How great is the IoT security threat and what’s the industry doing about it?
Cyber attacks are increasing exponentially. Forbes reported a 300% increase in compromise of billions of IoT security devices in 2019.4
Cyberattacks on UK businesses jumped a fifth in 2020.5 Horror stories abound. As a result, IoT security regulation is being developed, which will place growing pressure on businesses to conform to prescribed standards. The EU Network and Information Security Directive (NISD) imposes heavy fines for non-compliance. Singapore has its own Cybersecurity Act (CSA) and in the US, The National Institute of Science and Technology (NIST) sets out standards for safe, legal product innovation.
The fundamental principles underlying these standards include the need for a strong root-of-trust, secure lifecycle and key management, and a zero-trust approach to supply chain management.
Effective and economical end-to-end security can only be achieved by embracing a philosophy of security-by-design, rather than by trying to bolt it on as an afterthought. In fact, when done correctly, IoT security reduces costs throughout device lifecycles, rather than adding to them.
How cryptographic algorithms are used in the IoT
As classified by The National Institute of Standards and Technology (NIST), part of the U.S. Department of Commerce, there are three types of function generated by cryptographic algorithms: asymmetric keys, symmetric keys, and hash functions.
All three are used in a secure IoT ecosystem.
Asymmetric cryptography
Used for identity management through generating digital signatures and certificate requests, and for implementing key exchange mechanisms. Examples of frequently used cryptographic algorithms include RSA, Elliptic Curve and Diffie-Hellman. There is also a range of new algorithms being standardized by NIST to provide effective post-quantum cryptography.
Symmetric cryptography
Used for data transfer to and from connected endpoint devices. Symmetric keys are typically 128-bit or 256-bit, while it takes a 2048-bit asymmetric key to provide a broadly similar level of security to that of a 128-bit symmetric one. IoT deployments create a lot of data, so speed is important. Also, storing smaller keys requires less silicon area on semiconductor devices, where space is at a premium. The most common example here is AES.
Hash functions
Used for integrity checking, ensuring that received data has not been tampered with.
The silicon-based hardware root-of-trust
The unique identity of a silicon chip, for example, the microcontroller at the heart of an IoT device, is a string of digits – a random number. So are cryptographic keys.
You can create them in software, but random numbers generated in software are perhaps better described as ‘pseudo-random’ because the source of randomness may simply be the system clock. The degree of randomness, or entropy, of a system is one the primary factors that determine how difficult it is to hack. The more random the number (strictly, the higher the entropy of the number), the more secure the system.6
A hardware security module (HSM) can be used to generate more secure keys to be injected into devices on the production floor or remotely. However, this process is extremely expensive – the relevant clean rooms cost millions each year to run – and comes with risks. It involves multiple third parties in the supply chain, multiplying the risk of malicious theft or unintentional leakage of the keys.
Fortunately, there is a more secure alternative which gives end users complete control of IoT security, from chip-to-cloud. It starts with building the seeds of the RoT into the silicon itself, exploiting ‘physical unclonable functions’.
The role of physical unclonable functions, or PUFs, in hardware security
Each semiconductor chip is unique by virtue of tiny differences created in its silicon die during the manufacturing process. Such differences can be used to create physical (or physically) unclonable functions, or PUFs, which can contribute to robust security.
PUFs are used to identify silicon chips in a similar way that fingerprints, or iris recognition, are used to identify people. If you can use hardware IP to generate the identities and keys it is far more secure than the common practice of injecting these, and significantly less expensive. However, not all methods of creating such a fingerprint are equally secure or equally cost-effective.
For an IoT system to be secure today and in the post-quantum era, its RoT must be based upon quantum-driven entropy, or randomness. What does this mean?
PUFs can be categorized by how the variations in silicon chips are measured or by how the randomness is derived. First-generation PUFs were derived by measuring physical characteristics. They are less secure than second-generation PUFs, which are derived from measuring quantum effects.
The quantum computing era will demand quantum-driven security for IoT systems. And even if that era has not yet arrived, quantum-driven security gives better protection for today’s systems too.
It is also worth noting that first-generation PUFs typically generate only a single seed for random number generation, and often still rely on key injection for additional cryptographic keys – such keys residing in secure non-volatile memory. Fundamentally, these devices don’t solve the security or cost issues at the heart of IoT.
The quantum advantage
QDID exploits randomness in the thickness of an oxide layer on silicon wafers resulting from manufacturing variability. The extent of quantum tunnelling – a phenomenon whereby electrons propagate through barriers in the fabric of the wafers – varies with the thickness and atomic structure of the oxide layer.7 QDID measures these quantum effects to generate multiple, uncorrelated cryptographic keys inside the silicon chips made from the wafers. The keys can be used for identities, cryptography, and authentication.
This unique approach eliminates the need for keys to be injected or stored, simultaneously reducing system costs while increasing security. Crucially, having multiple, uncorrelated keys also results in the microcontroller (or other device containing the QDID) to be usable for multiple purposes, and even to be passed to a new owner, allowing secure use of the IoT device.
A platform that solves IoT security challenges
What’s needed is a universal platform, hosted on a server, that connects IoT devices to the cloud, or several clouds, quickly and easily. And it needs to be a platform that does not demand cryptographic expertise to use it. After all, think how many fewer car drivers there would be if they had to be qualified mechanics to get behind the wheel.
QuarkLink™ easily secures and connects devices safely
QuarkLink is one platform that addresses this challenge, without compromising security, without you having to depend on third-party support, and without you having to connect devices one at a time. It will work with RoTs from Crypto Quantique’s partners and, most securely, with devices that employ Crypto Quantique’s QDID, quantum-driven RoT hardware IP.
An end-to-end IoT security platform has to perform three main roles:
Provisioning the IoT devices.
Onboarding those devices to a server so that they can access applications.
Managing the devices throughout their lifecycle.
Here’s how QuarkLink tackles these tasks to deliver seamless cloud connectivity.
3. IoT device management
The management of IoT devices has five main facets:
- Monitoring their functional integrity to ensure that they have not been compromised by a cyberattack.
- Firmware signing and encryption to enable secure updates over the air (OTA).
- Key and certificate renewal, which may be needed after the system has a fault or needs reconfiguration.
- Device revocation if it is compromised and must be disconnected from the server.
- Subsequent re-onboarding if the device is being passed to a new owner.
QuarkLink enables system owners and operators to manage all of these functions via a simple graphical user interface based on drop-down menus and action buttons.
Here are the most important questions you need to ask, and why.
Are device identities created in hardware or software?
If the answer is software, there is always the risk that someone else’s software may compromise security.
If the identities are created in hardware, how are these and the associated cryptographic keys generated?
If this is done by measuring physical parameters, there may be a good degree of entropy, but the outcome is still deterministic. Such a solution may provide a reasonable level of security today, but its efficacy may well be compromised in the post-quantum computing environment that is just around the corner.
How comprehensive and well-integrated are the hardware and software elements of the solution?
To maximize security, you need to minimize the involvement of third parties by selecting a fully integrated, chip-to-cloud security architecture.
Q:Architecture, which comprises the QDID quantum-driven hardware IP block and QuarkLink universal IoT security platform, was designed from the ground up to meet not only today’s IoT security challenges but also those that will arrive in the wake of quantum computing. Scalable IoT security has never before been so powerful, and yet so easy to implement.
Q:Architecture has closed the IoT security gap.
Watch this 10 minute demonstration
See the QuarkLink universal security management platform in action
