Securing the Internet of Things

Transcription

1 Securing the Internet of Things Challenges & Opportunities Licensing Executive Society December 15, 2015 World s first Linear in Time Asymmetric Security Addressing Authentication and Data Protection For the Smallest Internet of Things Cool Vendors in Mobile Security and IoT Security, 2015 Gartner, Inc. 10 Most Influential Internet of Things Companies Forbes Article/Appinions Survey July 8, 2014 Top Emerging Cybersecurity Companies SINET SecureRF Securing the Internet of Things 1

2 The Internet of Things (IoT) is the network of physical objects or "things" embedded with electronics, software, sensors, and network connectivity, which enables these objects to collect and exchange data. Large and Small SecureRF Securing the Internet of Things 2

3 IoT Big! SecureRF Securing the Internet of Things 3

4 Security is a collection of mechanisms, procedures and controls that can be implemented to reduce the risk of specific threats. Examples include: Authentication Data Integrity Confidentiality Non-Repudiation Security Primer SecureRF Securing the Internet of Things 4

5 Private Key One Private or Secret Key Key Management Challenge Challenge: - Securely distribute Keys - Secure all databases - Single breach System compromised SecureRF Securing the Internet of Things 5

6 RSA Public Key Diffie Hellman Public Key SecureRF Securing the Internet of Things 6

7 Public Key Method Exchange Public Keys Public Alice 16 Bob 9 Private X Y Public Key Method Calculate Shared Secret Public Alice 9 Bob 16 Private X = 34#D82 Y = 34#D82 SecureRF Securing the Internet of Things 7

8 Is it really Alice? Alice Bob Public Key 9 X& X& 9 Certificate Authority Signs Public Key 9 Certificate Authority Verifies Public Key 9 Challenges in Securing IoT IoT represents broad range of technology Little or no power Small computing platform Time to compute No common computing environment SecureRF Securing the Internet of Things 8

9 IoT and Security? good security tools developed over the last 35 years won t fit into the hardware that s (now) available Burt Kaliski Founding Scientist RSA Laboratories Director, EMC Innovations Network Microcontrollers (MCUs) IoT Building Blocks Small Computer on a single IC Processor core Memory Programmable Input/Output Designed for embedded applications SecureRF Securing the Internet of Things 9

10 Real World Example Today s Vehicles 30 to 50+ Microcontrollers (MCUs) per vehicle Vehicle Controls 16 Bit MCU Power Train 16 to 32 Bit MCU Driver Information 8 Bit Examples: Brakes, steering, air bags, wipers, climate control SecureRF Securing the Internet of Things 10

11 So What Could Go Wrong? 2014 Jeep Cherokee The Hack Access car via Sprint Network Connected to Uconnect in vehicle communications systems Re wrote firmware to chip in Head Unit Controlled other areas and systems via Controller Area Network (CAN) Estimated Vehicles Vulnerable: 471,000 SecureRF Securing the Internet of Things 11

12 The Hack Applied Controlled: Sound System Climate Control Windshield Wipers Brakes & Acceleration Engine Head Unit Display And more Is it really Chrysler? Public Key 9 Chrysler X& Jeep Cherokee X& 9 Certificate Authority Signs Public Key 9 Certificate Authority Verifies Public Key 9 SecureRF Securing the Internet of Things 12

13 Other IoT Hacks Webcams/cameras Refrigerators Medical Devices Printers Light Bulbs Thermostats Door Locks How bad is it? SecureRF Securing the Internet of Things 13

14 Who is working on This? (Or should be) ISO/IEC JTC1/SC31 WG7 ISO/IEC JTC1/SC27 Industrial Internet Consortium AllSeen Alliance Thread Group Open Interconnect Consortium IEEE P2413 Summary Securing small Things is a challenge Looking for a solution to secure a lot of different Things a BIGGER challenge Understand your solutions security needs E.g. Authentication? Confidentiality? Integrity? Current solutions may not come from existing protocols/tools Performance, Strength & Time vs. Platform SecureRF Securing the Internet of Things 14

15 SecureRF Corporation 100 Beard Sawmill Road, Suite 350, Shelton, CT Louis Parks Voice: (203) X1301 Mobile: SecureRF Securing the Internet of Things 15