This is part 2 of the blog series “IoT Constrained Node Networks”. Please read part 1 of this blog series "Introduction to IoT Constrained Node Networks" to understand more about IoT constrained node networks.
Constrained node networks face many challenges like mobility, reliability, scalability, management, availability, interoperability, and cybersecurity. Cybersecurity is one of the major concerns and of all the aspects of cybersecurity, securing data is crucial as it determines both confidentiality and integrity in the CIA (Confidentiality, Integrity, and Availability) triad. However, it is not possible to follow conventional data security methods for constrained node networks because of resource constraints. The objective of this blog is to present the guidelines needed to secure the data in constrained node networks in an IoT system.
“Conventional data security methods could not be followed for constrained node networks because of resource constraints.”
Cybersecurity Standards and its Problems
There are various standards available for implementing mechanisms to secure data. It is always good to follow these standards rather than to proceed with our own custom solution.
“It requires huge effort to understand the standards and select an appropriate one.”
The list below covers a majority of the security standards applicable for embedded software development and its standard definitions:
- Institute of Electrical and Electronic Engineers (IEEE) - PHY and data link layer standards
- Internet Engineering Task Force (IETF) - Networking protocols from layer 3 and above
- International Standard Organization (ISO) - Defines standards for many domains
- International Electrotechnical Commission (IEC) - Electrical and electronic products
- ISO/IEC 27000 family of standards - Jointly defined by ISO and IEC for defining information security management system (ISMS) standard
- International Society of Automation (ISA) - Defines standards for automation
- ISA Security Compliance Institute (ISCI) or isasecure - A part of ISA group defines standards for industrial automation control systems. Provides below certifications in alignment with IEC-62443:
- EDSA - Embedded Device Security Assurance
- SSA - System Security Assurance
- SDLA - Security Development Lifecycle Assurance
- IEC-62443 or ISA-99 - Security of Industrial Control System (ICS) networks. This standard was produced by the International Society of Automation (ISA) and taken over by IEC for further development.
NIST Framework – A single solution to ensure security?
National Institute of Standards and Technology (NIST) is a non-regulatory agency of the United States Department of Commerce. One of the objectives of NIST is to help organizations to better understand and improve their management of cybersecurity risk, by proposing security guidelines. They have released the NIST cybersecurity framework document  which covers all the cybersecurity areas in the form of security functions, categories, sub-categories, and the standards associated with them.
Figure 1 – NIST Cybersecurity Framework Overview Source - http://blog.cipher.com/a-quick-nist-cybersecurity-framework-summary
The NIST cybersecurity framework defines 5 major functions as listed below:
- Identify – Identify what needs to be protected, such as systems, assets, data and capabilities.
- Protect - Implement appropriate safeguards to ensure the delivery of critical infrastructure services.
- Detect - Implement appropriate activities to identify the occurrence of a security event.
- Respond - Implement the appropriate activities when facing a detected security event.
- Recover - Implement the appropriate activities to restore the affected services.
Organizations need to go through all the sub-categories and references of the NIST framework, and develop the security requirements against their business goals. The output generated will be a set of security requirements which is called a profile.
How to use the NIST cybersecurity framework for data security during IoT product development?
NIST has created a cybersecurity framework for IoT systems and released a guidelines document  which mandates the device capabilities like networking protocols and cryptographic support to achieve data security.
The usual phases of IoT product development, using the NIST security framework, where the roles of cryptography and networking protocols are involved, are shown in Figure 2.
Figure 2 – Process Flow to ensure needed device capabilities
Cryptographic algorithms need significant processing capability, otherwise it affects performance. The cryptographic operations should be offloaded to hardware accelerators to improve the performance. The selected processor shall have this hardware acceleration support.
The firmware that runs in the constrained nodes shall support running cryptographic algorithms and utilize the hardware acceleration for cryptography. Networking protocols which are specifically designed to support constrained nodes shall be supported.
During application development, to ensure data security, choose a relevant cipher suite and its library implementation.
A cipher suite is a set of various kind of algorithms that help secure a network connection. There are several cipher suites that contain different combinations of algorithms. The kind of algorithms that cipher suites usually include are listed below:
- Key Agreement - Securely exchanges keys between devices. Ex: RSA, Diffie-Hellman
- Encryption - Encrypts the data transfer. Ex: AES, DES, RC4,
- Message Authentication - Provides data integrity checks. Ex: SHA, HMAC
- Signatures - Authenticates the client or server. Ex: DSA, ECDSA
To know more about various cipher suites and libraries, refer , , , . Selection of the relevant cipher suite ensures confidentiality and integrity of the data transfer.
Mostly, the needed cipher suites are present as a part of the selected firmware. After the cipher suite is selected, the next step is to extract the requirements and the best practices related to data security from the guidance documents listed in  and implement them.
Provisioning of Keys
Constrained nodes need pre-configured keys, so that cipher suites use these keys to secure the communication in the data-link and the transport layers. When the nodes are deployed in the production environment, these keys shall be provisioned.
In a conventional system, the focus is more on securing the transport layer as the medium is wired and the switch/router takes care of physical security of the data link layer. But in constrained node networks, the focus should be more on the data link layer as the medium is wireless and anybody can access the wireless medium. Since the security is needed at layer 2 itself, the only way to achieve this is by using a pre-shared key (psk).
“A Pre-Shared Key needs to be used in all constrained nodes to ensure data security”
What are the IoT use-cases which require data security?
- Network Joining – IoT device joins the network
- Data Transfer – IoT device transfers data
- Command – IoT device receives commands from other devices and processes them
- Secure storage – IoT device stores device ID and other data
- Network Leaving – IoT device leaves the network
This blog presented the security approach by using NIST framework which ensures end to end security coverage. The IoT profile generated out of the NIST framework is used as a reference to ensure data security in IoT constrained node networks. The key task is to identify the security requirements from the NIST recommended guidelines. As per a wiki statement, “A 2016 US security framework adoption study reported that 70% of the surveyed organizations mentioned the NIST Cybersecurity Framework as the most popular best practice for Information Technology (IT) computer security, but many note that it requires significant investment.”
PoC: What are we doing in HCL ERS-ET1-Systems CoE-EPL CoE?
In ERS-ET1-Systems CoE-EPL CoE, we are working on IoT security PoC by considering the above guidelines. Open thread has been selected as the firmware for the reasons mentioned in part 1 of this blog series.
- Book “Network Security Essentials 4th Edition”
- Master Thesis “Leveraging Public-key-based Authentication for the Internet of Things” by Hossein Shafagh
- NIST - “Framework for Improving Critical Infrastructure Cybersecurity” version 1.1
- NIST.IR 8228 - “Considerations for Managing Internet of Things (IoT) Cybersecurity and Privacy Risks”