May 2016
14
I
nternet
-
of
-T
hings
Requirements for IoT and IIoT
in the changing connected world
By Oliver Winzenried,
WIBU-Systems
This article describes the requirements
and solutions to ensure safety
and cyber security. It covers
aspects including secure boot,
firmware updates, licensing and
know-how protection as well
as new business opportunities
for device manufacturers.
Manufacturers of IoT devices need to care
about three things: security, security, and
security. Consider this: security is required to
operate and use IoT devices in the way they
are intended, security is required to update
and upgrade functionality and features in IoT
devices while ensuring that they are not tam-
pered with or hacked, and security is required
to monetize features in IoT devices and imple-
ment new business models with benefits for
both device manufacturers and users. The
potential threats are increasing as more and
more systems are becoming connected with
each other making the integration of security
mechanisms a must. A look at the evolution
of devices nowadays into IoT devices reveals
the benefits.
Table 1 shows the differences. Today, embed-
ded devices are often stand-alone devices with
set functionality. Device makers make a one-
time sale of the device, and repair or mainte-
nance revenue is optional. In many cases, an
individual piece of hardware is used with no
operating system or with an easy scheduling
OS. This situation is changing: devices are
becoming connected, and are being equipped
with upgradable features, not unlike the pop-
ular app stores for smartphone applications.
Using standard hardware and software plat-
forms, development efforts can be reduced
and the time-to-market shortened, which
promises benefits for the device maker. Fur-
thermore, selling devices at an early stage
and with a basic feature set allows additional
feature sales at a later point. With these new
business models, recurring revenues can be
realized. To enable these new benefits for
users and makers, the three security chal-
lenges have to be solved.
More and more features are software-real-
ized, using the same hardware and software
platform. Increasing connectivity then needs
a secure identity. The major threats are the
following. Counterfeiting by copying software
or rebuilding it with standard hardware and
OS platforms. Reverse engineering to uncover
the actual value-adding algorithms and imple-
menting them without major development
efforts. Undermining new business models
by enabling all embedded software functions
without buying the required licenses. Manip-
ulating devices with faked firmware updates
or manipulating existing firmware or config-
uration parameters, as well as manipulating
complete systems with fake identities. The
solutions for these challenges rely on the fol-
lowing methods.
Know-how protection: valuable intellectual
property in application data and program
code is protected via encryption. For perfor-
mance reasons, symmetric encryption algo-
rithms are used, such as the well-known AES.
The required data is decrypted in the memory
at runtime, while always staying encrypted on
the disk or flash storage. A static analysis is
made impossible without access to the plain-
text data.
Product protection: creating counterfeit
products by copying data or program code
to a look-alike system will not work, as the
encrypted data and program code cannot be
decrypted on counterfeit products. Therefore
cryptographic keys need to be stored with
protection against cloning.
Flexible licensing: each software-realized
feature is assigned a unique license, using
different encryption keys. In addition to the
encryption key itself, the maker can define
how these keys and licenses and the fea-
tures can be used. The new licensing options
include pay-per-use models, time-based
licensing, rental and subscription models, and
many more. To use these licensing mecha-
nisms and transfer the licenses to a device,
license creation, administration, and deploy-
ment needs to be integrated in the vendor
business process. This can rely on a form of
appstore or user license portal with which the
user can activate or return licenses himself
and is billed accordingly.
Figure 1. CodeMeter techno-
logy allows easy integration in
products and processes.
