The Challenges Of IoT Security

In 1903, magician and inventor Nevil Maskelyne disrupted a public demonstration of Marconi’s purportedly secure wireless telegraphy technology by sending insulting Morse code messages through the auditorium’s projector.

Although Maskelyne’s “Gray Hat” stunt is now only a distant memory, industry experts are still grappling with the challenge of securing new technology well over a century later for a rapidly evolving Internet of Things (IoT). Comprising billions of endpoints, the IoT isn’t limited to traditional mobile devices such as smartphones or tablets. Rather, the Internet of Things includes wearables, medical devices, smart appliances, semi-autonomous vehicles and even intelligent sensors.

For example, dedicated medical devices that were previously stand-alone platforms – including infusion pumps and implantable heart devices – are now coming online en masse. A number of these devices are equipped with standard electronic components that expose unsecured software functionality. However, a software-centric security approach for the medical market inevitably requires frequent updates due to unforeseen vulnerabilities. To avoid potentially dangerous scenarios, medical companies will need to pursue robust hardware-based security as a primary design goal – whilst simultaneously jettisoning their dependence on patches after a device or system has already hit the market.

Similarly, one in five cars on the road will be categorized as “self-aware” by 2018. Nevertheless, numerous vehicles are still equipped with standard electrical communications buses that betray unsecured functionality. A comprehensive security model remains elusive, as vehicle manufacturers are loath to exchange traditional software updates and patch rollouts for hardware-based isolation mechanisms that offer robust protection against myriad forms of attack.

Despite instances of industry reticence, a number of companies have embarked on various initiatives to develop solutions addressing a diverse set of IoT security requirements. From our perspective, the most robust approach bakes security into the initial design and manufacturing of a SoC. To be sure, the process of key injection during fabrication and test operations could potentially expose vulnerable key data, while test and debug capabilities are often fully enabled on chips by default. It is therefore essential for an advanced IP security core to create and maintain a secure endpoint throughout the manufacturing and device lifecycle.

Indeed, an embedded SoC core provides a critical root of trust, effectively allowing manufacturers to manage sensitive keys for secure boot and services. More specifically, a SoC security core is capable of regulating debug modes to thwart reverse engineering, while providing authentication to prevent counterfeiting. SoC-based security can also manage the one-time-programming of on-chip resources, along with device provisioning and personalization, subscription management, secure payments, authorization and RMA/test support.

Major industry players clearly are beginning to realize that administering and updating low-cost IoT devices in the same way current IT systems are managed is simply not an option for most end-users. Simply put, manufacturers are likely to stop developing and rolling out patches for a product once it reaches (perceived) obsolescence. Unfortunately, this approach does not take the extended life expectancy of certain devices and platforms – especially in developing countries – into account.

This is precisely why IoT devices need to leverage hardware-based security and isolation mechanisms that offer robust, long-term protection against various forms of attack. At the Cryptography Research division of Rambus, we believe adoption of hardware-based security solutions will only continue to accelerate, as everything from cars to medical devices join the growing ranks of the Internet of Things.