Category: Uncategorized

Posted on by cascademic

IoT Security Frameworks - Third Issue

 
 
 

 

The cryptographic security methods we saw in the previous issues form an important component in IoT Security frameworks.

Security frameworks have as their main characteristics:
• Confidentiality: it disallows unwanted access to sensitive information.
• Integrity: it protects the transmitted data for unwanted modification or tampering.
• Availability: it is related to the ability of accessing the data when they are needed.

Typical attacks which can break these characteristics by exploiting vulnerabilities in the system are: RF interference, node tampering, jamming, man-in-the-middle attack, Denial of service attack, virus and worms, malicious scripts among many others.

The IoT world comprises small devices which are inherently insecure and the IoT Systems are vulnerable to attacks.

IoT Security Frameworks, in addition to being able to address Data anomaly detection, remote attestation or packet filtering issues in order to mitigate these complex attacks, should be scalable and support ease of testing.

If the IoT System is a complex one comprising large number of heterogeneous devices, detecting data anomalies and compromised nodes becomes very difficult and can be complicated if there are communication errors due to injection of malicious data.

Two generic IoT Frameworks which have made considerable efforts to tackle these issues are Internet of Things Architecture (IoT-A) or Core Platform of the Future Internet (FiWARE). While FiWARE implements a “security-by-design” paradigm with generic components (such as monitoring, identity, and confidentiality management, context security or secure storage), IoT-A uses a trust model involving Trust domains, Trust evaluation mechanisms, Behavior analysis and such security aspects.

The interaction of different security modules in the framework is ensured by establishing a trust relationship based on the authentication mechanism. The trust relationship is established using digital certificates, asymmetric keys or pre-shared symmetric keys, depending on the constraints of the devices involved.

“IoT security will be complicated by the fact that many “Things” use simple processors and OS…” - Gartner

Importantly, most of the good security algorithms developed so far - which typically involve large numbers and complex methods of handling them - find it challenging to fit into the current IoT or Industrial IoT hardware due to limitations related to size, power, speed, processing power, etc.

Moreover, since IoT allows sensor and actuator devices to communicate end-to-end through the system, the security techniques implemented by IoT end-nodes impact the rest of the involved devices.

With IoT devices and systems becoming more prevalent, paradoxically more and more consumers are concerned about the safety and security of the devices and there is more awareness of the security risks involved.

In conclusion, with the IoT market growing at an explosive rate, good developments in IoT Security and advancements are much needed and urgent.

Posted on by cascademic

IoT Security Frameworks - Second Issue

 
 
 

 

In this second instalment of IoT security Frameworks series, we look at Asymmetric cryptographic systems.
As we saw earlier, the problem with secret key cryptosystems was that the encryption and decryption keys were the same (or easily derived from the other) and that the keys had to be distributed to all users of the system. Since keys need to be protected from theft, the key distribution itself was a weak link in these systems.

To solve this problem, The Asymmetric cryptographic or Public key system was proposed. In this system a key pair - a Private key that is known only to the sender and a public key which is shared with the receiver – is used. Here the encryption and decryption keys are different from each other and the decryption key cannot be derived from the encryption key.

In a public key cryptosystem, the encryption and decryption algorithms E and D are such that they meet the following requirements, where P is the plaintext:

• D(E(P)) = P;
• It is exceedingly difficult to deduce D from E;
• E cannot be broken by a chosen plaintext attack.

One of the early Asymmetric Cryptographic algorithms is RSA (named after its designers Rivest, Shamir and Adlernan) which satisfies all the above requirements.

This is a very good method and works as follows:
- Choose two large primes, p and q, typically greater than 10100.
- Compute n = p x q, and z = (p-1)(q-1).
- Choose a number d relatively prime to z.
- Find e such that e x d ≡ 1 (mod z).

Then divide the plaintext P (bit string) into blocks, so that each plaintext message P satisfies
0 <= P < n.

To encrypt, compute Ciphertext C = Pe(mod n). To decrypt C, compute P = Cd(mod n).

It can be proven that for all P in the specified range, the encryption and decryption functions are inverses. The public key consists of (e,n), the private key consists of (d,n).

The security of the method is based on the difficulty of factoring the product of two large primes. Because RSA uses very large primes, it is pretty slow when used to encrypt large volumes of data. Most RSA-based systems use public key cryptography for distributing one-time session keys for use with DES, IDEA or similar algorithms.

Though systems with RSA Encryption implementation have been around for decades, in addition to being slow, RSA is not very suitable when it comes to security of smaller devices and systems, especially IoT devices and systems. We will look at some other aspects of IoT Security Frameworks in the final issue.