Security and the Internet of Things Prashant Krishnamurthy - - PowerPoint PPT Presentation

▶
security and the internet of things
SMART_READER_LITE
LIVE PREVIEW

Security and the Internet of Things Prashant Krishnamurthy - - PowerPoint PPT Presentation

Jan 27, 2023 256 likes •531 views

Security and the Internet of Things Prashant Krishnamurthy Department of Informatics and Networked Systems School of Computing and Information University of Pittsburgh 1 About Faculty member in the School of Computing and Information

slide-1
SLIDE 1

Prashant Krishnamurthy Department of Informatics and Networked Systems School of Computing and Information University of Pittsburgh

Security and the Internet of Things

1

slide-2
SLIDE 2
  • Faculty member in the School of Computing and Information
  • Department of Informatics and Networked Systems
  • Part of LERSAIS – Pitt’s Laboratory for Education and

Research in Security Assured Information Systems

  • Part of Prof. Joshi’s team for SAC-PA
  • Teaching
  • Cryptography, Network Security, Wireless Networks, and

now IoT

  • Research
  • Wireless networks, localization, and security

About

2

slide-3
SLIDE 3
  • Efficiency of cryptographic algorithms/protocols
  • When you perform per packet stateless encryption, the

“best” encryption algorithm depends on the length of the packet

  • Security in multi-hop sensor and ad hoc networks
  • Part of an ARL multi-university research project
  • Jamming and key establishment in sensor networks

Past Related Research

3

slide-4
SLIDE 4
  • Information security needs to be pervasive and

coordinated

  • There are many moving parts
  • Need to have a 1000 foot understanding for all security

professionals as to how the parts fit and how one may impact the other

  • IoT is a good example of need to understand the “system”

and the moving parts

Thoughts

4

slide-5
SLIDE 5
  • IoT is coming, if it has not already arrived
  • As consumer/business adoption increases, it gets into the

scientific/research community as well

  • The new cyberinfrastructure?
  • Data credence and integrity
  • (Trusted and Reproducible Science)
  • IoT Track
  • Professional Masters programs at Pitt

Thoughts (2)

5

slide-6
SLIDE 6
  • Quick overview of IoT
  • Security in IoT
  • Efforts at LERSAIS
  • Data credence in IoT

Agenda

6

slide-7
SLIDE 7

IoT Everywhere

  • Healthcare
  • Education
  • Banking
  • Agriculture & Farming
  • Transportation
  • Manufacturing
  • Retail

All critical infrastructure sectors

7

slide-8
SLIDE 8

What is a thing?

  • No unique definition of a “thing”
  • Networked video cameras
  • WiFi Routers
  • Speakers
  • Drones
  • Cars
  • Refrigerators
  • Coffee machines
  • Smart locks, shutters, toys, and light bulbs

Source: pcworld.com

8

slide-9
SLIDE 9

What is the “Internet of Things?”

  • Every “thing" has an IP

address

  • Maybe or maybe not?
  • IoT =? Smart Environment
  • Smart cities
  • Smart grid
  • Smart health
  • Connected life

9

slide-10
SLIDE 10

Example (1)

10

slide-11
SLIDE 11

Example (2)

11

slide-12
SLIDE 12

Six Pathways

  • Device Network
  • App & Things (Devices)
  • App & Cloud
  • Device and Third-Party Services
  • Analytics and Presentation
  • Third-Party Services

12

slide-13
SLIDE 13

Summary: High-Level Architecture

Cloud Internet

Storage, computation

Edge Router Device Networks Gateway

Crowdsourced data

Third party services (including bots)

Client devices get analytics, visualization, recommendations - result of computing

cloud

Things that sense and do “stuff”

13

slide-14
SLIDE 14

Security Threats at a High Level

14

slide-15
SLIDE 15

So…

  • Many security challenges
  • Subdivision into smaller problems
  • Heterogeneity of devices and

platforms

  • Capabilities vary widely
  • Usable security of IoT “systems”
  • IoT devices and systems are

complex and (human) users do not comprehend the intricacies

Security Challenges/Work Edge (things, device network) IoT “system” 15

slide-16
SLIDE 16

Predominant focus on edge

  • Scale (number of devices)
  • Resource constraints of devices
  • Long device life
  • Device cannot be updated
  • Post manufacturing
  • Key establishment and content delivery to

devices

  • Device exploitation
  • Boot process, software bugs
  • Hardware, chip, side-channels
  • Network access

❖

Use device function to generate high-entropy keys

❖

Inter-heart beat times

Device networks 16

slide-17
SLIDE 17

HomeKit

  • Restrictive
  • Device has to generate new keys if factory reset
  • Uses Apple Coprocessor
  • Needs Bluetooth or WiFi connectivity between iOS

device and Homekit accessory (thing)

  • Device has a public key/private key pair, as also the iOS

device

  • User has to enter an 8-digit code by device vendor
  • Use SHA-512 with something like HMAC to generate keys
  • Communications use the ChaCha stream cipher (more

efficient than AES) with authentication/integrity

Device Networks App 802.11 Router

Internet

17

slide-18
SLIDE 18

Transparency

  • Who “owns” the devices?
  • Manufacturer, OS Vendor, App Developer, Service

Provider, Me?

  • What are the devices doing?
  • What information are they gathering?
  • What data are they manipulating?
  • Who gets access to the data? What is shared?

18

slide-19
SLIDE 19

Recent trends

  • Forrester 2017 prediction
  • “Hackers will continue to use IoT devices to promulgate

DDoS attacks”

  • ARM puts security into its chips through its TrustZone

technology

  • Secure and not software/data are hardware separated
  • Akamai state of the internet report has started highlighting

IoT related attacks

  • Example of Spike DDoS toolkit targeting Linux on ARM chips
  • Calls for standardizing IoT security

http://www.arm.com/products/security-on-arm/trustzone 19

slide-20
SLIDE 20

Efforts at LERSAIS

  • Fall 2018
  • Special topics class in IoT
  • Two weeks dedicated to security issues
  • Research directions
  • How can we exploit multiple-link layer technologies in

“things” for enhancing security?

  • How can we best use energy harvesting in “things” to

improve the tradeoffs between security and performance?

20

slide-21
SLIDE 21

Data Credence and IoT

  • Work with Dr. Vladimir

Zadorozhny

  • Typical IoT scenarios
  • Variety of heterogeneous

data sources

  • Trusted or not,

granularity/gaps in space/time, semantics, scope, etc.

  • Probabilistic “confidence” in

data

Data Credence Stratum sources Consolidation

  • f

v a r i

  • u

s Human Things Apps & Bots Meta- sources

SOURCES

21

slide-22
SLIDE 22

Working Example

  • Banking
  • Farmer Fiona takes a loan
  • Collateral – crops
  • Sensors to monitor land,

moisture, crop growth

  • Should we approve second

round or foreclose on land?

  • Many data sources
  • Green = trusted
  • Red = untrusted
  • Blue = external “macro”

Controllable devices with high credence external source

  • ther

“things” Bob

Owen Oscar

Fiona’s land

22

slide-23
SLIDE 23

How can we develop a model for the “credence” of data?

  • One approach
  • Subjective logic +

graphs (like page rank)

  • Tuple with “opinions”

that iteratively improve

  • Role of crypto
  • Tuning credence
  • Tradeoffs with efficiency

Network

Storage, credence computation

Mix of sources with varying credence Public (or private) AP Untrusted Path to Data Credence Stratum Data Credence Stratum

Crowdsourced data (lower credence)

23

slide-24
SLIDE 24

Sources

  • Enabling Things to Talk and the IoT Architecture Project: available at

http://www.iot-a.eu

  • S. Ray, A. Raychowdhury, Y. Jin, “The Changing Computing Paradigm

with Internet of Things: A Tutorial Introduction,” IEEE Design and Test, March/April 2016

  • J. Gubbi, R. Buyya, S. Marusic, M. Palaniswami, “Internet of Things

(IoT): A Vision, Architectural Elements, and Future Directions,” Elsevier Future Generation Computer Systems, Vol. 29, pp. 1645-1660, 2013

  • J. Bughin, M. Chui, J. Manyika, “An Executive's Guide to the Internet
  • f Things,” McKinsey Quarterly, August 2015

24

slide-25
SLIDE 25

– Title of article by Martin Bryant, The Next Web, April 7, 2016

“Your next car will need a firewall.”

25

slide-26
SLIDE 26

– Title of article by Ben Woods, The Next Web, April 21, 2016

“The bank at the middle of an attempted $950m cyber heist didn’t even have a firewall”

26

slide-27
SLIDE 27

Thank You!

If you have time and interest, please see: goo.gl/Crifhd

27