Protecting Devices From Data Breach: Identity of Things (IDoT)

IoT Ecosystem

It is a necessity to protect IoT devices and their associated data. As the IoT ecosystem continues to expand, the need to create an identity to newly-connected things is becoming increasingly crucial. These ‘things’ can include anything from basic sensors and gateways to industrial controls systems, retail terminals and scanners, and kiosks to medical devices, heating and lighting systems, connected homes, and smart cars.

Identity and authentication for the IoT enables the use of foundational information security concepts, including confidentiality, integrity, availability, authentication, and non-repudiation. At the core, identity binds credentials. It allows an operator to well manage IoT devices, define access, set policies, and secure communications to protect devices and data. But within the Identity of Things (IDoT), how does one clearly define the credential and the accompanying authentication and encryption services?

Identity and Access Management

The Cloud Security Alliance (CSA) first raised this issue back in September 2015 when the organization released a Summary Guidance on Identity and Access Management (IAM) for the IoT. Within the document, the CSA emphasized the importance of properly identifying things in order to enable authentication, encryption, and data integrity in an ecosystem. Currently, there are more than 20 different study groups, consortiums, alliances, and standards initiatives working toward creating a secure framework for the IDoT.

connected-iot

Issues such as scale, power and computational constraints, ruggedized requirements, energy limitations, increased number and variation of connectivity protocols, and cost factors, among others, make it difficult to simply impose a legacy enterprise IAM or credential management solution. Furthermore, while scenarios for IoT authentication are numerous, there are three notable challenges: token-based authentication currently only works for HTTP, symmetric key mechanisms require input at manufacture, and standard Public Key Infrastructure (PKI) is generally considered impracticable for constrained environments.

Cybersecurity Obstacles

The three obstacles are ones the cybersecurity industry is working diligently to overcome. For token-based authentication, new methods need to be devised for all the new connectivity vectors (cellular, Bluetooth, Wi-Fi, NFC, RFID, etc.), either as one, convergent authentication method or one for each vector. Both approaches will require significant research and development.

Alternatively, and with some modifications, symmetric key mechanisms can be adapted for the IDoT. For example, Digital Short Range communications (DSRC), used in vehicle-to-vehicle communications, supports a much smaller certificate structure than the standard X.509. Meanwhile, the use of certificates requires some form of central mechanisms and management structure, such as PKI. In fact, many (and notably certification authorities) tout PKI as the contending standard for identification, encryption, and authentication of IoT devices, but traditional PKI does not scale well for the IoT. A more dynamic key architecture may need to be developed. Essentially the method chosen will depend on the constrained devices in question and their respective environment.

From a private sector perspective, a number of firms are already promoting authentication, identity, and related management services to address the challenges head-on. The movement in the private sector is dynamic, with numerous firms—from startups to big players in the enterprise IAM and authentication and key management space—investing in the IoT market. While some are offering data-centric security platforms for IoT and M2M, others are developing cloud-based IoT security platforms to create and manage digital identities. The solutions are wide-ranging and varied.

In all, the IDoT market opportunity is still nascent, but it is evidently expanding quickly. Most pressing is the development of adapted identity solutions. These solutions will need to revolve around data centric encryption, dynamic certificates and key architecture.

By Michela Menting

Kishore Durg

Relevance at scale is the key to growth – just ask Del Monte Foods

Relevance at scale is the key to growth Consumer goods companies have seldom had things tougher. The possibilities shown to consumers by customer experience leaders such as Amazon, Google and Facebook have whet out appetites ...
Move bot migration

MoveBot – New Data Transfer Platform

Data Transfer Platform Branded post by Movebot As cloud computing and storage continue to provide enhanced ROI to organizations, businesses are storing their data on the cloud– instead of on-premise servers. Storage migration is an ...
Kevin Julian

Patients Increasingly are embracing technology, and so must the pharmaceutical industry

Patients Increasingly Embracing Technology COVID-19 has driven home the need to use digital solutions more broadly, which means C-Suites may be turning to their CTOs for advice As lockdown restrictions went into effect due to ...
Miha Kralj

SaaS Native – Design, Delivery and Management of Applications

Going cloud native, the right way Moving from a traditional IT organization to one that’s cloud native is an inevitability for all businesses. This is because all real software innovation is now cloud-first or cloud-only, ...
Future Fintech

What’s the cloud forecast for 2020?

Tech Agnosticism In 2019, we saw how cloud computing transformed the way data is managed, the way applications are developed and deployed, and also the way IT teams operate. Organizations are starting to experience the ...
David Balaban

Ransomware – Cybercriminal Groups Know The Weak Points

Cybercriminal Groups Grow Data breaches and leaks represent a quickly growing security problem these days. When plenty of people work from home, the risk of data leaks is much higher. Cybercriminal groups know the weak ...