How to Secure your IoT Solution From Edge to Cloud?

Maintain supply chain integrity: Enterprise companies need to ensure that their vendors and suppliers have defined Supply Chain Management (SCM) procedures that include baseline testing of components and specifications for parts used in IoT projects. In addition, they should be able to provide information on the entire manufacturing process. They should also share any changes in the system or any technical vulnerabilities in components with the IoT system owner. Any updates of the system such as changes in configuration, software changes and so forth should also be shared with the system owner or operator. Supply chain management systems should be able to consult a dashboard where they can easily access vendors’ and suppliers’ details, and any changes in the specifications of the components or parts.

Establish a chain of trust: Ensuring a high degree of security for an IoT implementation requires that devices, gateways and applications that are part of an IoT value chain. A trustworthy system enables the “chain of trust,” and this level of confidence should be maintained in the entire lifecycle of the system and adapt to new changes.

The basic categories for building a chain of trust, according to the Industrial Internet Consortium’s security framework include:

1. Security, which is the assurance of a system that it will remain secure from any outside threats, and attempts to harm the system. It also includes confidentiality of the information that it will not be disclosed to any unauthorized entity, the integrity of the system to avoid inappropriate changes and destruction of the information, and availability of the system to provide instantaneous information to an authorized user.
2. Safety, which is the condition at which a system runs without posing a threat of danger includes safeguarding people and physical OT assets.
3. Reliability is the ability of a system or component to perform its required functions under stated conditions for a specified time. Reliability and availability are correlated. Reliability can be thought of like a fraction: it is the amount of actual availability over scheduled availability, as affected by things like scheduled maintenance, updates, repairs and backups. Hence, when the scheduling is done properly, it is possible to get the actual availability (reliability) closer/equal to the scheduled availability.
4. Resilience is achieved by designing the system so that, when a failure occurs, the system can find an alternative way to accomplish the task. Failure in a single component should not affect other parts of the system. The system should be able to deal with failed or faulty processes automatically.
5. Privacy is the ability of personnel or an organization to have control of the information flow. It includes matters such as the confidentiality of processing and transferring data and who has access to that data.

When a system has all of these characteristics, it should be able to stand up to risks predicted for the system.

Communication and network security

An important aspect of any connected device or IoT system involves peer-to-peer communication between gateways and devices as well as communication to the cloud.

Data security

Securing data at endpoints involves data-at-rest (DAR) and data-in-use (DIU). The communication security is required for data-in-motion (DIM). For DAR, TPM (Trusted Platform Module) storage key can be used to secure the data. For DIU, runtime integrity techniques can be used to monitor memory access, and detect & protect against memory attacks. For DIM, data tokenization (a type of cryptography) can be used to protect sensitive data with encryption that can be decoded by authorized parties. See the example below showing a hospital’s patients database

There are three main techniques for cryptography: shared key, certificate-based authentication, and token-based authentication.

Cyber theft prevention

From a theft perspective, the most common type of targets are IP addresses, Fully Qualified Domain Names (FQDNs), and malicious URLs. There are many frameworks that can identify the cyber threats and mitigate them, including the Collective Intelligence Framework (CIF),

Trusted Automated eXchange of Indicator Information (TAXII) and Structured Threat Information Expression (STIX). Such technological frameworks continuously analyzes data, creating a chain of messages. In the STIX framework, for instance, whenever a user asks for specific data, the system provides information on cyber risks, threat actors, a recommended course of action and other information. For building a chain of trust, it is important for IoT devices to share threats and other pertinent information with the nearby devices that are on the same network.

Hardware security

Hardware security can be achieved in an IoT solution with Trusted Platform Modules (TPMs) and Trusted Execution Environment (TEE). TPM is essentially a chip that is installed on an IoT device near the CPU. It is used for mainly cryptographic operations, which creates a security key, saves it, stores the data and other related operations. They can use to ensure the integrity of a platform, for disk encryption and password protection.

TEE is a separate execution platform that differentiates the operational capability from the security functionality. It consists of APIs, kernel and a trusted OS that runs security checks, parallel to the standard OS. TEE consists root of trust (RoT), which includes a trusted boot platform, a measured boot process and an attestation process. TEEs also help ensure the integrity of applications and data storage. A trusted boot platform enables a secure boot, avoiding problems with malware that self-installs during the boot process. A measured boot process provides data on every process of the boot sequence before executing it on the standard OS. The attestation process allows the process to share its trustworthiness and security parameters with other trusted sources, securely. TEEs also help ensure the integrity of applications and data storage.

Blockchain-based security

While blockchain is best known for its use in cryptocurrencies like Bitcoin, the technology can be used for authentication in IoT networks as it uses a “micro-ledger” as evidence for peer-to-peer communications. Blockchain can record the communication history of two IoT gateways or devices. Once an action (or “transaction”) get stored in a micro-ledger, then it cannot be altered in the future. While certificate-based encryption technologies can be forged, Blockchain has the advantage of being distributed, and thus supports the security concept of non-repudiation, meaning a person who triggers an action on an IoT network cannot deny doing so.