Wireless Security and the Internet of Things Nick Hunn

Size: px

Start display at page:

Download "Wireless Security and the Internet of Things Nick Hunn"

Louisa Paul
8 years ago
Views:

1 Wireless Security and the Internet of Things Nick Hunn WiFore Consulting

2 The Legal Requirement In the EU proposal for the revision of the R&TTE directive, it states that: Article 3 Radio equipment shall be so constructed that it complies with the following essential requirements: (c) radio equipment incorporates safeguards to ensure that the personal data and privacy of the user and of the subscriber are protected;

to ensure that the personal data and privacy of the user and of the subscriber are protected; https://www.gov.

3 Some examples of what has been hacked Pacemakers Insulin Pumps Weir Gates Set Top Boxes Fitness Monitors Smart Meters

4 The Consequences of Hacking People know where you are. People know where you aren t. People know who you re with. People know what you re doing. People think you re someone else. Your lights go out. Your bills go up. Things stop working. Things start working differently. Your business fails.

People know what you re doing. People think you re someone else.

5 What is the Internet of Things? Some are born with Sensors, Some acquire sensors, and Some have sensors thrust upon them.

6 Machine to Machine (M2M) Many current M2M deployments are cellular

7 Appcessories and The Quantified Self Consumer growth is most likely to come from the world of Appcessories. Find out more about Appcessories at

8 The Smart Home It will take time coming, but homes will get monitored.

9 To 40 billion and Beyond

10 Millions The missing 25 billion may be Desirable 14,000 Annual Sales of Appcessories 12,000 10,000 8,000 6,000 4,000 2,000 - Source: WiFore Consulting

11 Which gives 40 billion opportunities to steal or corrupt someone s data. Every second of every day

12 Addressing Security

13 The Topology of the Internet of Things Sensors db & App Where cellular is Integrated with sensors it will remove some steps in the chain.

14 The Simple Case of the Smart Thermostat Senso r Gateway Router Boiler Switch PCT PC Installer Supplied Customer Supplied

15 Phone The Backend Environment Web Interface External Service Provider Router 3 rd Party Data MDMS, etc. I/O Manager db Application & Analysis PC Device Manager Security Manager Service Provision

16 Phone And don t forget the Weak Link PC

17 Elements of Security Most IoT architectures consist of a collection of separate, connected elements, each of which may have their own security. Systems composed of Off the Shelf components generally have different levels of security, which need to be stitched into a whole. This can be trickier than designing from scratch. The order of installation can be critical. But guaranteeing the correct order may be impossible. Existing security of wireless may be a false security.

Systems composed of Off the Shelf components generally have different levels of security, which need to be stitched

18 The AES128 Datasheet Misconception But I m using Wi-Fi / Bluetooth / ZigBee. That s got security built in. Why do I need to do anything else?

19 Practical Considerations

20 Build a Security Model You MUST develop a complete end-to-end security model. Just implementing Wireless security is not enough. Write an RMADS as soon as you ve done your first draft of system architecture, and then reiterate both until they work and are consistent. Consider device management, end to end authentication and link key management. db & App BTS / WPA2 TLS TLS / PW Encryption / Authentication

Write an RMADS as soon as you ve done your first draft of system architecture, and then reiterate

21 Design for Autonomous Operation X X X X db & App Think about what happens when: Internal or external comms links or the web service fail The mobile phone goes out of the house The gateway / router fails or is replaced The consumer moves home The consumer expects their HVAC and lights to continue working

22 Security & Usability No security makes getting to 40 billion devices easy. High security makes it very difficult. But Major security failures scare customers and may kill the market altogether. If the reaction to new security threats is simplistically to add even stronger protection, then the costs of that additional security will result in M2M solutions that are not economically viable. Beecham Research

23 And Pairing remains the biggest problem for most wireless products, both in terms of usability and security. Many of these IoT & M2M products will have much longer lives than current consumer products. That means that new components will be added to the system and existing ones replaced. That is a security challenge. More security = more processing = shorter battery life. Make sure that firmware updates don t compromise the security. Or that the security model doesn t prevent them being deployed. Remember that many of these devices may have NO user interface.

24 Millions But Annual Sales of Appcessories 14,000 12,000 10,000 8,000 6,000 4,000 2, If we get it right, the market is five times bigger than the mobile phone market. It s worth getting it right.

25 Questions? Nick Hunn CTO mob: web: Creative Connectivity Blog:

Securing the Internet of Things WHITEPAPER

Securing the Internet of Things WHITEPAPER Table of Contents Introduction...1 Expectations of Security Risk...1 Complexity... 2 What is Secure Enough?... 2 Authenticated Sender & Receiver... 3 Accessible