© 2016. All Rights Reserved. Information and Communications Technology
www.usask.ca/ict
1
www.usask.ca/ict
Cryptographic Modules for the Internet of ThingsMay 20th 2016
Dr. Lawrence G Dobranski P.Eng.University of Saskatchewan
Carol Cantlon, CISSPEWA-Canada
© 2016. All Rights Reserved. Information and Communications Technology
www.usask.ca/ict
2
Let’s set the stage• Proliferation of mobile, cloud,
and Internet of Things technologies
• Smart Homes, Smart Automobiles are here today
• At the University of Saskatchewan:
– 16,000 plus mobile users
– 1.7 devices per user
– Increasing every term
© 2016. All Rights Reserved. Information and Communications Technology
www.usask.ca/ict
3
Technology Disruptors
A disruptive technology is one that displaces an established technology and shakes up the industry.
– Harvard Business School Professor Clayton M. Christensen, 1995.
• More importantly: disrupts society
© 2016. All Rights Reserved. Information and Communications Technology
www.usask.ca/ict
4
The 4th Industrial Revolution
Revolution Year Technology Disruptor
1 1784Steam, water, mechanical production equipment
2 1870Division of labour, electricity, mass production
3 1969Electronics, IT, automatedproduction
4 2016Cyber-physical systems, Internet of Things, Mobile & Cloud Computing
© 2016. All Rights Reserved. Information and Communications Technology
www.usask.ca/ict
5
Evidence of Disruption
AirbnbThe world’s largest accommodation provider owns no real estate
Alibaba The world’s largest retailer has no inventory
FacebookThe world’s most popular media company creates no content
UberThe world’s largest taxi company owns no vehicles
ClassPassThe world’s largest source for group fitness owns no studios
© 2016. All Rights Reserved. Information and Communications Technology
www.usask.ca/ict
6
Internet of Things is here, today• A proliferation of devices
– From home thermostats
– To bathroom scales
– To surveillance cameras
– To garage door controls
– To smart door locks
– To medical devices
– To Raspberry PIs controlling …
© 2016. All Rights Reserved. Information and Communications Technology
www.usask.ca/ict
7
The number of stakeholders are multiplying
Carriers 3rd Parties Apps Environments
© 2016. All Rights Reserved. Information and Communications Technology
www.usask.ca/ict
8
BYOD & Cloud & IoT – Represents a Multi-Dimensional Risk Problem
• Not just a technology problem it not just a business problem, it is a societal disruption
• Risk involves:– Confidentiality, Integrity, Availability of information & services– Personally-identifiable information (aka Privacy)– Business survivability (disaster recovery & business continuity)– All stakeholders (users, clients, 3rd parties, CxOs,…)– Data mining extracting value
• ATraditional IT approaches do not acknowledge:– ‘de-perimeterisation’ or ‘context of use’
An information problem, an access problem.
© 2016. All Rights Reserved. Information and Communications Technology
www.usask.ca/ict
9
Mobile, Cloud, & IoT as a disruptive revolution are represented by the eradication of boundaries
De-perimeterisation
© 2016. All Rights Reserved. Information and Communications Technology
www.usask.ca/ict
10
De-perimeterisation• Mobile, Cloud, & IoT Services means that the boundaries of
the organization have changed or do not exist
• It is de-perimeterisied
• Changes in boundaries are a mark of the societal disruption –where you are no longer matters.
Now not just who is accessing the information, but who, where, how, and
with what.
© 2016. All Rights Reserved. Information and Communications Technology
www.usask.ca/ict
11
Context of Use
• The context of the mobile device and the service provided must be reflected in the authorizations granted to the authenticated user
• Information is the asset; authorization is the key
Contextof Use
Where
Who
What
When
Why
How
© 2016. All Rights Reserved. Information and Communications Technology
www.usask.ca/ict
12
To be effective for the IoT INFOSEC has to evolve to be information and device centric
• Proactive monitoring
• Continuous compliance
• Application firewalls
• Data firewalls
• Adaptive authentication
• Information availability, integrity, and confidentiality
• Best solution to:
– Authenticate and authorize the device
– Protected the information
• Is Cryptography
• Delivered by a validated cryptographic module
The new perimeter is the information boundary
© 2016. All Rights Reserved. Information and Communications Technology
www.usask.ca/ict
13
IoT Reference Architecture
By WSO2.COM © 2015
© 2016. All Rights Reserved. Information and Communications Technology
www.usask.ca/ict
14
IoT Reference Architecture
• IoT Reference Architecture by WSO2.COM © 2015
• Crypto Additions Dobranski/Cantlon © 2016
Embedded Cryptographic Module
CA
AS
–C
ryp
to a
s a
Serv
ice
© 2016. All Rights Reserved. Information and Communications Technology
www.usask.ca/ict
15
Reference Implementation• Apple IoS 9 Security Architecture
• ‘Secure Enclave’ built on a ‘Crypto Engine’
• Secure Enclave a core component of the IoS 9 Kernel – separate from the OS and User Partitions
• Implements Application Sandboxes
© 2016. All Rights Reserved. Information and Communications Technology
www.usask.ca/ict
16
IoT Security: Cryptographic Module PrimitivesBi-Directional Authentication aka Secure Phone Home
• Phone Home to a Cloud Based Server Architecture– Usually multiple destinations
– Needs to be done securely to destinations that are trusted, with a degree of assurance
• Authentication needs to be bi-directional:– Cloud Based Servers need to authenticate
the IoT device
– IoT devices should only accept connections for authenticated Cloud Based Servers
Trusted Software Distribution
• Software loads need to be:– Trusted, i.e., originate from the
manufacture
– Digital signed to validate that they are coming from the manufacture
– Validated so if the load fails the device does not become a ‘brick’
© 2016. All Rights Reserved. Information and Communications Technology
www.usask.ca/ict
17
IoT Security: Cryptographic Module Primitives IIMandatory Access Control
• Cryptographically binding label to asset
• Reference monitor permits access to assets only if the labels match
• User or malware cannot change meta data with label attached or subvert enforcement of access
Object Reuse
• All data segments are encrypted
• Follow on process cannot read previous data stored
• Object can be freely re-used without risk of data leakage occurring
© 2016. All Rights Reserved. Information and Communications Technology
www.usask.ca/ict
18
Three layer IoT Security Model• Three layers
– Management
– Signalling
– Media
• Successful security model applied to embedded multi-media systems, i.e, VoIP
• Secure Management of the device first, then signalling to the device, then the media delivered from/to the device
Management
Media
Signalling
© 2016. All Rights Reserved. Information and Communications Technology
www.usask.ca/ict
19
Thank You!
Thank you!
[email protected](306) 966-7177branski(306) 966-7177
[email protected](613) 295-3488
