Week 7 - IoT Security

WIRELESS EMBEDDED SYSTEM
IoT Security
07/31/2021
07/31/2021 Copyrights 2020 CE-UIT. All Rights Reserved. 1

Objectives
 Understanding the importance of Security in IoT
 Understanding the Challenges of IoT Security
 Knowing Solution Approach for IoT Security

Contents
 Introduction to Security in IoT
 Problem and Challenges of IoT Security
 Solution Approaches for IoT Security

Introduction to Security
 What is Security?
 “The quality or state of being secure—to be free
from danger”
 A successful organization should have multiple

layers of security in place:
o Physical security
o Personal security
o Operations security
o Communications security
o Network security
o Information security
Information Security
 What is Information Security?

 The protection of information and its critical
elements, including systems and hardware that use,
store, and transmit that information
 Necessary tools: policy, awareness, training,

education, technology

Security Concepts

Security Concepts (cont.)
To ensure protection
against unauthorized To ensure the accuracy
access to or use of and completeness of
confidential information information to protect
business processes
To ensure that information and vital services

are accessible for use when required
Security vs. Usability
07/31/2021 Copyrights 2020 CE-UIT . All Rights Reserved. 9

Security vs. Safety (General Usage)
 Security is concerned with malicious humans that

actively search for and exploit weaknesses in a system.
 Safety is protection against mishaps that are

unintended (such as accidents)

Security in IoT Ecosystem

IoT Security Opportunities
IoT Security means new opportunities

for a security professional to develop
novel security solution!

IoT Trend

IoT Trend

Security Cases

Problem and Security Challenges

Problem and Security Challenges

Security Risk

Security Domain

IoT Security Toxonomy

Typical IoT Infrastructure

Typical Attack: Fake Control Service

Typical Attack: Attack on Device Open Port

Typical Attack: Attack on Server Open Port

Typical Attack: Steal Credential

Typical Attack: Inject Bad Configuration or Firmware

Typical Attack: Sniff Data on Private Networks

Other Attack

OWASP Top 10 IoT Vulnerabilities

Security Approaches

Security Approaches
• One-Time Pads
Software • Data Encryption Standard (DES)
Approaches • Advanced Encryption Standard (AES
• RSA: Rivest, Shamir, and Adleman
Hardware • Cruptography Accelerator

Approaches • Cruptography Chip

Basic Cryptography: One-Time Pads
How?
Symmetric (Shared Key) Cryptography
• Block cipher uses more elaborate algorithms so that key siz

e and message size don’t need to be the same.
• Subsequent identical messages encrypt as different cipher te
xt.
• Data Encryption Standard (DES) – mid 1970s.
• Advanced Encryption Standard (AES) – 2001
Based on a cryptographic scheme called Rijndael proposed
by Joan Daemen and Vincent Rijmen, two researchers from
Belgium. AES uses a message block length of 128 bits and t
hree different key lengths of 128, 192, and 256 bits.
Asymmetric (Public Key) Cryptography
Each participant has two keys, a public and a private one.
A message is encrypted with the public key.
The message can only be decrypted with the private key.
Public and private keys match via clever algorithms.
Relies on a one-way function, easy to compute, hard to revers

e without knowing a (private) key.
RSA: Rivest, Shamir, and Adleman
• Public key: KB = (n,e)

• Encryption: C = Me (mod n)
• Private key: d
• Decryption: M = Cd (mod n)
Ronald L. Rivest, Adi Shamir, and Leonard Adelman, 1978 and 2010
RSA Overview
Based on the fact that it is practical to find three large positive

integers e, d, and n, s.t. for all m coprime with n,
(me)d mod n = m
The public key is then (e, n), and the private key is d.
Encryption:
• Add bits to message M to make m coprime to n.
• Ciphertext: C = (me) mod n
RSA Overview
Based on the fact that it is practical to find three large positive

integers e, d, and n, s.t. for all m coprime with n,
(me)d mod n = m
The public key is then (e, n), and the private key is d.
Decription:
• m = (Cd ) mod n
• Remove extra bits by reversing the padding scheme
RSA Key Generation
 Find two distinct large prime number p and q. Let

 n = pq
RSA’s security relies on the difficulty of finding p and q kno
wing only n (the “factorization problem”). Let
F = (p-1)(q-1)
Find an e s.t. 1 < e < F coprime with F. (e, n) is the public ke
y.
Find a d s.t. de mod n = 1. d is the private key.
Widely Used Asymmetric Cryptography:
SSL/TLS
 Secure Socket Layer/Transport Layer Security
 Widely used for web servers

on the Internet
HTTPS = HTTP over
SSL/TLS
 Provides:
 Authentication
 Confidentiality and integrity of
communication
Slide from Hokeun Kim

Intro to SSL/TLS Based on Certificates
Shared secret: Cryptographic key for encryption
Message Encryption Your bank (server)

Browser (client) ID/Password
Account balance
se c ret ?
Make wire transfer
are the
re ly sh
e s ec u
ca n w
How
Internet
Eavesdropper
 Public key cryptography (e.g., RSA)
Your bank (server)
Browser (client)
Decrypted With
Bank's Private Key
Secret to be shared
Encrypted With Bank's
Public Key
Bank's Bank's
Public Key Private Key

 However, even with public key cryptography…

Browser (client) Your bank (server)
Fake website &
Malory's Public Key
Encrypted With Bank's Bank's

Malory's Public Key Public Key Private Key
Malory
"Man In The Middle" Encrypted With
Bank's Public Key
www.bankofamerica.com
=> Malory's IP address
Spoof network address to redirect Malory's Malory's Decrypted With

client to fake website Public Key Private Key Malory's Private Key
(e.g. DNS cache poisoning)

Signing a Message
Each participant has two keys, a public and a private one.
A message is encrypted with the private key and both the mes
sage and its encryption are sent.
The encrypted part can be decrypted with the public key. If it

matches the plaintext message, the signature is valid.
A (Digital) Certificate (Proof of Public Key's Authenticity)
• Name of certificate authority (CA)
• www.bankofamerica.com
• Bank's public key
• Additional Information: validity period, etc.

Signed (encrypted)* with
issuer (CA)'s Private key
• Digital Signature
Can only be decrypted (verified)

with issuer (CA)'s matching
public key!
Actually the hash of data is encrypted (signed), and the
result of decryption is also hash

CAs Issues a certificate for Bank
Browser (client) Your bank (server)

Connects to www.bankofamerica.com
CA Certificates Bank's certificate issued by CA

(embedded in browser)
Verify Bank's certificate Malory's (invalid)certificate
with CA's certificate insisting ownership of domain
Can't be verified!

Issues with Using SSL/TLS for IoT
 Overhead for resource-constrained devices
 Energy/computation overhead for public key crypto, communication
bandwidth, memory, etc.
 Limited support one-to-many communication
 Connections are 1-to-1 (server/client model)
Certificates Thermostat
Roomba
HVAC
Remote door Mobile phone

control
Garage door
Fridge Washing
Machine
Vehicle Sensors
Microwave

Issues with Using SSL/TLS for IoT
• Management overhead of certificates
– If you use commercial certificate authorities (CAs)
• Company Validation Quotes from www.digicert.com

… First, we will verify that the company requesting a certificate is in good standing …
• Domain Validation
… can include emails or phone calls to the contact listed in a domain's whois record …
– Alternative: free & automated CA

• Overhead for managing domains to get certificates

Security Hardware
Approaches

Security Standard FISP 140-2

FIPS 140-2 Levels of Security

FIPS 140-2 Levels of Security

SoC with Crupto Accelerator

…

Summary
 Introduction to problems and challenges of Security

in IoT Area
 Discussion on Security approaches
 Software Approaches: one-time pads, DES, AES, RS

A…
 Hardware Aprroaches

Q&A

Week 7 - IoT Security

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Week 7 - IoT Security

Uploaded by

Copyright:

Available Formats

WIRELESS EMBEDDED SYSTEM

07/31/2021 Copyrights 2020 CE-UIT. All Rights Reserved. 1

 Understanding the importance of Security in IoT

 Understanding the Challenges of IoT Security

 Knowing Solution Approach for IoT Security

07/31/2021 Copyrights 2020 CE-UIT. All Rights Reserved. 3

 Introduction to Security in IoT

 Problem and Challenges of IoT Security

 Solution Approaches for IoT Security

07/31/2021 Copyrights 2020 CE-UIT. All Rights Reserved. 4

 A successful organization should have multiple

 What is Information Security?

 Necessary tools: policy, awareness, training,

07/31/2021 Copyrights 2020 CE-UIT. All Rights Reserved. 6

07/31/2021 Copyrights 2020 CE-UIT. All Rights Reserved. 7

To ensure that information and vital services

07/31/2021 Copyrights 2020 CE-UIT . All Rights Reserved. 9

 Security is concerned with malicious humans that

 Safety is protection against mishaps that are

07/31/2021 Copyrights 2020 CE-UIT . All Rights Reserved. 10

07/31/2021 Copyrights 2020 CE-UIT . All Rights Reserved. 11

IoT Security means new opportunities

07/31/2021 Copyrights 2020 CE-UIT . All Rights Reserved. 12

07/31/2021 Copyrights 2020 CE-UIT . All Rights Reserved. 13

07/31/2021 Copyrights 2020 CE-UIT . All Rights Reserved. 14

07/31/2021 Copyrights 2020 CE-UIT . All Rights Reserved. 15

07/31/2021 Copyrights 2020 CE-UIT . All Rights Reserved. 16

07/31/2021 Copyrights 2020 CE-UIT . All Rights Reserved. 17

07/31/2021 Copyrights 2020 CE-UIT . All Rights Reserved. 18

07/31/2021 Copyrights 2020 CE-UIT . All Rights Reserved. 19

07/31/2021 Copyrights 2020 CE-UIT . All Rights Reserved. 20

07/31/2021 Copyrights 2020 CE-UIT . All Rights Reserved. 21

07/31/2021 Copyrights 2020 CE-UIT . All Rights Reserved. 22

07/31/2021 Copyrights 2020 CE-UIT . All Rights Reserved. 23

07/31/2021 Copyrights 2020 CE-UIT . All Rights Reserved. 24

07/31/2021 Copyrights 2020 CE-UIT . All Rights Reserved. 25

07/31/2021 Copyrights 2020 CE-UIT . All Rights Reserved. 26

07/31/2021 Copyrights 2020 CE-UIT . All Rights Reserved. 27

07/31/2021 Copyrights 2020 CE-UIT . All Rights Reserved. 28

07/31/2021 Copyrights 2020 CE-UIT . All Rights Reserved. 29

07/31/2021 Copyrights 2020 CE-UIT . All Rights Reserved. 30

Hardware • Cruptography Accelerator

07/31/2021 Copyrights 2020 CE-UIT . All Rights Reserved. 31

• Block cipher uses more elaborate algorithms so that key siz

Each participant has two keys, a public and a private one.

A message is encrypted with the public key.

The message can only be decrypted with the private key.

Public and private keys match via clever algorithms.

Relies on a one-way function, easy to compute, hard to revers

• Public key: KB = (n,e)

Based on the fact that it is practical to find three large positive

Based on the fact that it is practical to find three large positive

 Find two distinct large prime number p and q. Let

 Secure Socket Layer/Transport Layer Security

 Widely used for web servers

Slide from Hokeun Kim

Shared secret: Cryptographic key for encryption

Message Encryption Your bank (server)

 Public key cryptography (e.g., RSA)

Your bank (server)

Slide from Hokeun Kim

 However, even with public key cryptography…

Encrypted With Bank's Bank's

Spoof network address to redirect Malory's Malory's Decrypted With