© 2016 Nokia 1

IoT Security

Challenges & Opportunities

Erez Waisbard

Haifa 3rd Security Research Seminar

December 2016

© 2016 Nokia 2

A Tale of IoT

© 2016 Nokia 3

Smart Refrigerator A Tale of IoT

Interconnecting different devices from different vendors

No Milk

© 2016 Nokia 4

Ideal world A Tale of IoT

Secure Intercommunication

© 2016 Nokia 5

The real world A Tale of IoT

No Intercommunication

Tower of Babel

© 2016 Nokia 6

The Security Model

© 2016 Nokia 7

The Internet model Security Model

Trust relies on Root CA and public key cryptography

© 2016 Nokia 8

IoT devices security Security Model

IoT Devices are not secure

© 2016 Nokia 9

IoT devices security Security Model

IoT Devices are not secure

We’re at a crisis point now with regard to the security of embedded systems, where computing is embedded into the hardware itself — as with the Internet of Things.

Bruce Schneier, Jan, 2014

© 2016 Nokia 10

The IoT model Security Model

PKI is not suited for IoT

•No central Trusted Authority

•Multiple vendors

•Multiple service providers

•Multiple Protocols

•Low power unprotected devices

© 2016 Nokia 11

The Blockchain Technology

© 2016 Nokia 12

Bitcoin [October 2008]

© 2016 Nokia 13

Popularity

Ransomeware & Darknet

© 2016 Nokia 14

Digital Payment before Bitcoin (using banks)

Alice’s credit card number

Alice Bob

Alice’s credit card number

Alice Bob

transfer money to

Bob’s account

transfer confirmation

Relies on a central trusted entity No digital cash

© 2016 Nokia 15

Replacing the bank with a bulletin board

User P1 transfers a coin #16fa35afc6831 to user P2

© 2016 Nokia 16

Distributed Bulletin-Board

© 2016 Nokia 17

Problem Definition Blockchain Technology

Nokia Internal Use

© 2016 Nokia 18

The Bitcoin solution

Majority of computing power

instead of majority of parties

© 2016 Nokia 19

What is a blockchain?

Sender Receiver Message

© 2016 Nokia 20

Open Challenges Blockchain Technology

© 2016 Nokia 21

Blockchain Applications

(beyond BitCoin)

© 2016 Nokia 22

Anti-Counterfeit

• Each product is labeled with a block verified tag.

• Verified supply chain

• Consumer activation and validation

© 2016 Nokia 23

Notary

• Proofs of:

– Ownership

– Integrity

• Privacy preserved using cryptographic hash functions

© 2016 Nokia 24

Distributed CA

© 2016 Nokia 25

Secure DNS

© 2016 Nokia 26

Distributed web hosting

© 2016 Nokia 27

Research Tracks

Bell-Labs

© 2016 Nokia 28

Research Track : Trust in IoT

© 2016 Nokia 29