Identification and Authentication of IoT Objects by Arthur Rowley
Learn everything you need about the authentication of IoT objects
IoT devices undoubtedly make our lives much easier! Hence, there isn’t a household, at least in the Western world, that doesn’t use some IoT objects! However, if you want to enjoy the benefits of smart devices maximally, you need to authenticate them! If you want to know more about IoT authentication, you came to the right place!
Someone enters their house, claps their hand, and suddenly the light turns on and the music starts playing! Seems familiar? Indeed, we are pretty sure that all of you saw this kind of scene in movies! But guess what? For quite some time, this isn’t fiction anymore!
Internet of Things allows many devices in your home to connect and send information to each other. But do you know what IoT is? The definition of IoT technology stipulates that it is a concept that involves an idea of objects that we use daily being connected to the Internet and being able to identify themselves to other devices.
You will often hear people referring to IoT as smart technology. Now, the truth is that although it exists for more than two decades, the Internet of Things is still in its infancy. We have a smart TV, smart refrigerators, devices to visit your favorite sites with guides to how to earn real money, etc. However, we still didn’t come to the point where smart driverless cars and Google assistants are the norms. That doesn’t mean that we are not going in that direction, though!
Now, to properly and safely use these devices, we need to think about authentication and identification in IoT. But what does that mean? Basically, it refers to ways in which we can securely access all connected devices. Authentication is required so we can be sure that the devices connected to IoT are what they claim to be. That said, devices need to have their IoT identities that can be authenticated when they are connecting to a server or gateway. That way, the IT administrators can track the device through its lifecycle, communicate with it, and prevent it from conducting any harmful practices. If the device starts to show strange behavior, the administrator can revoke its privileges.
Does all this sound like quantum mechanics? Don’t worry; you are not the only one being confused about it! We talked with IoT experts to get simpler explanations of IoT security, and now we share them with you.
How Does IoT System Work?
In recent years there have been so many talks about IoT, so most of you probably know how it functions. However, we will assume that some of you still aren’t fully informed about this, so we are going to go through the basics before we start talking about IoT authorization. When talking about it, we have the image of devices connected to the Internet and each other. For example, when we asked, many people told us that the Internet of Things means that you can remotely turn on the heating in your house. While that is true, it is essential to say that IoT doesn’t imply only that. The IoT sensors enable these devices to collect a large amount of data. You know that the smart fridge can inform you about the food that is going out of date, right? However, it can do much more! It can provide you with information on temperature, power consumption, average time the door spent open, etc. Apart from that, IoT devices can lighten the workload because of automation. Besides the time, Implementation of IoT can save you unnecessary costs. For example, if the lights turn off when you leave the room, the electricity bill will be significantly lower. All of these things are possible because of the four different stages that reflect how the data travels from the device to the final analysis.
- Actuator or sensor. In this case, the sensor is there to detect and monitor the temperature of the water for example. When the desired temperature is reached then the actuator will close the valve.
- Internet Gateways. Basically, what happens is that the collected analogue data is converted to digital. After that, it is streamed through the IoT protocols of your choice. That can be Wi-Fi, W – LAN, or the Internet.
- Edge IT performs additional analysis before sending the data to the center. The purpose of this is to reduce the traffic of the data that goes to the center.
- The data center or Cloud. Generally, it is possible to conduct a detailed analysis of the data that arrived at the center.
The implementation of these stages depends on the number of devices and sensors, the amount of data, and the way it is processed.
What Is IoT Authentication
Devices can secure the data and limit its usage only to those that have correct permissions. It is not a new idea, though, and it is already used across many industries. Now you may wonder why all the devices weren’t subjected to the same security principles!
Well, the reality is that there are many devices in IoT networks. That said, it is reasonable to expect that the IoT security is going to vary. For example, they use different ways to connect. Some are Wireless IoT, others use Bluetooth, GPS, 4G, etc. Generally, we connect them easily, by putting a code or using some kind of authentication. As we mentioned earlier, it is a way to build trust in the identity of the IoT project and device. The purpose of it is of course to protect the data and control IoT access when the information travels through the Internet.
Authentication and Identification in IoT are important because that way we protect our devices from commands by unauthorized users. We can also protect our personal data from different cyberattackers. We can achieve this in several ways:
- One-way authentication. If two parties want to establish communication, only one of them will provide the authentication.
- Two-way authentication. Again we have two parties, but this time they will both authenticate themselves to each other.
- Three-way authentication. In this situation, two parties want to connect. However, there is a central authority, too, which authenticates both parties and enables them to authenticate to each other.
- Distributed authentication is happening through a distributed straight authentication method.
- Centralized. In this case, there is a central server that manages and distributes authentication certificates.
Regardless of the IoT management method, it is essential to remember that security is the goal. Maybe you will decide that two-way authentication is sufficient. In some other cases, you may want a central server to ensure authentication. Whichever you choose, you must remember that there is a variety of protocols. The authentication methods need to consider these variations.
Authorization
As you realized, IoT architecture is not a single technology. Instead, it is a connected environment that consists of various machines. And the best part is that all of them work perfectly without human interference. The purpose of the authorization is to establish the identity of each endpoint in the system. After the enrollment entry, a certificate is configured to prove the system’s identity when registering.
Identity Management
Now we are going to talk about device identity management. Its purpose is to build and manage the identity of the machine that interacts with other machines, gateways, clouds, etc. Identity management often includes authentication and authorization processes of the devices. Some of those devices can be security cameras, medical devices, industrial control systems, smart speakers, TVs, home security systems, etc.
Each device needs a specific digital identity that can be checked when connecting to the central server or a gateway. The point is to prevent and eliminate any risk of malicious attacks. Hence, each device should have a specific encrypted key.
How to Choose the Right Authentication Model
IoT devices undeniably make our lives easier. But as we mentioned, they are connected to the Internet, which is not perfectly secure. That means that hackers can try to get access to your machines. Now you may think, “But I am not important, why would a hacker pick me as a target?” It is essential to remember that hackers have their reasons to attack anyone, regardless of whom this person is! And of course, they are not interested in devices per se! They are interested in gaining access to more personal information like bank card numbers, etc. The Symantec threat reports show that the number of IoT attacks rose from 6000 in 2016 to 50000 in 2017. However, if the device has authorization to only communicate with an authenticated server, you will not have any problems. However, choosing the IoT scale authentication model can be quite a challenge. That is why we are going to list some of them to give you ideas on what is out there.
Hardware Security Module
It is the best and safest form of secret storage. It is hardware-based secret storage where you can put both X. 509 certificate and SAS token. It can be used in two-way authentication if it is supported by a third party. Device secrets can also be stored in the memory software. However, it is a less safe option.
X.509 Certificate
This certificate is based on a model called chain of trust. It, same as other digital certificates, is in a chain of certificates. Each of them is signed by the private key infrastructure of another trusted certificate. The chain returns to a globally trusted root certificate. It is by far the most secure type of digital identity authentication. But managing it can be challenging.
Trusted Platform Module
The good thing about a trusted platform module (TPM) is that it can keep the key in hardware that cannot be tampered with. These keys are created with the module and therefore can’t be accessed externally. The only way to roll those keys is by destroying the identity of an IoT chip and giving it a new one.
Symmetric Key
It is a simple authentication process, executed through Provisioning Service instance. It is less secure though than X. 509 certificate and TPM, but it is still good for personal use. If you are using IoT devices at work it is better to opt for more secure options. The attestation is made with security tokens called SAS – Shared Access Signature. IoT hubs use the same tokens for device identification. When the device signs in with this certificate, it uses the symmetric key to create a hashed signature for the token. Since the key is shared between the device and the cloud, it needs to be double protected.
Bottom Line
Keep in mind that these methods are necessary and beneficial for the security of objects and your personal information. However, as you could see, there are several methods, and choosing the most adequate can be pretty challenging. Some risks can be reduced only by using symmetric keys. However, while this may work for IoT devices that you have at home, it is unlikely it will be enough for a company. Do you use some authentication methods already? Which ones? Why did you opt for them?
About the Author:
Arthur Rowley is an avid writer specializing mostly in technology and marketing. Having spent years finessing his craft, he can now assure you that he has much acclaim for these areas and is dedicated to providing high-quality blogging content.
