Mal - Things

Continuing our work on wireless IoT standards, security - related items contribute to about 70% - 80% of the total effort. It is difficult and complicated, especially when dealing with very resource - constrained devices. We very often deal with contradicting requirements. "It has to be secure" (of course). "It should cost less than $1". "It should last on batteries for ages". Etc. Meeting all the requirements is a challenge, but certainly possible, to some extent.

One interesting problem that is coming up in discussions is mal - things, or devices that are legitimately introduced in a network, but start misbehaving. In the end, nobody can be sure a lightbulb does not contain malicious code that once given access to a network, will start playing dirty tricks, such as broadcasting "all off" messages repeatedly to the whole network. It is the same problem corporate administrators have with their LANs. And the only good solution seems to be isolation.

By isolation I mean security domains within a network. If there is a light switch that communicates over the network with a lamp, it should only be able to send messages to this lamp. Not to other devices (even if it wanted). And nobody should be processing any messages coming from a lamp, unless specifically configured to do so. Such isolation can be achieved by having two layers of security. One at the network layer, to allow messages to be relayed by intermediate mesh nodes. And the second one at the application layer, to ensure a message, when is about to be executed by a receiving device, can be verified and dropped on a floor if it does not prove its legitimacy.

Today very few protocols support such isolation and even office LAN networks are still prone to very simple attacks like e.g. connecting a 2nd DHCP server that will wreck havoc stopping most users from accessing any Web service. Techniques like DHCP Snooping are barely making their inroads into enterprise LANs today. Low power wireless IoT have to be able to protect themselves from mal - things by design, from day one.