Engineering 2 (2016) 48–49

Contents lists available at ScienceDirect

Engineering
j o u r n a l h o m e p a g e : w w w. e l s e v i e r. c o m / l o c a t e / e n g

Views & Comments

Insecurity by Design: Today’s IoT Device Security Problem

In today’s technological age someone could gain access to Compounding this problem is the fact that to enable the
your online bank account through a light bulb. This is due to the ubiquitous nature of the IoT, the embedded devices themselves
Internet of Things (IoT). The IoT has become a reality as more and are often low-cost, low power devices that are restricted in both
more of our devices are being connected to the Internet. In fact, memory and computing power, and adversaries will have physi-
automated teller machines (ATMs) have been online for many cal access to the devices. As such, physical attacks are possible in-
years, and more recently we have had the installation of smart cluding side-channel attacks (SCAs), which can be used to extract
meters remotely connecting to the electricity grid. We now have the secret key from electronic devices using power, electromag-
smart watches and smart baby monitors, and there are many netic (EM) emanations, timing analysis or acoustics. Such attacks
more examples of new IoT devices. have been shown against transit cards [5], car immobilisers [6],
The influence of IoT in our day to day activities is set to further and Field Programmable Gate Array (FPGA) device bitstreams [7].
increase with a projected 25 billion connected devices by 2020, Quantum computers may also have a significant impact on to-
according to Gartner [1], while Cisco believes that by 2020, 50 bil- day’s security. Public-key cryptography, which is an essential ele-
lion devices will be network-connected [2]. Gartner also predicts ment in security applications today, is used to secure everything
that the automotive industry will show the highest growth rate from email to online transactions. However, it is computationally
in connected things as car-to-car communication and self-driving intensive and expensive to implement. It is also believed that it
car technology begin to become commonplace. Smart devices and will no longer be secure due to the computational capabilities of
sensors will be found in our homes, our cars, our workplaces, in quantum computing. For example, the RSA algorithm is based on
remote health sensing, and in self-driving cars. IoT has the poten- the integer factorization problem and quantum computers are
tial to truly revolutionize how we interact with the world today. expected to be able to factorize large numbers at an exponen-
tial speedup over today’s classical computers. Quantum-safe or
1. Challenges post-quantum cryptography refers to conventional non-quantum
cryptographic algorithms that are secure today but will remain se-
The expected volume of connected devices necessitates the cure even after practical quantum computing is a reality. They are
use of machine-to-machine communication meaning that we based on different underlying hard problems to current public-
will no longer have direct control over with whom or what our key techniques. In August 2015, the National Security Agency
devices are communicating. In addition, the growing presence announced that the Suite B cryptographic algorithms as specified
of devices enables new attack methods and new attack surfaces by the National Institute of Standards and Technology (NIST) will
for criminals and hackers to exploit, posing serious security and be transitioning to quantum-resistant algorithms in light of the
privacy issues. Practical attacks of IoT devices have already been potential threat of quantum computers [8].
shown to be a real threat. Returning to the light-bulb example, in
2014, security experts demonstrated how they could hack a lead- 2. How can we address these challenges?
ing brand of network-connected light bulb and obtain the Wi-
Fi username and password of the household to which the lights So how can we address these challenges? There are many new
were connected [3]. Attacks have also been shown against smart security technologies and solutions currently being developed
meters, home automation devices, and in 2015 Chrysler had to that can help to address IoT device security problems. These in-
send out a security update to all its customers after a live demo clude quantum-safe algorithms which I have already mentioned;
showed how to remotely cut the engine and take control of the however, in many cases they are not practical and many are even
steering and brakes of their cars via its network-connected enter- more complex than current public-key techniques. Also, their key
tainment system [4]. It is very evident that the fact these devices sizes tend to be much larger, making them impractical for low-
are network-connected poses serious threats, which could have cost devices. The development of practical and optimal quantum-
significant real-world consequences. This is one of the many chal- safe solutions is very much an open research problem at the
lenges in providing IoT device security. moment.

http://dx.doi.org/10.1016/J.ENG.2016.01.014
2095-8099/© 2016 THE AUTHORS. Published by Elsevier LTD on behalf of Chinese Academy of Engineering and Higher Education Press Limited Company.
This is an open access article under the CC BY-NC-ND license (http://creativecommons.org/licenses/by-nc-nd/4.0/).
 M. O’Neill / Engineering 2 (2016) 48–49 49

There are a number of initiatives currently addressing this, layer of the IoT ecosystem (Fig. 2). A second layer is the commu-
including workshops being hosted by NIST in the US, and by the nications between the devices, the security of which is also vital;
European standardisation body, European Telecommunications and thirdly, the amount of data being generated from such a vol-
Standards Institute (ETSI). There are also European H2020 funded ume of devices must also be stored and analyzed securely. There-
projects including the SAFEcrypto project [9]. Work has already fore, a step change in the security and privacy of all layers of the
been carried out in this project to show that it is possible to IoT ecosystem is needed to ensure its usability and acceptance in
achieve light weight quantum-safe solutions [9]. the future, with secure IoT devices at the root.
An alternative approach for providing device authentication,
in particular, is the utilization of a physical unclonable function
(PUF). PUFs use the manufacturing process variations of silicon
chips to generate a unique digital fingerprint. Since every chip
is different, no two chips give the same response when supplied
with the same challenge. This allows the use of PUF technology
for both device identification and authentication. They also have
the advantage of being tamper resistant and as such can be uti-
lized to detect cloned devices. They are inherently lightweight,
with a recently proposed PUF solution (Fig. 1) occupying less than
1% on a low-cost FPGA device [10]. As such, they can be used as
an effective trust anchor to enable lightweight device authentica-
tion in embedded IoT systems.

Fig. 2. IoT ecosystem.

References

[1] Rivera J, Van der Meulen R. Gartner says 4.9 billion connected “things” will
be in use in 2015 [Internet]. 2014 Nov 11 [cited 2016 Feb 20]. Available from:
http://www.gartner.com/newsroom/id/2905717.
[2] Cisco. Internet of things (IoT) [Internet]. [cited 2015 Jul 23]. Available from:
http://www.cisco.com/web/solutions/trends/iot/portfolio.html.
[3] Chapman A. Hacking into internet connected light bulbs [Internet]. 2014 Jul
4[cited 2015 Sep 15]. Available from: http://contextis.com/resources/blog/
hacking-internet-connected-light-bulbs.
[4] Greenberg A. Hackers remotely kill a jeep on the highway—with me in it
[Internet]. Wired 2015 Jul 21 [cited 2015 Sep 15]. Available from: http://www.
wired.com/2015/07/hackers-remotely-kill-jeep-highway/.
[5] Oswald D, Paar C. Breaking Mifare DESFire MF3ICD40: power analysis and
templates in the real world. In: Preneel B, Takagi T, editors Cryptographic
Hardware and Embedded Dystems―CHES 2011: 13th International Work-
shop; 2011 Sep 28-Oct 1; Nara, Japan. Berlin: Springer; 2011. p. 207–22.
Fig. 1. One-bit physical unclonable function (PUF) identification generator cell [6] Eisenbarth T, Kasper T, Moradi A, Paar C, Salmasizadeh M, Shalmani MTM.
design. On the power of power analysis in the real world: a complete break of the
KeeLoq code hopping scheme. In: Wagner D, editor Advances in Cryptology—
CRYPTO 2008: 28th Annual International Cryptology Conference; 2008 Aug
3. Conclusions 17-21; Santa Barbara, CA, USA. Berlin: Springer; 2008. p. 203–20.
[7] Moradi A, Kasper M, Paar C. Black-box side-channel attacks highlight the im-
portance of countermeasures—an analysis of the Xilinx Virtex-4 and Virtex-5
In conclusion, as companies race to get IoT devices to market,
bitstream encryption mechanism. In: Dunkelman O, editor Topics in Cryptol-
many are forgetting about security or all too often, security is an ogy—CT-RSA 2012: The Cryptographers’ Track at the RSA Conference 2012;
afterthought. Numerous attacks of IoT devices have already been 2012 Feb 27-Mar 2; San Francisco, CA, USA. Berlin: Springer; 2012. p. 1–18.
[8] National Security Agency. Suite B Cryptography today [Internet]. 2015 Aug
demonstrated, and these attacks could have significant conse-
19 [cited 2015 Sep 15]. Available from: https://www.nsa.gov/ia/programs/
quences. Therefore, it is vital that companies take the time to suiteb_cryptography/index.shtml.
consider the security of their devices and include appropriate se- [9] SAFEcrypto. About SAFEcrypto [Internet]. [cited 2015 Sep 15]. Available from:
curity solutions, such as PUF and quantum-safe techniques, from www.safecrypto.eu.
[10] Gu C, O’Neill M. Ultra-compact and robust FPGA-based PUF identification
the outset of their design. generator. In: Proceedings of IEEE International Symposium on Circuits and
Finally, the security of IoT devices can be regarded as just one Systems (ISCAS’15); 2015 May 24–27; Lisbon, Portugal; 2015. p. 934–7.