The 10 challenges of securing IoT communications

---

From the very beginning of developing an IoT product, IoT security must be a forethought.

---

One of the hottest topics at last week’s IoT StreamConf was security. In other words, how are we going to secure communication for billions of connected devices? How can we ensure that attackers can’t take control of our devices, steal information, disrupt services, or take down entire networks of expensive, imperative devices?

With IoT is still in its early stages, security is not fully understood and well-defined when compared to other industries, like the financial and e-commerce sectors. From the very beginning of developing an IoT product, whether it’s small-scale like a wearable device, to massive-scale IoT deployments, like an oil field sensor network or global delivery operation, IoT security must be a forethought.

In this talk, Rohini Pandhi, Product Manager at PubNub, walks through the ten challenges of securing Internet of Things communication. Rohini discusses flexible and secure messaging design patterns for IoT communication, and how they can be implemented and scaled. There are a number of security considerations, but after watching this talk, you should have a good idea of how you can secure your IoT deployment.

(Scroll below video for a table of contents of when individual concepts are talked about in the video).

Video Table of Contents

1. Defining the Internet of Things (10:27)
2. Unprotected devices will be attacked (13:15)
3. Encryption (15:46)
4. Single security model for all communications (17:56)
5. Access control (20:13)
6. Tracking device metadata (21:14)
7. Provisioning in the field (22:38)
8. Firmware updates in the field (24:07)
9. Compliance with regulations (25:15)
10. Reinventing the wheel (26:17)

More Resources on Securing IoT Communication

Below are a couple great pieces on IoT security, and some code tutorials for IoT developers:

• The Next Generation of IoT: PubNub CEO Todd Greene walks through the evolution of the IoT stack, and how it’s continuing to change, with security at the forefront.
• Securing the Internet of Streams: Doron Sherman discusses the need for a new approach to IoT security, built on a loosely-coupled, smarter network.
• World-class embedded security solutions ensures trust for every system design: Data security is directly linked to how exposed the cryptographic key is to being accessed by unintended parties. How to thwart? Keep the “secret key secret” locked in protected hardware devices.
• IT cloud vs. IoT cloud: Kaivan Karimi, Atmel VP and GM of Wireless Solutions, shares the top 10 factors to consider when transitioning from IT cloud to IoT cloud.
• Become a Crypto Expert by securing all the layers of IoT. Securing valuable pieces to solve your security puzzle for any stage or level of the design cycle.
• Ultra-secure Hardware-based Key Storage: CryptoAuthentication installed into the architecture of element devices with hardware-based key storage ensure that a product, consumables it uses, firmware it runs, accessories that support it, and the network nodes it connects to are not cloned, counterfeited, or tampered with.
• Complete Security for PCs and Embedded Systems: The TPM includes integrated, protected nonvolatile storage for cryptographic keys, secrets, and authorization information.
• Making EEPROMs a Safe Place for Sensitive Data: CryptoMemory chips are the world’s largest family of EEPROMs with a 64-bit embedded hardware encryption engine, four sets of nonreadable, 64-bit authentication keys, and four sets of nonreadable, 64-bit session encryption keys.

The CryptoCape is the BeagleBone’s first dedicated security daughterboard

---

The CryptoCape extends the hardware cryptographic abilities of the BeagleBone Black.

---

With the insecurity of connected devices called into question time and time again, wouldn’t it be nice to take comfort in knowing that your latest IoT gadget was secure? A facet in which many Makers may overlook, Josh Datko recently sought out to find a better way to safeguard those designs, all without hindering the DIY spirit. The result? The CrytpoCape — which initially debuted on SparkFun last year — is a dedicated security daughterboard for the BeagleBone that easily adds encryption and authentication options to a project.

Generally speaking, cryptography offers a solution to a wide-range of problems such as authentication, confidentiality, integrity and non-repudiation, according to Datko. SparkFun notes that the $60 Atmel powered cape adds specialized ICs that perform various cryptographic operations, amplifying a critical hardware security layer to various BeagleBone projects.

The CyrptoCape is packed with hardware, including 256k EEPROM with a defaulted I2C address (plus write protection), a real-time clock (RTC) module, a Trusted Platform Module (TPM) for RSA encryption/decryption, an AES-128 encrypted EEPROM, an ATSHA204 CrypoAuthentication chip that performs SHA-256 and HMAC-25 and an Atmel ATECC108 tasked with the Elliptic Curve Digital Signature Algorithm (ECDSA).

“You will also find an Atmel ATmega328P microcontroller and a large prototyping area available on the board. The ATmega is loaded with the Arduino Pro Mini 3.3V bootloader and has broken out most of the signals to surrounding pads,” its SparkFun page reveals.

Beyond that, each easy-to-use CryptoCape comes with pre-soldered headers making this board ready to be attached to your BeagleBone right out of the box. The only additional item a Maker will need to get the CryptoCape fully-functional is a CR1225 coin-cell battery.

Interested? You can check out the product’s official SparkFun page here. Meanwhile, those looking to learn more should also pick up a copy of Datko’s book entitled “BeagleBone for Secret Agents.” The third chapter of the resource is devoted to the CryptoCape where Makers will learn how to combine a fingerprint sensor, the on-board ATmega328P, and the crypto chips to make a biometric authentication system.

HackADay talks CryptoCape

The CryptoCape – which recently made its debut on SparkFun – is a dedicated security daughterboard for the BeagleBone designed in collaboration with Cryptotronix’s Josh Datko, which features Atmel’s Trusted Platform Module and SHA-256 Authenticator.

HackADay’s Brian Benchoff was lucky enough to catch up with Josh and asked him to break down how the nifty device works.

“If you need to add security to your project or you want to learn more about embedded security the CryptoCape adds encryption and authentication options,” the Maker added.

As its webpage notes, the CryptoCape functions as the BeagleBone’s first dedicated security daughterboard. Known as a BeagleBone Cape, the device attaches to the expansion headers of the BeagleBone and “adds specialized ICs that perform various cryptographic operations which will allow you to add a hardware security layer to your BeagleBone project.”

Previously discussed on Bits & Pieces, the CyrptoCape is packed with hardware, including 256k EEPROM with a defaulted I2C address (plus write protection), a real-time clock (RTC) module, a trusted platform module (TPM) for RSA encryption/decryption, an AES-128 encrypted EEPROM, an Atmel ATSHA204 authentication chip that performs SHA-256 and HMAC-25 and an Atmel ATECC108 that performs the Elliptic Curve Digital Signature Algorithm (ECDSA).

The reasoning behind the developer’s choice to use the SHA-256 Authenticator? “It creates 256-bit keys that can be used in keyed Message Authentication Codes (MACs), or HMAC, to prove the authenticity of the device.” In addition, the authenticator allows the device to “implement an anti-counterfeiting system with the exchange of nonces and MACs between other embedded devices.”

If you are interested in boosting the security of your Maker project or learning more about the CryptoCape, you can head to the product’s official SparkFun page here.