The Basics of IoT Embedded Device Security

RE: The Basics of IoT Embedded Device Security

DAB — Mon, 30 May 2016 19:02:32 GMT

Nice overview of the issues around IOT security.

I look at it as an issue where you feel that the raw data is important enough to protect and making your analysis software robust enough to identify when a sensor has been compromised.

You also have the issue of cost to effect. Hackers will go after the big payoff devices, but will probably ignore the run of the mill implementation.

It's an issue of what do you get for your effort. So you can cause a house to over heat, so what, it annoys people, but what did it get YOU?

So I understand the encryption angle for sensitive applications, but there will be a lot of IOT that is just not worth hacking.

DAB

RE: The Basics of IoT Embedded Device Security

e14 Contributor — Mon, 30 May 2016 18:24:31 GMT

Agree with [mention:9096439d3a464e28836f5e90621862d3:e9ed411860ed4f2ba0265705b8793d05] that we typically use the public/private key pair for periodic key exchange of a symmetric working key set; the payload data is subsequently protected with the working key. Using a public/private key for an extensive conversation between two end points is too slow and resource-hungry.

Regarding #11, B) Encrypted messages:

"Cons: Enabling encryption reduces payload size"

This is not necessarily true. Assuming that a symmetric key-set was used for encryption, it might cause an increased message size to hold the encrypted payload compared to a clear-text equivalent. Perhaps this just needs a bit more explanation.

"Cons: Takes time to decrypt the message before it can be used"

It takes time and resources on both sides (transmitter and receiver) to process data cryptographically.

RE: The Basics of IoT Embedded Device Security

clem57 — Sun, 29 May 2016 23:10:47 GMT

Just a point here: usually a string is encoded with a symmetric key which in turn is encrypted with a public-private key asymmetrically which would be a hybrid system.

Clem