The “things” making up the Internet of Things need efficient security technologies that can protect against tampering and enable devices to authenticate themselves, thereby preventing unauthorized access to the network.
Applications in the Internet of Things (IoT) are vulnerable to hacking at multiple locations, such as at endpoints and network concentrators, network interfaces, mobile applications, and cloud services. The hackers’ intentions are as diverse as the IoT itself, and may range from under-reporting energy usage to a utility provider, to stealing data such as passwords or financial information, or more severe acts such as industrial sabotage or international terrorism.
Just as activities such as online commerce needed improvements in security to give users the assurance that their financial data is protected, the IoT world is also coming to understand the very real security risks that are present.
The IoT Security Learning Curve
Connecting small computerized devices such as smart appliances, smart energy meters or industrial SCADA systems to a network has highlighted many advantages compared with traditional scenarios in which equipment has not been interconnected or has been deployed in closed networks using proprietary or specialized communication protocols. Widespread connectivity using industry-standard protocols such as IP, often over Ethernet or over wireless links like Bluetooth® or ZigBee®, allows easier control and reporting as well as new features such as remote monitoring and control via a mobile device.
On the other hand, extending connectivity presents opportunities for hackers to gain unauthorized access. IoT devices such as mobiles, wearables, and smart devices installed in customer premises or publicly accessible areas are vulnerable to physical tampering in addition to unauthorized access via a network connection.
Attacks on IoT applications may seek to intercept communications containing data such as passwords that may be poorly protected or unencrypted. On the other hand, the hacker’s goal may be to install malware either by uploading a malicious update via a network connection or by physically replacing code-storage media on the device. The malware could be designed to send false information from a smart meter to the managing utility company, re-transmit information such as video or audio to another location, steal login credentials that can allow rogue devices to access other assets on the network, or to disable or take over the device.
Knowledge surrounding IoT security is evolving quickly. The Open Web Application Security Project (OWASP), a non-commercial organization that provides information about application security, is one example of an open community aiming to help improve IoT security. OWASP has started its Internet of Things Top 10 Project and recently published a list of the 10 most significant IoT vulnerabilities for 2014, which includes advice on testing and prevention. The project considers all aspects of the IoT infrastructure, including hardware, software/firmware, user interfaces, network services and connections to cloud services.
Access Control
Key issues noted in the OWASP list are concerned with access control. These include insecure web interfaces, weak user authentication, and web services that present unnecessary open ports to the Internet or are vulnerable to attacks such as Buffer Overflow or Denial-of-Service. The report recommends use of strong passwords, two-factor authentication, prevention of account enumeration, and resistance to tricks like cross-site scripting (XSS) or SQL injection (SQLi) at the web interface.
The fourth concern in the OWASP Top Ten is lack of transport encryption. According to recommendations, data transported via the Internet or the local network should be properly encrypted using a protocol such as Secure Sockets Layer (SSL) or Transport Layer Security (TLS).
SSL/TLS, or alternatively IPSec (Internet Protocol Security) encryption may be used but the algorithms usually employed, such as AES or 3DES, add significant CPU overhead if performed in software. CPU cycles, not to mention power consumption, are usually extremely limited in embedded applications such as IoT smart sensors or data concentrators.
The integrated hardware security accelerator (SEC engine) featured in embedded processors such as Freescale’s QorIQ P1021 offloads encryption tasks from the main CPU, and supports important algorithms such as 3DES, AES, RSA/ECC, MD5/SHA, and ARC4. The P1021 SEC engine is capable of performing single-pass encryption and message authentication for common security protocols including IPsec and SSL, as well as Secure Real-time Transport Protocol (SRTP) and WiMAX security. Developers can thus take advantage of the P1021’s dual e500 Power Architecture™ cores for other protocol processing and system tasks. Integrated system peripherals and support for multiple interconnect technologies, as well as advanced energy management (Figure 1), make the device ideal for applications such as network security equipment.
Figure 1: Hardware security acceleration helps users make the most of QorIQ processor functionality.
If, on the other hand, the chosen microcontroller does not have its own security engine, an Ethernet controller such as the Microchip ENC624 can perform encryption using its own security engines. These support AES, MD-5 and SHA-1 encryption, as well as modular exponentiation. Keys and data are stored in a special area of memory reserved for cryptographic data. This area is not directly accessible through the external host interface, which can be either SPI or a parallel slave port, and can only be written to using Direct Memory Access (DMA).
Hardware-accelerated encryption can also be found in smaller, lower-power microcontrollers suitable for use in IoT endpoints such as smart meters and smart sensors. The Freescale MK11DX128AVLK5-ND microcontroller is based on the ARM® Cortex®-M4 core, and not only includes hardware acceleration supporting the major encryption algorithms, but also integrates aspects of Freescale’s trust architecture including tamper detection and secure key storage. The tamper-detection module is able to sense attacks involving temperature, clock, and supply voltage variations. Freescale’s trust architecture is implemented alongside the security engine in devices such as K11, K21 and K70 Kinetis microcontrollers, and QorIQ processors such as the P4080.
Devices need to share encryption keys in order to exchange encrypted data. New wireless protocols for IoT applications, such as ZigBee PRO Smart Energy (ZigBee PRO SE), implement security using digital certificates and keys. ZigBee PRO uses AES-CCM encryption based on a 128-bit key to prevent eavesdroppers from interpreting network data. Two types of keys are used, comprising a randomly generated Network Key shared by all nodes, and a unique Application Link key for each pair of communicating nodes. To join the network and establish an Application Link Key, the joining node must have a pre-configured link key and a security certificate. The link key is generated from an installation code assigned at manufacture, and programmed into Flash memory. The secure storage provided by a technology such as Freescale’s trust architecture provides an ideal location for this data, capable of preventing unauthorized agents from reading the pre-configured key.
When the node is installed, for example if replacing an ordinary utility meter with a smart meter, the MAC address and installation code are communicated to the network owner using a separate channel such as by telephone. The administrator at the utility company then uses the installation code to calculate the node’s pre-configured link key and installs this key in the network coordinator. When the new smart meter issues a join request, the coordinator then uses the pre-configured link key to encrypt the Network Key and sends the result to the joining node. The joining node then uses the Network Key to negotiate with the coordinator to generate an Application Link key, which is then used as the basis for encrypted communications.
The joining node must also have a digital security certificate, which contains information including the node’s MAC address, details of the certificate issuer, a public key, the signature of a Certificate Authority and other data. For maximum security, the certificates are only available from a recognized certification body, and can only be granted to devices that already have ZigBee PRO SE certification.
Closing Other Security Vulnerabilities
The OWASP IoT Top 10 project also lists privacy concerns, configurability of security settings, and security of software and firmware, as well as protection against physical attack. Privacy can be supported by collecting only the data needed to run the application. The ability to configure security settings to differentiate administrators from normal users and to notify administrators of security events also helps to strengthen protection against malicious attack.
Recommendations for securing software and firmware include encrypting all software updates, and transmitting these over encrypted data links. Update servers should be kept secure and the updates should be signed and verified before being uploaded and applied. Finally, resistance to physical attack can be enhanced by measures such as preventing easy removal of storage media, and ensuring that any external interfaces such as a USB port cannot be used to maliciously access the device.
Conclusion
As IoT applications become more ingrained in domestic, industrial, financial, and energy infrastructures, network nodes are exchanging more and more valuable information. The value of the information is also becoming more widely appreciated, both by hackers keen to gain access, as well as end users who will demand proper protection if they are to accept the IoT revolution and all it has to offer.
Security-conscious design, taking advantage of technologies such as hardware-based encryption and secure storage, can help ensure robust protection within practical constraints such as cost, size and power consumption.
