Scribd
Upload
11 views

Lecture of IoT Security

From a classroom lecture given online for IIIT Hyderabad

Uploaded by

Sachin Gaur
Copyright
© © All Rights Reserved
Available Formats
Download as PDF, TXT or read online on Scribd
11 views

Lecture of IoT Security

From a classroom lecture given online for IIIT Hyderabad

Uploaded by

Sachin Gaur
Copyright
© © All Rights Reserved
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 26

ESW/IoT Course Lecture

covering security related


research questions around IoT
By Sachin Gaur
25.10.2021
Thinking like an attacker or an artist: Modern
Art
Hardware device along with sensors and
IoT Stack radio interface

Firmware to enable
connectivity

User Interface ( Mobile, Smart Speakers, BCI)

Backend Cloud Computing for data


storage and network intelligence

Intelligence from Network of


Smart Devices
Camera as an example to Illustrate the same

Camera as a Device Camera as a connected Camera as an intelligent


• Installed at the door for security device device
usecase • Check the stream anytime, • Unlock doors for approved faces
• Local access and limited storage anywhere • Buy premium intelligence features
• Unlimited storage and keep getting more value from
the same investments
We are surrounded by systems around us
which acquire data?
We are surrounded by systems around us
which acquire data?
We are surrounded by systems around us
which acquire data?
Unsuspecting photocopier!
The next big thing: voice activated devices?
IRTF RFC 8576 : IoT Security State of the Art
and Challenges

Figure taken from the RFC document


Now reflect on this statement?
“People will eventually be unable to know how
many devices they are carrying, which ones are
currently connected and what data they contain.
Is the data personal or not? Who is able to access
it? Who is able to perform software update
without the user’s knowledge? “
- Aurelien Francillon, Eurecom, France
The formal work on IoT security is fast
catching up but not yet there
The formal work on IoT security is fast
catching up but not yet there
The formal work on IoT security is fast
catching up but not yet there
The formal work on IoT security is fast
catching up but not yet there
Lets explore some research
ideas?
Idea is not violate someone’s intellectual property but to get inspired and develop
our own original approach
Power
fingerprinting

https://research.kudelskisecurity.com/2019/10/16/power-analysis-to-the-people/
An example of power fingerprinting!
Replacing the firmware / server code once in
a while?
How SCIT works?
Self- Cleaning Intrusion Tolerance is a patented technique for providing ultra-
low intruder persistence time. We constantly restore systems to a pristine
state to remove malware and rob intruders of the time needed to plan and
launch attacks. SCIT does not require changes to existing information
systems, applications, or security protocols to deliver new high level of
protection. When intruders get in, you need to throw them out as quickly as
possible without waiting to figure out what they are up to. SCIT-MTD (SCIT
Moving Target Defense) assumes that while intrusions are inevitable, the
bigger problem is that intruders are in your systems for a very long time
watching how your system works. Once they are in, they learn how your
systems operate, where your most valuable assets are located, and how to
get your data out of your system under your security radar. SCIT disrupts the
hacker processes and makes it difficult for hackers to succeed.
Dealing with legacy devices?
• You cannot update them
• The vulnerabilities are known
• The exploits are also available
• What if the device we are talking about is not cheap? If it is an Xray
machine, MRI machine will you throw it away once you know you
cannot update it?
Monitoring the IoT Traffic
What could be a potential solution in the long
term?

https://www.nist.gov/news-events/events/2021/09/workshop-cybersecurity-labeling-programs-consumers-internet-things-iot
Another non technical solution could be….
Not to buy devices but rent them!
Rent the most secure device always.
Open Discussion
• What is your view on security of IoT Devices?
• What is that most popular device that you would like to investigate
for Confidentiality, Integrity and Availability?
• Any approaches that you will like share and discuss

You might also like