IOT Safety: Preventing a possible disaster

In 2015, Ukraine experienced unexpected Power outageMost of the country became dark. The US inquiry concluded that it was running a significant infrastructure on Ukrainian computers due to a Russian state cyber attack.

In the following decade, significant infrastructure and cyber attacks on near OngoingIn 2017, A nuclear power plant There was a Russian cyber attack in Kansas. In 2021, Chinese state actors allegedly gained access to parts of the New York City Subway Computer System. Later in 2021, A Cyber ​​attack Temporarily closed beef processing plants. In 2023, Microsoft reported a cyber attack on it IT systemThere is a possibility by Chinese -backed actors.

The risk is increasing, especially when it comes to the Internet of Things (IOT) equipment. Popular craze just below the veneer of gadgets In fact Want to order their refrigerator automatically for groceries?) Is there a growing army of more prosecutors who take care of keeping our world running on. This is especially true of a sub-class called Industrial Internet of Things (IIOT), which controls our communication network, or the infrastructure such as power grids or chemical plants. IIOT devices can be small devices such as valves or sensors, but it can also include very enough pieces of gear, such as an HVAC system, an MRI machine, a dual -used aerial drone, a lift, a atomic centrifug, or a jet engine.

The number of current IOT devices is increasing rapidly. In 2019, there were one estimated 10 billion IOT devices in operation. At the end of 2024, it was almost doubled About 19 billion. This number has again exceeded double by 2030. Cyber-horses aimed at the purpose of devices, which are inspired by political or financial gains, can harm the entire communities very real physical world, which is beyond the damage to the device.

Security for IOT devices often occurs later, as they often require very little for “human interface” (ie, perhaps a chemical plant requires command to open, close and report a valve), and usually they do not have information that is seen as sensitive (ie, the thermostats require a credits, a credits do not require a credits, a medical device does not have a credited. Is). what could go wrong?

Of course, “what can go wrong” depends on the device, but especially with carefully planned, scale attacks, it has already been shown that much can be much wrong. For example, in the armies of poor-safe, internet connected security cameras already The service attacks are placed to use in coordinated distributed denial, where each camera makes some of the suffering requests of some afflicted service, causing collapse under the service load.

How to secure IOT devices

Measures to protect these devices typically fall into two categories: basic cyber security hygiene and depth defense.

Cyber ​​security hygiene has some rules: Do not use default passwords on administrator accounts, apply software updates regularly to remove newly discovered weaknesses, require a cryptographic signature to validate the update, and need to “understand your” “Software supply chain: “Where does your software come from, where suppliers receive the components that they can simply undergo open-source projects.

The rapid work of open-source software has inspired the development of the US government’s software bill of materials (SBOMIt is a document that expresses the supply chain perfection, indicating which version the package went to create the software of the product. Both IIOT device suppliers and device users benefit from accurate SBoms, shortening the path to determine whether there may be a version of the unprotected package to attack in the software of a specific device. If SBOM shows an up-to-date package version where vulnerability is addressed, both IIOT seller and user can take easy breath; If the package version listed in SBOM is weak, it may occur in therapeutic order.

Defense in depth is less famous, and more noticeable.

It is attractive to apply the easiest approach to cyber security, a “outward and crushing, soft and chewing” models “models. It emphasizes the perimeter of this theory that if they cannot be found in hackers, they cannot do harm. But even the smallest IOT devices can have a software stack that is very complex for designers to fully understand, usually obscure the weaknesses in the dark corners of the code. As soon as these weaknesses are known, the device has no protection from tight, well -managed security, because there is no other line of defense.

The depth is the defense answer. A national institute and technology Publication Breaks this approach to cyber flexibility in three basic functions: to protectMeaning Haichers use cyber security engineering to keep out; traceAdd mechanisms to detect the meaning unexpected infiltration; And remediatiAction should be taken to expel intruders to prevent the meaning of latter. We will find out each of them in return.

to protect

With most “normal behavior” of the device in an outer layer, systems designed for protection use a layered approach, while internal layers form a series of shells, each of which has small, more constrained functionality, making the internal balls progressively simple to protect the shells. These layers are often related to the sequence of stages followed during the start of the device, where the device begins in the interior layer with the smallest possible functionality, just enough to run the next step, and so on until the exterior layer is functional.

To ensure the correct operation, each layer must also check an integrity on the next layer before starting it. In each ring, the current layer calculates the signature of a fingerprint or next layer.

To create a defensive IOT device, the software needs to be layered, with each layer only if the previous layer is considered safe. Gai Fedorco, Mark Montgomery

But here is a puzzle. Each layer is checking the next one before starting it, but who investigates the first one? No one! The inner layer, whether the first checker is applied in hardware or firmware, must be really trusted to be worthy of trust for the rest of the system. For example, it is called a root of trust.

The roots of the trust should be carefully preserved, as an agreement of the root of the trust may be impossible to find out without a particular test hardware. One approach is to keep the firmware that applies the root of the trust only in reed-only memory that cannot be modified after the construction of the device. This is great if you know that there is no bug in your rot code, and uses algorithms that may not be obsolete. But some of us live in the world, therefore, at least, we should usually protect the rot code with some simple hardware that reads the firmware only after our work, but is written during its startup phase, walked during the phase, carefully walled, cryptographically signed updates allow.

The new processor takes this route of the Chips Trust one step back to the processor chip, a hardware route of the trust. This firmware makes rotting more resistant to weaknesses or hardware-based attacks, as the firmware boot code is usually stored in non-vaporous flash memory where it can be obtained again by the system manufacturer (and by hackers). A rot inside the processor can be made more difficult to hack.

trace

Being a reliable root of the trust, we can organize so that each layer is able to check the next for hack. This process can be enhanced Remote verificationWhere we collect and report fingerprints (called) Verification evidence) The startup process was collected by each layer. We cannot only ask the external application layer whether it has been hacked; Of course, any good hacker will ensure that the answer “No way! You can trust me!”, No matter.

But distance verification connects a small combination of hardware, such as Reliable platform module (TPM) is defined by reliable computing group. This bit of hardware collects evidence in the preserved places made of special-purpose, hardware-paint memory cells, which cannot be directly replaced by the processor directly. TPM also provides protected capacity, which ensures that new information can be added to preserved locations, but the information already stored cannot be changed. And, it offers a protected capacity that attachs a cryptographic signature to the content of the preserved location to work as evidence of the machine status, using only a key known to the root of the trust hardware, called a verification key (AK).

Given these tasks, the application layer has no choice but to accurately report the evidence of verification as per the use of the rot of the rot near the application layer. Any attempt to tamper with evidence will invite the signature provided by AK. At a remote location, a verification can then validate the signature and check that all fingerprints line up with known, reliable, versions of the device’s software. These known-good fingerprints, called endorsments, should come from a reliable source, such as device manufacturer.

To verify that the IOT device is safe to turn on, no one can use a verification and verification protocol provided by a reliable computing group. Gai Fedorco, Mark Montgomery

In practice, the root of the trust may have many different mechanisms to protect different tasks, such as boot integrity, verification and device identification, and device designer is always responsible for collecting specific components the most suitable components for the device, then to carefully integrate them, but to integrate them carefully, but the guidance and objectives to the objectives to the institutions like worldly computing group are made to integrate them, but objectives such as worldly computing groups. Is, such as reliable modules, can be used in TPM.

remediati

Once a discrepancy is detected, there are many types of actions to remade. A simple option is the power-cycling device or its software is refreshed. However, reliable components inside the equipment can help with treatment through the use of self -certified watchdog timers or other approaches that cause the device to reset themselves if it cannot demonstrate good health. Reliable computing group cyber flexibility Provides guidance for these techniques.

The requirements mentioned here are available here and have been used in special high-protection applications for a few years, and many attacks have been known for a decade. Over the years, the trust has been widely used at the root of implementation Some laptop familyBut recently, blocking the root of trust attacks IIOT has also been challenging and expensive for cyber experts in space. Fortunately, many silicone vendors who supply the underlying IOT hardware Now Involved in high security Mechanism Even in embedded chips with budget-minded, and reliable software stacks have developed to create mechanisms for the root of trust defense available for any designer that want to use it.

While the IIOT device designer has the responsibility of providing these cyber security mechanisms, it is dependent on the system integrators, which are responsible for the protection of an overall service interconnecting IOT devices, so that their suppliers require facilities, and to coordinate facilities inside the device with external flexibility and monitoring mechanisms, provide all more easily.

Keep your roots in mind in mind!