attack
Applications & devices
are personal, and involves
humans & physical world
Variety of devices,
protocols, &
applications
Big Impact
Safety & economic risks,
loss of privacy and
business interruptions

4. THE CONSTRAINED DEVICES
Provide an indirection for
computing resources.
4
Limited Power
Limited Bandwidth
Limited Computing
Cannot protect
themselves.
Vulnerable to
DoS attacks

5. THE END USERS ARE TECH ILLITERATES
Reduce the technology
complexity and ease
their role.
Lack of knowledge, transparency and impact
Loss of privacy, and safety & economic risks
Secure Provisioning
Privacy Management
5

6. Make them autonomous,
decentralized & resilient.
THE SCALE
6
Bigger Attack Space
Big Data
Day-to-Day Usage
Diversity
Lack of Experience
Variety of protocols, devices,
applications, environments
users, vendors.
More personal
Realtime information
Poor design

7. THE BIG IMPACT
Business interruption,
Damage to reputation
& economic risks
Theft of Personal Data Safety Risks
Hijacking Physical Assets
Allow communication to
IoT applications only
from trusted sources!
7

8. WHO IS RESPONSIBLE FOR THE SECURITY?
Standards will bring the ecosystem together to build the secure systems.
8
Device
Manufacturers
Software
Vendors
Network
Builders
Service
Providers
Policy
Makers

9. THE NEED FOR AN IOT SECURITY STANDARD
9
Need to be a standard
Differentiator
Applications/Services
IoT Services
Devices
IoT Security
Scalable and trustworthy IoT applications require a security standard with a
minimal set of protocols & Businesses should compete on application/Service
level innovation!

10. IOT SECURITY != CYBER SECURITY
10
Secure Provisioning + Secure Key
Management + Authentication &
Authorization + Secure Communication
Network Security =
IoT Security
Root of Trust
Network Security
Secure Software Updates
Privacy

11. A NEW THINKING FOR IOT SECURITY
Indirection
Computing assistance
Resilient
Ability to isolate & recover
Accountability
Ability to prosecute
Autonomy
Function independently
Decentralized
Dispersed functions
11

12. A FEDERATED ARCHITECTURE
A learning from human evolution for distributed security architecture.
12
Homes Cities States The World
Self protection,
best practices
Enforcement by
the state law
Cooperation &
coalition
Global cooperation
& programs

13. SECURING THE INTERNET OF THINGS
Uninternetting
Don’t expose things over the Internet
Indirection
Move security computing one level up
Security Gate
Allow only trusted sources
Security Fusion
Contextual analysis
Multi Factor Authentication
Extra layers of security
A combination of these would help in building robust protection against the threats.
13

14. UN-INTERNETTING
The Roof The Local ServerThe Things The Passive Cloud
Intermittent
Connectivity
Always-on
Connectivity
14

15. IOT SECURITY BY INDIRECTION
Communication
Security Negotiation
Resource Owner
Security Manager
Resource ServerClient
Security Provisioning
Security Provisioning
Security Provisioning
Security Provisioning
Cloud
Roof
Things
15

16. SECURITY GATE - SECURITY SERVICES
16
Trusted
Environment
Security
Service
Provider
IPSec Tunnels
The Internet
Cloud Apps
Roof
Trusted Party
(PKI)
Untrusted
Party

17. PKI FOR IDENTITY
PKI binds public keys with respective identities of entities/actors.
Security
Service
Provider
IPSec Tunnels
Validation
Authority
Roof
Trusted Party
Certification
Authority
Requesting
Authority
Blockchain
Secure Communication
17

18. SECURITY FUSION
Security Fusion
Security by design
Contextual analysis
Multi factor authentication
Prevent DoS attack on devices
Minimize device computing
18
Authorization
Authentication
Channel
Security
Security Fusion
Security
Management
Root of Trust

19. SECURING THE NETWORK SEGMENTS
CloudPAN WANLAN Internet
IPSec Tunnel
CoAP/UDP/DTLS/IPv6
IPSec Tunnel
WiFi/
Ethernet
BB/LTE/MPLS
OTAE
BLE,802.15.4,WiFi
SSPEdge Router
Apps
19

20. ROOT OF TRUST & AUTOCONFIGURATION
HW Root of Trust*
Device ID
Ownership
Owner ID
Device Configuration
& Service Identification
Service
Enablement
Blockchain/
Trusted Database
PKI
20

21. CLASSES OF IOT DEVICES
21
Class 0 Class 1 Class 2
RAM, ROM, IP
< 10KB, 100KB,
No IP
~ 10KB, 100KB,
CoAP
~ 50KB, 250KB,
IPv6, HIP
Cryptography Over the air
Symmetric
cryptography
PKI based
Protection One level up
Assisted at one level
up
Self and services at
one level up
Interface IoT Services
Security Provisioning
and Services
Security Services
Applications
Only for trusted
environments
Battery powered
under the Roof
Mains powered &
standalone devices

22. FUNCTIONAL ASPECTS OF IOT SECURITY
22
Channel Security - Protect the
communication path
Cooperation - share information and
learn best practices
Security Fusion - Detect, block and
report unauthorized access attempts
Root of Trust - Secure boot capabilities
Security Management - key
management, policies, security updates
Security Services - protect the resources
and manage vulnerabilities
Data Protection - Protect the data at rest
in the servers and equipment
Identify, Authentication and
Authorization - Allow access only to
authorized entities & accountability
Security Bootstrapping - Initial security
configuration and procedures
These need to be supported for constrained devices in constrained
environments.
Secure Software Updates - Secure
updates for bugs, vulnerabilities and
feature additions

23. PRIVACY MANAGEMENT
Informed Decision
Making End-to-End Transparency
Weighing Privacy vs.
Benefits
Contextual Awareness Privacy by Design Government Regulations
23

24. STRATEGIC PRINCIPLES FOR IOT SECURITY
* United States Department of Homeland Security, November 2016
Incorporate security at the
design phase
Promote security updates
and vulnerability
management
Build on proven security
practices
Prioritize security
measures according to
potential impact
Promote transparency
across IoT
Connect carefully and
deliberately
1 2 3
4 5 6
24

25. THANK YOU!
SMADANAPALLI@GMAIL.COM | @SMPALLI