Reinventing the Internet of Things: A Thought Experiment

Hi Mark!

As you say, not necessarily always life-sustaining but Internet is essential 'plumbing' (like water and electricity) for business (and I believe teaching). Today, most businesses have critical applications without which their stores/branches absolutely have to shut down. Some things they can do locally but the remainder require a network connection of some sort, and it can include the Internet or bits of the infrastructure that is shared with Internet access (like copper and DSL or mobile phone network). They take steps to have backup connections like the data plan you mention.

I just don't think there is any decent level of investment in teaching any more. When I was at school I was given a total of half a dozen books or so for nine subjects total, to last me two years. But I also had access to a library and teachers who were fantastic in these subjects, and parents who provided books too. It was always implicit that some teaching would come from parents. Some kids had private tuition.

Times have changed, there are fewer libraries and the divide between the amount of knowledge obtainable online (even if that means connecting to the school's private network through the Internet) and the practical access offline with reduced libraries is huge. Amazon is great, but it is an expense. I've known single parent families to struggle so much that they worry about if they have any food for the day let alone consider a book. Sad, but it still happens in the UK. Documentaries on TV shows people on welfare with televisions but they are concerned with finding the most controversy to keep viewers watching and ratings high. There will always be a few that abuse the system. There are particular production companies who exclusively deal in such programs because it is easy money for them. Irritating, and many people fall for it.

To be honest it will get there, to a point where it will become essential infrastructure, one way being similar to phones, where usually an outage is considered so severe, that the telephone company has to report to their government if communications are cut off for more than a certain amount of time per year (I think 6 minutes for the UK). Today it certainly does degrade more quickly than phone lines used for voice, but the telephone company networks are now internally not entirely dissimilar to the hardware that the public Internet is composed of (telephone networks are far more redundant of course!), and some bits like copper lines to homes still remain unchanged except the equipment at the ends. The Internet is definitely not a replacement for phones nor even a $1 transistor radio for emergencies today, but we still see elements of its emergency usefulness especially when live images/videos from disaster situations are available. There are slow frame rate long range methods by radio, but the Internet has made it far more accessible to get such emergency footage out, get bodies to respond and save lives.

Methods will hopefully be found to scale to billions of devices. Already there are storing mechanisms, perhaps in the future inspection mechanisms to better prioritise traffic in emergency situations, and there are companies that already have servers worldwide to allow people to think they are downloading or streaming content from (say) a news website but in reality for a better response it is coming from a nearby location (e.g. Akamai is one vendor). But as you saw first-hand for real, this really isn't there today for many emergency situations, so lots of work still to do : (

Guess what, it is not like internet is air!

Some things they can do locally but the remainder require a network connection of some sort

We have quite a few data circuits between various parts of the country, but we've always had these in one form or another.

The methods and costs have changed but essentially they are fixed links.

It's not these that I consider 'non essential' it's the open WiFi so we can search for the nearest fast food outlet, etc.

We have similar issues with familes here in NZ, with some schools insisting that the pupils have to have the latest itoy as part of their 'stationery'.!!!!

My attitude is that if it's required for learning, then the school should provide it, just as they do with blackboards/whiteboards, chairs and desks and a classroom.

Mark

Certainly I don't mean to suggest it's as essential as water and power, no -- and you're right that it's something we should try not to let ourselves become too reliant on.

But right or wrong, I think it's also becoming a place where people work and earn a living, which elevates it from a luxury and closer to being a household necessity. Not for everyone, but for many, and more every day.

I tend to think of it like the road networks. Built for a different purpose, but now an integral part of people's existence and subsistence whether they like it or not. And also, as you say, it's crumbling under a weight of traffic it was never designed to carry!

There's a good (though slightly old) TED talk that this conversation reminds me of: https://www.ted.com/talks/jeff_bezos_on_the_next_web_innovation

Wasn't the idea of IoT about different things talking to each other? E.g. your car telling your microwave to warm up the food 'cause you 'll arive shortly? Or your dryer talking to the power company to find out which time electricity is cheap enough for the budget you set?

Hi! Yes, there is a requirement for M2M, P2M and P2P communications supported using IoT (machine-to-machine, people-to-machine, people-to-people).

Yes, the idea of the IoT is things talking to other things (or computers or people and so on). Without going off on a tangent about the silliness and impracticality of many of the examples people spew out about the IoT, in general the things that need to talk to each other fit within application groups. Your home automation system wouldn't talk to the traffic signal on the corner which wouldn't talk with the ATM at the convenience store, each of those would be an application group that would talk with other things within its group.

Even within application groups not everything needs to talk to everything, Your dryer doesn't need to talk with your home theater system which doesn't need to talk to your microwave oven which doesn't need to talk to your security cameras. It wouldn't even make sense for all of them to be on the same network. A security camera would need a high-bandwidth, low-latency network connection 24x7 to provide useful imagery while a window sensor or microwave oven would only very occasionally have short messages to exchange with something else and the network latency would be almost irrelevant. For performance and cost reasons, a window sensor would want some type of low-power mesh network, the microwave could use power-line networking and the security camera would want WiFi or even a wired Ethernet. This also touches on data generation and storage. To really be useful the security camera data would need to be stored for days, easily chewing up gigabytes of disk space (hopefully locally and not in the "cloud"). Most other things in a home network would generate very little data and most of it would be acted upon immediately so there would be little reason to store any of it.

Since security is important I'd start reinventing there. But first let us analyse where existing solutions failed. AES is secure and solutions in hard- and software exist. BLE for instance encrypts communication using AES. But it is insecure nevertheless. Why? For encryption both sides need to know the same secret key. Trivial knowledge. But how does the key get there? It would be straight forward to require the user to enter it on both sides. But average users can not be bothered to enter 128 bit keys even on a keyboard and a big screen. Therefore other methods were invented. All of them failed. The security of punching the key into the device completely relies on an adversary being unable to watch and observe the key. By this out of band transfer an adversary needs to literally "look over your shoulder" to get the key. Much easier to the user are in band key transfers like those invented for Bluetooth (pairing) or WiFi (WPS) but without asymmetric cryptography it is impossible to produce a secret key which cannot be observed in band. Therefore all this process failed. Added PINs do not help either, the can easily brute forceed.

In my opinion including a mandatory key exchange protocol based on asymmetric cryptography is important.

The next area which needs a makeover is privacy. The IoT business model today is: "give us all your data, we do all kind of calculation and sell the results - maybe we share some of the results with you."

I don't believe that IoT should be done in the cloud. Data should be stored and processed "on premise" close to where it is needed. If it has to be transmitted to somebody then on equal terms and only for a specific use case.

You're totally right, security needs to be built in to solutions and many of the ones we see skip many steps. It is totally feasible today to have the same authentication mechanisms that are used for (say) e-commerce and secure websites, i.e. PKI based. But adopting such things could mean adding another IC to the BoM, and some

software effort. So it is dispensed with on the cheap solutions we see.

But, even some small low-power consumer products do this already today. Not directly IoT related, but Apple products use a certificate mechanism to authenticate things plugged into iPhones. The official Apple cables contain a tiny chip inside the connector body to do this. It is possible to probe this, and see the exchange.

It means that official iPhone cables can offer more features than non-official iPhone cables, e.g. video output or whatever.

Provided devices ship with a unique entity (e.g. a unique identifier or a signed cert) and a mechanism exists to validate that it is  genuine (e.g. certificate verification process) then after authentication you could subsequently negotiate new keys and then use AES or any other cipher (i.e. just like HTTPS) would work and fill the product with its actual desired configuration securely.

This is just one aspect however, there are plenty of other issues to resolve with resource constrained devices and radio communications (as mcb1 rightly mentioned a while back, sometimes even the presence of encrypted data can signify an event if someone is listening to it, although there are techniques that (say) make RF data transmissions look buried in the noise) so many other things also need to be considered. It needs more discipline from product and solution vendors. Some solutions do have this discipline in certain industries, we just don't hear about it because IoT means 'fridge alerting when it is empty' according to a lot of people.

Also, it is right to only invest more in securing data that is sensitive. Not all data needs to be secured to the same level. The difficulty is determining a few things such as putting a value on the data and determining who needs to be the users of the data. But such determinations need to be done when shopping for IoT solutions or for any security solutions.