The IoT is made up of billions of devices that collect and share data. If this data is not properly secured, it puts both end-users and manufacturers at risk for all sorts of disastrous consequences.
For example, the data collected by a smart thermostat can reveal when someone is home based on their heating and cooling settings. If this information is not adequately protected, thieves can use it to determine when to break into houses. Similarly, if the data from a sensor monitoring a factory assembly line is not secured, it can be accessed and used by a competitor to steal inventory information. Even seemingly innocuous information can be combined from multiple devices to build detailed pictures of a person’s lifestyle or buying behavior.
Breaches can have equally devastating consequences for the companies that failed to adequately secure the devices in the first place. Security breaches, particularly high-profile ones, can cause irreversible brand damage, revenue loss, drops in stock price, and other significant negative ramifications.
According to Cisco, the billions of devices comprising the Internet of Things will generate trillions of gigabytes of data by 2018 – some 400 zettabytes a year to be more precise – and all that data needs to be safeguarded from hackers to protect consumers and manufacturers.
Effectively securing data in the IoT requires identification, authentication, and encryption, which produces integrity and confidentiality.
Identification and authentication are related – they are cryptographic functions that provide a provable identity. They are necessary to ensure information is being communicated to the correct device and that the source can be trusted. Without authentication, for example, a hacker could communicate directly with your front door and alarm system, and gain access into your home by causing the door to unlock and the alarm to disarm.
In the real world, we have trusted agencies that produce documents (e.g. a driver’s license) that can be presented to assert an identity. In the digital realm, there are cryptographic methods for performing a similar action with a digital certificate.
