쥐스킨트의 작은 서재

Security in the Internet of Things

The ability to connect, communicate with, and remotely manage an incalculable number of networked, automated devices via the Internet is becoming pervasive, from the factory floor to the hospitaloperating room to the residential basement.

As we became increasingly reliant on intelligent, interconnected devices in every aspect of our lives, how do we protect potentially billions of them from instructions and interference that could compromise personal privacy or threaten public safety?

How We Got Here: The Evolution of Network Security

Protection of data has been an issue ever since the first two computers were connected to each other. With the commercialization of the Internet security concerns expanded to cover personal privacy, financial transactions, and the threat of cybertheft. In IoT, securityis inseparable from safety. Whether accidental of malicious, interference withthe controls of a pacemaker, a car, of a nuclear reactor poses a threat to human life.

Security controls have evolved in parallel to network evolution, from the first packet-filtering firewalls in the late 1980s to more sophisticated protocol- and application-aware firewalls, intrusion detection and prevention systems (IDS/IPS), and security incident and event management (SIEM) solutions. If malware managed to breach a firewall, antivirus techniques based on signature matching and blacklisting would kick in to identify and remedy the problem.

Later, as the universe of malware expanded and techniques for avoiding detection advanced, whitelisting techniques started replacing blacklisting. Similarly, as more devices started coming onto corporate networks, various access control systems were developed to authenticate both the devices and the users sitting behind them, and to authorize those users and devices for specific actions.

More recently, concerns over the authenticity of software and the protection of intellectual property gave rise to various software verification and at testation techniques often referred to as trusted or measured boot. Finally, the confidentiality of data has always been and remains a primary concern. Controls such as virtual private network (VPN) or physical media encryption, such as 802.11i (WPA2) or 802.1AE (MACsec), have developed to ensure the security of data in motion.

New Threats, Constraints, and Challenges

Blacklisting, for example, requires too much disk space to be practical for IoT applications. Embedded devices are designed for low power consumption, with a small silicon form factor, and often have limited connectivity. The typically have only as much processing capacityand memory as needed for their tasks. And they are often “headless” – that is, there isn’t  a human being operation them who can input authentication credential or decide whether an application should be trusted; they must make their own judgments and decisions about whether to accept a command or execute a task.

The endless variety of IoT applications poses an equally wide variety of security challenges. For example:

-      In factory floor automation, deeply embedded programmable logic controllers (PLSs) that operate robotic systems are typically integrated with the enterprise IT infrastructure. How can those PLCs be shielded from human interference while at the same time protecting the investment in the IT infrastructure and leveraging the security controls available?

-      Similarly, control systems for nuclear reactors are attached to infrastructure.  How can they receive software updates or security patches in a timely manner without impairing functional safety or incurring significant recertification costs every time a patch is rolled out?

-      A smart meter – one which is able to send energy usage data to the utility operator for dynamic billing or real-time power grid optimization – must be able to protect that information from unauthorized usage or disclosure. Information that power usage has dropped could indicate that a home is empty, making it an ideal target for a burglary or worse.

Building Security in From the Bottom up

Security must be addressed throughout the device lifecycle, from the initial design to the operational environment:

1.    Secure booting: When power is first introduced to the device, the authenticity and integrity of the software on the device is verified using cryptographically generated digital signatures. In much the same way that a person signs a check or a legal document, a digital signature attached to the software image and verified by the device ensures that only the software that has been authorized it, will be loaded. The foundation of trust has been authorized it, will be loaded. The foundation oftrust has been established, but the device still needs protection from various run-time threats and malicious intentions.

2.    Access control: Next, different forms of resource and access control are applied. Mandatory or role-based access controls built into the operating system limit the privileges of device components and applications so they access only the resources they need to do their jobs. If any component is compromised, access control ensures that the intruder has minimal access to other parts of the systems as possible. Device-based access control systems such as Microsoft Active Directory: even if someone managed to steal corporate credentials to gain access to a network, compromised information would be limited to only those areas of the network authorized by those particular credentials. The principle of least privilege dictates that only the minimal access required to perform a function should be authorized in order to minimize the effectiveness of any breach of security.

3.    Device authentication: When the deviceis plugged into the network, it should authenticate itself prior to receiving or transmitting data. Deeply embedded devices often do not have users sitting behind keyboards, waiting to input the credentials required to access the network. How, then, can we ensure that those devices are identified correctly prior to authorization? Just as user authentication allows a user to access acorporate network based on user name and password, machine authentication allows a device to access a network based on a similar set of credentials stored in a secure storage area.

4.    Firewalling and IPS: The device also needs a firewall or deep packet inspection capability to control traffic that is destined to terminate at the device. Why a host-based firewall or IPS is requiredif network-based appliances are in place? Deeply embedded devices have unique protocols, distinct from enterprise IT protocols. For instance, the smart energy grid has its own set of protocols governing how devices talk to each other. That is why industry-specific protocol filtering and deep packet inspection capabilities are needed to identify malicious pay-loads hiding innon-IT protocols. The device needn’t concern itself with filtering higher-level, common Internet traffic – the network appliances should take care of that – but it does need to filter the specific data destined to terminate on that device in a way that makes optimal use of the limited computational resources available.

5.    Updates and patches: Once the device is in operation, it will start receiving hot patches and software updates. Operators need to roll out patches, and devices need to authenticate them, in a way that does not consume bandwidth or impair the functional safety of the device. It’s one thing when Microsoft sends updates to Windows users and ties up their laptops for 15 minutes. It’s quite another when thousands of devices in the field are performing critical functions or services and are dependent on security patches to protect against the inevitable vulnerability that escapes into the wild. Software updates and security patches must be delivered in a way that conserves the limited bandwidth and intermittent connectivity of an embedded device and absolutely eliminates the possibility of compromising functional safety.

The End-To-End Security Solution

Security at both the device and network levels is critical to the operation of IoT. The same intelligence that enables devices to perform their must also enables them to recognize and counteract threats. Fortunately, this does not require a revolutionary approach, but rather an evolution of measures that have proven successful in IT networks, adapted to the challenges of IoT and to the constraints of connected devices.

from: http://www.windriver.com/whitepapers/security-in-the-internet-of-things/wr_security-in-the-internet-of-things.pdf