Design Article
Comment
KerryM
Troubleshoot1
(*) 1980 A multi-story Bank with remote facilities addressed and installed a ...
What Internet of Things needs to become a reality
Kaivan Karimi, Freescale; Gary Atkinson, ARM
10/30/2012 10:57 AM EDT
Here’s what we mean by secure information:
Information needs to be available when needed: This is the most basic level of security. If the information regarding an intruder in your house gets sent to the police station the next day, that information loses its value. The assurance that the services and their underlying infrastructure can process, store and deliver the data when and where it’s needed is the first aspect of a secure system. In certain cases, redundant infrastructure needs is required to ensure this will happen.
Information needs to be confidential: Hence, the owner of the information decides which authorized people, groups or organizations can access it. Safeguarding the information obtained by IoT services is critical, or those services will lose the users’ trust. Mechanisms must be put in place to ensure confidentiality of the information exchanged. This is a tough balancing act, as there are a whole host of IoT-related services designed to leverage data mining and generate push services. The “opt out” mechanism for such services would be subject to the governance of the IoT.
The integrity of data needs to be assured: Assurance that the information is accurate, authentic, timely and complete is key. Unless the data can be trusted and relied upon, it cannot be used for its intended purposes, and the entire service paradigm around that data will break down.
The security of the system is as good as the last threat it was able to prevent, and, as soon as it gets broken, one needs to implement new ways of making it secure again. If the recent hacking of credit card and personal information from reputable outlets on the Internet is any indication of the challenges facing IoT services, the Internet security infrastructure available today is inadequate to manage IoT services.
In the summer of 2010, malware for the first time targeted electronic process control systems instead of the traditional targets of credit cards and personal information. The Stuxnet Trojan that attacked Siemens process control systems at nuclear plants demonstrated incredible levels of sophistication and showed the potential damage that could be done to undermine the security of the IoT.
Device-level Security: There are different types (MCU, hybrid MCU/MPU, integrated MCUs, etc.) and layers of embedded processing at various nodes of the IoT, and for any device to be considered smart so it can be connected to the Internet, it must incorporate an embedded processor. Embedded processors are going to be pervasive in the IoT, and they’d better be extremely secure.
Early in Kaivan’s career, working on cellular phone modems, he learned the hard way how easy it was to hack a phone during the boot-up process. MCUs are similarly vulnerable during their boot-up process, when software is executed from programmable memory using the code stored in the read-only memory (ROM) or non-volatile memory (NVM)/flash memory. During this process, expert hackers can break the routine and hack the system in a variety of ways. Many new technologies are rolling out to address the security issues related to passive attacks (e.g. glitching) and invasive attacks (e.g. UV attacks), but more is likely necessary.
The intent of the IoT is to put smart devices on a sort of universal neural net, controlling them remotely. Hence, each of these identifiable objects (billions of them) can introduce a threat to the overall system. With such potential for disaster, are there best practices engineers can learn to enhance the security of MCUs in an IoT system?
By now it should be clear that networks of the future will connect more objects, machines, and infrastructure, to a global neural network of cloud-based services, than they will be connecting people. A tsunami of data and services will affect the way we live, well beyond the changes networks and people experienced when the Internet itself first arrived and changed the way people communicated. At the heart of IoT are layers of embedded processing, from the most remote satellite sensing node, all the way to the core of the network. The diversity of services that are being planned for IoT means no one company can develop full solutions and supporting IoT-based innovations. Rather, IoT-based innovations will require a wide and rich ecosystem of partner companies working together to bring IoT-based services to the market. An open (non-proprietary) platform that allows all partners working together using same baseline technologies is the key to make IoT happen.
So when does the IoT become a reality?
The pervasiveness of embedded processing is already happening everywhere around us. At home, appliances as mundane as your basic toaster now come with an embedded MCU that not only sets the darkness of the piece of toast to your preference, but also adds functional safety to the device. Your refrigerator has started talking to you and keeping track of what you put in it. There are energy-aware HVAC systems that can now generate a report on the activity in your house and recommend ways to reduce your energy consumption. The electrification of vehicles has already started happening, and in just a few years from now, each car will contain infinitely more electronics than they did just five years ago. And the cars of the future will indeed be able to drive themselves. Similar changes are also happening in other aspects of our lives … in factories, transportation, school systems, stadiums and other public venues. Embedded processing is everywhere.
Connecting these smart devices (nodes) to the web has also started happening, although at a slower rate. The pieces of the technology puzzle are coming together to accommodate the Internet of Things sooner than most people expect. Just as the Internet phenomenon happened not so long ago and caught like wildfire, the Internet of Things will touch every aspect of our lives in less than a decade.
If you found this article to be interest, visit Microcontroller / MCU Designline where – in addition to my Max's Cool Beans blogs on all sorts of "stuff" – you will find the latest and greatest design, technology, product, and news articles with regard to all aspects of designing and using microcontrollers.
Also, you can obtain a highlights update delivered directly to your inbox by signing up for my weekly newsletter – just Click Here to request this newsletter using the Manage Newsletters tab (if you aren't already a member you'll be asked to register, but it's free and painless so don't let that stop you [grin]).
Last but certainly not least, make sure you check out all of the discussions and other information resources at All Programmable Planet. For example, in addition to blogs by yours truly, microcontroller expert Duane Benson is learning how to use FPGAs to augment (sometimes replace) the MCUs in his robot (and other) projects.
Information needs to be available when needed: This is the most basic level of security. If the information regarding an intruder in your house gets sent to the police station the next day, that information loses its value. The assurance that the services and their underlying infrastructure can process, store and deliver the data when and where it’s needed is the first aspect of a secure system. In certain cases, redundant infrastructure needs is required to ensure this will happen.
Information needs to be confidential: Hence, the owner of the information decides which authorized people, groups or organizations can access it. Safeguarding the information obtained by IoT services is critical, or those services will lose the users’ trust. Mechanisms must be put in place to ensure confidentiality of the information exchanged. This is a tough balancing act, as there are a whole host of IoT-related services designed to leverage data mining and generate push services. The “opt out” mechanism for such services would be subject to the governance of the IoT.
The integrity of data needs to be assured: Assurance that the information is accurate, authentic, timely and complete is key. Unless the data can be trusted and relied upon, it cannot be used for its intended purposes, and the entire service paradigm around that data will break down.
The security of the system is as good as the last threat it was able to prevent, and, as soon as it gets broken, one needs to implement new ways of making it secure again. If the recent hacking of credit card and personal information from reputable outlets on the Internet is any indication of the challenges facing IoT services, the Internet security infrastructure available today is inadequate to manage IoT services.
In the summer of 2010, malware for the first time targeted electronic process control systems instead of the traditional targets of credit cards and personal information. The Stuxnet Trojan that attacked Siemens process control systems at nuclear plants demonstrated incredible levels of sophistication and showed the potential damage that could be done to undermine the security of the IoT.
Device-level Security: There are different types (MCU, hybrid MCU/MPU, integrated MCUs, etc.) and layers of embedded processing at various nodes of the IoT, and for any device to be considered smart so it can be connected to the Internet, it must incorporate an embedded processor. Embedded processors are going to be pervasive in the IoT, and they’d better be extremely secure.
Early in Kaivan’s career, working on cellular phone modems, he learned the hard way how easy it was to hack a phone during the boot-up process. MCUs are similarly vulnerable during their boot-up process, when software is executed from programmable memory using the code stored in the read-only memory (ROM) or non-volatile memory (NVM)/flash memory. During this process, expert hackers can break the routine and hack the system in a variety of ways. Many new technologies are rolling out to address the security issues related to passive attacks (e.g. glitching) and invasive attacks (e.g. UV attacks), but more is likely necessary.
The intent of the IoT is to put smart devices on a sort of universal neural net, controlling them remotely. Hence, each of these identifiable objects (billions of them) can introduce a threat to the overall system. With such potential for disaster, are there best practices engineers can learn to enhance the security of MCUs in an IoT system?
By now it should be clear that networks of the future will connect more objects, machines, and infrastructure, to a global neural network of cloud-based services, than they will be connecting people. A tsunami of data and services will affect the way we live, well beyond the changes networks and people experienced when the Internet itself first arrived and changed the way people communicated. At the heart of IoT are layers of embedded processing, from the most remote satellite sensing node, all the way to the core of the network. The diversity of services that are being planned for IoT means no one company can develop full solutions and supporting IoT-based innovations. Rather, IoT-based innovations will require a wide and rich ecosystem of partner companies working together to bring IoT-based services to the market. An open (non-proprietary) platform that allows all partners working together using same baseline technologies is the key to make IoT happen.
So when does the IoT become a reality?
The pervasiveness of embedded processing is already happening everywhere around us. At home, appliances as mundane as your basic toaster now come with an embedded MCU that not only sets the darkness of the piece of toast to your preference, but also adds functional safety to the device. Your refrigerator has started talking to you and keeping track of what you put in it. There are energy-aware HVAC systems that can now generate a report on the activity in your house and recommend ways to reduce your energy consumption. The electrification of vehicles has already started happening, and in just a few years from now, each car will contain infinitely more electronics than they did just five years ago. And the cars of the future will indeed be able to drive themselves. Similar changes are also happening in other aspects of our lives … in factories, transportation, school systems, stadiums and other public venues. Embedded processing is everywhere.
Connecting these smart devices (nodes) to the web has also started happening, although at a slower rate. The pieces of the technology puzzle are coming together to accommodate the Internet of Things sooner than most people expect. Just as the Internet phenomenon happened not so long ago and caught like wildfire, the Internet of Things will touch every aspect of our lives in less than a decade.
If you found this article to be interest, visit Microcontroller / MCU Designline where – in addition to my Max's Cool Beans blogs on all sorts of "stuff" – you will find the latest and greatest design, technology, product, and news articles with regard to all aspects of designing and using microcontrollers.
Also, you can obtain a highlights update delivered directly to your inbox by signing up for my weekly newsletter – just Click Here to request this newsletter using the Manage Newsletters tab (if you aren't already a member you'll be asked to register, but it's free and painless so don't let that stop you [grin]).
Last but certainly not least, make sure you check out all of the discussions and other information resources at All Programmable Planet. For example, in addition to blogs by yours truly, microcontroller expert Duane Benson is learning how to use FPGAs to augment (sometimes replace) the MCUs in his robot (and other) projects.
|
|
|
|
|
Navigate to related information
SylvieBarak
10/31/2012 2:45 PM EDT
You know what the Internet of Things really needs to take off? Assurance that the security is in place to make it a good thing to use...
Sign in to Reply
lcovey
11/1/2012 12:10 PM EDT
Not so sure about the security angle, Sylvie. Like Helen Keller said "Security is an illusion." It will never be absolute unless humanity suddenly becomes universally sinless.
The real issue of the IoT is the management of data. Current search is based on words and phrases, primarily, but it is constantly being gamed by the SEO industry. We need a software approach that institutes an automated omniscience, more than just artificial intelligence, that brings the right information to the devices when requested. There's a lot of stuff we need to know but it comes to us in semi-truck loads, rather than in appropriate amounts. when someone figures that out, the IoT will take off.
Sign in to Reply
KerryM
5/7/2013 2:29 PM EDT
Sylvie,
I agree that you hit the nail on the head.
lcovey is right that managing the data is a 'big deal'. But unless you can be sure that the data is authentic/accurate/reliable, it's not clear that the data will be of any value. And if I can spoof data to make it look like it came from you instead of me there are all sorts of unpleasant options.
The technology is there - cryptography, hardware security devices, protected protocols - we just need to see them get integrated in the solutions.
Sign in to Reply
kaivan.karimi
10/31/2012 3:34 PM EDT
You are absolutely right Sylvie. With Millions/Billions of devices hanging off the "universal neural net", the potential security issues can be disastrous….…. No one likes to see something benign like their home electricity hacked. Imagine what can happen to larger mission critical infrastructures if they become the target. Security for IoT is perhaps the most aspect of the whole thing.
Sign in to Reply
Max the Magnificent
10/31/2012 3:47 PM EDT
See also my blog: IPv4, IPv6, The Internet of Things, 6LoWPAN, and lots of other “Stuff” ( http://bit.ly/VE4fMH )
Sign in to Reply
iniewski
11/1/2012 3:01 PM EDT
Pretty interesting stuff Max, would you be interested in giving a talk on this topic at emerging technologies event in Whistler in 2013? www.cmoset.com, Kris
Sign in to Reply
Max the Magnificent
11/1/2012 3:12 PM EDT
I didn't write this article -- but I can put you in touch with the authors if you wish
Sign in to Reply
expendable crewman #1
10/31/2012 4:44 PM EDT
How long will it be before “We” become part of the “Internet of Things”? As soon as everything about you is able to be tracked, you will not be allowed to be without your connected device. To make sure that doesn’t happen the device will be embedded in you at birth and constantly transmit data about you. Not long after that the data will become bidirectional instructing you how to best serve the collective. Resistance is futile.
Sign in to Reply
Max the Magnificent
10/31/2012 4:45 PM EDT
That's why I never go outside without wearing my aluminum hat
Sign in to Reply
expendable crewman #1
10/31/2012 4:55 PM EDT
Is that the one with the propeller on top?
Sign in to Reply
Max the Magnificent
10/31/2012 4:59 PM EDT
No -- the Propeller Beanie is actually used to hide my aluminum skull-cap (I don;t want people to laugh at me :-)
Sign in to Reply
docdivakar
11/1/2012 12:04 PM EDT
Good article... one thing the authors do not mention is the value from prognostics capability that can be in the embedded processing layer of sensor networks.
MP Divakar
Sign in to Reply
kaivan.karimi
11/2/2012 5:31 PM EDT
Hi MP,
Hope all is well. could you please elaborate more?
Thanks,
Kaivan
Sign in to Reply
docdivakar
11/21/2012 5:30 PM EST
Kaivan, didn't get to this message for a while, sorry for the late reply.
My comment was rather high-level, addressing the local embedded processing layer most often done by MCU/Micro's you were referring to. I think there are many software+hardware solution opportunities, both hierarchical or single stack, that can provide intelligent and correlated information from IoT. I will stop right there (since that is what I am working to protect as IP!). But you were right on track in the article!
MP Divakar
Sign in to Reply
mac_droz
11/2/2012 6:16 AM EDT
Apart from being interesting concept for all the geeks around, why would you need your home to be smart? One of the arguments I hear is that it will save the energy.... what a lot of bollocks. Unless we start building houses that are truly passive (that's the technology to follow and it exists for more than 20 years) nothing will change. If your house is not insulated than the super-duper thermostat with weather prediction and all the IP addressable light bulbs will not make it warmer. What is wrong with standard light switch? Are we too retarded to use it? And remember to switch it off when we leave the room? Or do you guys have 1000W lamps in every room?
Sorry for my rant but every now and then I see those articles about super benefits of smart homes but they are not addressing real problems.
The real problem with houses is to keep them warm/cold depending on the season with as little external energy as possible.
Sign in to Reply
iniewski
11/2/2012 10:57 AM EDT
Good point @mac_droz, the benefits of smart homes were never clear to me...and exactly to your point: I have moved to a brand new house from 15-year old house. The old house was properly build with extra wall insulation. The new house was build to some green standards, have high tech windows, efficient lighting etc. And guess what, walls are thin and my heating being is larger although the new house is less than half the size of the old ones. I can install as much electronics as I want the heat is escaping thru the walls and holes in all windows and doors. I guess I ended up getting a stupid house ;-)...Kris
Sign in to Reply
Bert22306
11/2/2012 4:27 PM EDT
Okay, another "excuse" to utter my mantra: the IoT is nothing more than "more of the same." Like everything else touted as being something brand new, yes, even this "cloud" business, in reality it is an evolution of what just about everyone is already familar with.
The Internet, to get down to the fundamentals, has ALWAYS been about "things." Internet addresses have ALWAYS been the address of an interface to a "thing." Not to a person. To a computer, to a peripheral device such as a printer, to a sensor, to a router, to a server at home or at work or in "the cloud." All things. Even your e-mail "address" becomes translated into the actual IP address of a "thing."
It's only cost and available Internet bandwidth that has kept things more or less under control. But already, you can contact your home PVR over the Internet, you can contact your car over 3G (and get remote diagnostics), easy enough to think of controlling your home heating system remotely over the Internet, and surely everyone knows that your home heating systems are also auto-adjusting (for too many decades to bother mentioning).
Remote and automated factory controls have been available for many years. Remote as well as automated control systems for cars, airplanes, ships, public transportation systems such as Metro, airport ground transportation systems, you name it, have also been with us for a whole lot of time now. Connecting each of these to the Internet, assuming they aren't already connected (many are!), is not a huge leap, is it?
So, if you want to make a few more of your own personal devices ALSO available over the Internet, surely this shouldn't be seen as ground-breaking innovation?
Sign in to Reply
kaivan.karimi
11/2/2012 5:21 PM EDT
Hi Bert22306,
You are absolutely right that all of this can be done today from remote comand and control basis, and IPv6 will make it more pervasive. This said, there are a ton of services being worked on that leverages these capabilities today, that VCs weren't spending money on before, and now they are. IPv6 along with a set of security standards, maybe the tipping point that leverages most of what is there today, and come up with a whole new set of services.
all the best,
Kaivan
Sign in to Reply
Bert22306
11/2/2012 5:38 PM EDT
Kaivan, I agree that IPv6 can make these Internet-connected devices "more pervasive," simply because it has so much more address space. But a problem might be that people will misconstrue that comment.
You don't HAVE to use IPv6 to achieve most of these capabilities. And the security measures available in IPv6 are also available in IPv4. The very same security protocols.
So as far as I'm concerned, people should not go off assuming that this IoT was practically impossible until now.
One simple technique, which has worked for decades, is that previously isolated control system networks are connected to the Internet via a gateway device. The gateway device is easily capable of accepting messages from the Internet at an interface with an IP address, and then translating that address into the scheme used by the previously isolated control system net. And vice versa, for messages originating from the control system net.
With that technique, as well as more standardized techniques such as NAPT, you can greatly expand the usefulness of even the 32-bit IPv4 address space.
It' true that refrigerators and toasters have not typically been connected to the Internet in the past, so perhaps the average joe didn't know this could be done. However EET readers should not be bowled over by any of this.
Sign in to Reply
kaivan.karimi
11/9/2012 5:04 PM EST
Hi Bert,
IoT is nothing but a collection of evolutionary steps that most of the technologies are available today, however collectively it enbales new classes of services....the "whole" at that point will be much greater than the sum of the pieces.
BR,
Kaivan
Sign in to Reply
iniewski
11/2/2012 4:32 PM EDT
I agree @Bert...IoT is just a new buzzword, along the lines of many other ones (like cloud computing which was done years earlier without using the term)...marketing news buzzwords though, otherwise we would be lacking any exciting topics to talk about ;-)
Sign in to Reply
kaivan.karimi
11/2/2012 5:16 PM EDT
Hello @mac-droz and iniewski,
Hope all is well. @mac_droz has a great point about passive houses with the right insulation, as indeed heating and cooling are the largest expense for most home, and account for over 50% of the energy use in a typical U.S. home. You don’t need a “smart home” to keep cost down on your heating, cooling or lighting for that matter. There are a couple of cases, that a “connected” home with visibility into their appliance usage can help the grid, hence the concept of energy savings. During the peak hour for cooling or heating, e.g. 2-5 pm mid July in Austin, Texas, when the air conditioner is blasting non-stop, and the grid is experience a peak capacity….at the margins, the cost of producing electricity is a lot more expensive for the utility companies, than what they are selling the electricity to you. If they can track your appliances usage and make sure that during these peak hours you are not also as an example running your washing machine, and incentivize you to run it late at nights, then it’s a win-win for everyone, and cost of energy consumption can be reduced by a reasonable amount. This can only happen when the energy usage can be tracked at a major appliance level at the time of usage, as oppose to aggregate at the meter.
Most other services related to a “smart home” are convenience based, for remote tracking and monitoring and command and control….all of this can be done today, with or without the IoT tag on it… the only thing that makes all of this happen is IPv6, so more unique addresses for more uniquely identifiable devices on the internet.
Iniewski,
I am working on a paper on the role of sensor fusion in IoT that may be suitable for your cmoset. Please send me an email and we can discuss (kaivan.karimi@freescale.com).
All the best,
Kaivan
Sign in to Reply
iniewski
11/2/2012 5:42 PM EDT
thank you Kaivan, I will be happy to discuss, will send you an email in a moment
Sign in to Reply
Chris_999
11/8/2012 4:21 PM EST
Is there a chance to get the images in higher resolution
Sign in to Reply
Max the Magnificent
11/8/2012 4:43 PM EST
Let me see what I can do -- my Internet went down in the office, so I'm working from home -- I'll have a look around tomorrow -- Max
Sign in to Reply
Max the Magnificent
11/9/2012 9:45 AM EST
I just uploaded them as a PDF http://bit.ly/RJnB4J
Sign in to Reply
iniewski
11/9/2012 11:34 AM EST
Max, interesting pictures...I will be editing a book on IoT in 2013, would you be interested in co-editing? kris.iniewski@gmail.com
Sign in to Reply
kaivan.karimi
11/9/2012 5:00 PM EST
Try
http://www.freescale.com/files/32bit/doc/white_paper/INTOTHNGSWP.pdf
I can also send you the ppt version of each graphic. please send me an email kaivan.karimi@freescale.com
and let me know which one you want.
BR,
Kaivan
Sign in to Reply
Chris_999
11/9/2012 5:15 PM EST
Many thanks for following up so quickly with the images!
Sign in to Reply
Max the Magnificent
11/9/2012 6:01 PM EST
I live to serve :-)
Sign in to Reply
Troubleshoot1
3/11/2013 1:14 PM EDT
(*) 1980 A multi-story Bank with remote facilities addressed and installed a 100% Computer Controlled “complex”. It was operational on Day One. Within the next (7) Years additional technology was adapted in other projects that would be very compatible to enhance the First Project. (Interactive Tele-video with data – proven 1966, Holography Proven 1986, To the Penny monetary flows same day as start of SWIFT. Yet another example is the Chicago Mercantile exchange.) All other areas were already functional. Real World Functional operations exist to prove it! Newer devices such as the Apple I-5 and similar have addressed total communications with all these functions at this time. The ONLY limitations are the “VISION” of those involved and the KNOWLEDGE they share!!!
Sign in to Reply