IoT Security Model

Article Info

Contributed by
2 authors

Last updated on
2022-02-15 11:56:41

Improve this article

IoT Security
Tools for IoT Security
System-on-Chip Security
Wi-Fi Security
Network Security
Cloud Security

Article Versions

4 2022-02-15 11:56:41
3394,2587 4,3394

By devbot5S

Migrating blockquotes to markdown syntax
3 2021-06-25 10:52:53
2587,2582 3,2587

By arvindpdmn

Completing content. Publishing.
2 2021-06-22 11:46:30
2582,2581 2,2582

By arvindpdmn

Added See Also items.
1 2021-06-22 11:43:54
1,2581

By arvindpdmn

Starting with some questions.

Chat Room

Submitting ...

You are editing an existing chat message.
2021-06-25 10:53:52
-

By devbot5S

[URL Check] The following URLs in this article are outdated. Please update.

Redirected URLs:
References: https://www.ioxtalliance.org/s/ioXt-Pledge-Book_Secure.pdf → https://static1.squarespace.com/static/5c6dbac1f8135a29c7fbb621/t/5fb43a05bda7c3689ea5bd32/1605646853608/ioXt+Pledge+Book_Secure.pdf

A suitable IoT security model is end-to-end and spans the entire protocol stack. Source: Adapted from Intel 2015, fig. 1 and 2.

Since the Internet of Things (IoT) is not a standard, there's no single standardized approach to security. There are multiple IoT reference models defined by various stakeholders including ITU-T, Cisco, Intel, IBM, Microsoft, Symantec, and others. Security is often considered in these reference models. This article looks at some of these security models.

An IoT security model can be seen in two perspectives: (a) In a layered architecture, there's a security layer that spans the entire stack, from the connectivity layer at the bottom to the application layer at the top. (b) In an end-to-end solution, security is implemented at all points, from end devices to network to cloud.

Models provide a formal framework to implement security and evaluate the maturity of those implementations.

Discussion

How is security addressed within the IoT Reference Model?
Cisco's IoT security reference model. Source: Cisco 2014, fig. 10.
For illustration, let's consider Cisco's reference model for security. It's a layered architecture with the lowest layers being device centric and the highest layers being more cloud centric. For control, information flows top to bottom. For monitoring, the flow is opposite. Security is considered at each layer. The lower layers focus on giving secure access to physical hardware while also providing a trusted environment for code execution. At higher layers, the focus is on identity management, authentication, analytics, and so on.
IBM's own model emphasizes the sensor gateway and IoT gateway where security is important. However, it too recognizes that security concerns the entire system. It identifies data security, device security, user security and application security.
Microsoft Azure divides the system into things (IoT devices), insights (data processing in the cloud), and action (business integration and machine learning). Security is a cross-cutting concerns across all three parts. We need secure provisioning of devices, secure connectivity, data protection during processing and storage, and secure user management.
How can I apply threat modelling to secure IoT systems?
Microsoft Azure for IoT defines zones and trust boundaries. Source: Microsoft Docs 2018.
Threat modelling is an approach used in Microsoft Azure. In particular, they classify threats according to STRIDE (Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege). A threat could fall under multiple categories at the same time.
When applied to IoT, the process involves modelling the application, enumerating threads, mitigating threats and validating the mitigations. Core elements of the threat model are processes, data stores, data flows, and external entities.
They also recommend partitioning the system into zones, each defined with its own data, authentication and authorization requirements. Typical zones include devices, field gateways, cloud gateways and services. Trust boundaries between zones are where STRIDE threats can occur. Focus must be on application features that are relevant to security and those that touch trust boundaries.
For instance, data going in an out of Azure IoT Hub or Event Hub must be protected at protocol level (eg. HTTP/MQTT/CoAP). At device level, read-only OS partition, signed OS image, strong authentication, memory encryption and Trusted Platform Module (TPM) are needed.
What is meant shared security model for IoT?
Division of responsibilities across customer, application, PaaS and IaaS. Source: Black 2017.
The shared security model looks at IoT security from the perspective of stakeholders and their responsibilities. An IoT system has many components and interfaces. It can be secured only when everyone plays their part.
PTC ThingWorx, which is an IoT cloud platform, has identified the following:
- Product Vendor: Securely test, release, document and support software. Alert customers on vulnerabilities. Train employees on best practices.
- Technology Partners & Systems Integrators: Securely test, release, document and support extensions to the basic product.
- Public Cloud Providers: Provide all elements of cloud security including hardware, software, networking, and access control.
- Administrators: Manage identities and user privileges following the principle of least privilege. Scan networks for malware. Set script timeouts. Configure system in line with security policies.
- Users: Use strong passwords. Regularly update local clients and devices. Avoid navigating to suspicious sites.
- IT Organization: Meet regulatory requirements. Vet third-party software vendors. Train employees on product usage and best practices.
I've heard of the IoT trust model. What is it?
The IoT trust model is inspired by how trust works in human relationships. When we trust someone, we're confident about their integrity, ability or character. The model asks if we can similarly trust IoT devices, services and data. The challenge with IoT is that a service may depend on a dozen others. Quantifying trust is not trivial, though Trust Network Analysis-Subjective Logic (TNA-SL) is one proposed method.
A trust model allows us to ask questions such as, "Can I rely on devices to defend against viruses? Can devices update themselves? If a device is compromised, do I take it offline or is there a service to do this? How are third parties using my data?"
Trust attributes become useful. A service may be marked as "child-safe". A piece of data may contain "GPS Location" or "Anonymized" attribute.
There's also a human-centric trust model that considers average users, not just system administrators. Users must find it easy to delegate access to devices and data, or determine who can be trusted and for what purposes.
Symantec takes the view that trust is established using cryptography, digital certificates and Certificate Authorities (CAs).
How can I evaluate the security maturity level of IoT systems?
Security maturity target in a HVAC system. Source: Rudina and Goncharov 2019.
A maturity model can help determine if current implementations are secure enough. For example, for some IoT devices checking the diagnostic logs may be adequate. For others such as HVAC systems, real-time monitoring and control, and protection against malware are necessary. A maturity model provides a systematic approach to what should be protected, what measures are suitable and to what extent they should be applied.
The Security Maturity Model (SMM) proposed by the Industrial Internet Consortium (IIC) identifies five levels of maturity: Level0 (None), Level1 (Minimum), Level2 (Ad hoc), Level3 (Consistent), and Level4 (Formalized). It also looks at three scope levels: Level1 (General), Level2 (Industry specific), and Level3 (System specific).
At Level1 maturity, at least the goals are defined and basic measures are implemented. At Level2, use cases are identified. At Level3, best practices, standards, regulations and tools are included. At Level4, the entire process is defined. It's useful to note that,
Maturity is about effectiveness, not the arbitrary use of mechanisms.

Milestones

2011

Køien publishes a paper titled Reflections on Trust in Devices: An Informal Survey of Human Trust in an Internet-of-Things Context. He notes that IoT devices are varied and often operate in hostile environments. Neither software nor hardware can be trusted completely. We therefore need security measures to mitigate risks.

2013

Riahi et al. propose a systematic approach to IoT since traditional methods don't consider aspects unique to IoT. Their model considers four entities: persons, processes, intelligent objects, and the technological ecosystem. When these entities interact, there's tension among them. They consider the following tensions: identification/authentication, privacy, trust, safety, responsibility, reliability, and auto-immunity.

2017

NXP proposes a secure distributed manufacturing model that looks at how NXP, OEMs and ODMs can play their part in securing the supply chain. For example, OEMs generate their own salt that even NXP doesn't know but NXP processors will protect this salt. The model aims to streamline security at the chip and device level. The model brings transparency and trustworthiness.

Dec
2018

The eight principles of ioXt Security Pledge. Source: ioXt Alliance 2020, pp. 7.

The ioXt Alliance crafts the ioXt Security Pledge consisting of eight principles. The Alliance was previously known as Internet of Secure Things. It brings together wireless carriers, manufacturers, standard groups, compliance labs and government organizations.

Jun
2019

ITU-T publishes the Y.4460 Recommendation, which details an IoT reference model. In fact, it describes three models based on device capability: low processing and low/high connectivity, and high processing and high connectivity. Security is not given due consideration and it's covered in a small paragraph.

May
2020

The Security Maturity Model process for IoT. Source: Carielli et al. 2020a, fig. 1.

The Industrial Internet Consortium (IIC) publishes two white papers describing what it calls the IoT Security Maturity Model (SMM). This is partly based on the Industrial Internet Security Framework (IISF) published by IIC in 2016. The SMM process is iterative and is based on Plan-Do-Check-Act (PDCA) cycle. The process starts with identifying a maturity target, assessing current level of maturity and working towards the target.

References

Article Stats

1447

Words

Authors

Edits

Chats

Likes

13K

Hits

Cite As

Devopedia. 2022. "IoT Security Model." Version 4, February 15. Accessed 2023-11-12. https://devopedia.org/iot-security-model

Contributed by
2 authors

Last updated on
2022-02-15 11:56:41

Improve this article

security iot framework model

IoT Security
Tools for IoT Security
System-on-Chip Security
Wi-Fi Security
Network Security
Cloud Security

IoT Security Model

Discussion

Milestones

References

Further Reading

Article Stats

Author-wise Stats for Article Edits

Cite As

See Also

Article Warnings

Login