World Class Standards Security challenges in an Internet of Things RFID and beyond, RFID03_07 Scott CADZOW C3L © C3L All rights reserved Workshop – RFID Networks Start

World Class Standards 2 Concepts and content Security Internets Internets of Things Conclusions

World Class Standards Security Very poor word It doesnt have a specific meaning Collection of attributes or functions leading to well-being CIA … Confidentiality Integrity Authenticity Availability Access Reliability Repeatability … 3

World Class Standards Internets and IP Historically joining heterogeneous networks DECnet to SNA and similar Abstraction of a network with 2 abstracted transport services Developed towards ubiquitous network technology Internet becomes the network IP allows great abstraction of link capability 4

World Class Standards Internets of things Devices versus hosts Hosts are addressed In RFID the readers are hosts (if networked) Devices are named In RFID the tags are devices Hosts need to be reachable (Semi-)Permanent address Routing capabilities deep in the network (DNS, BGP) 5

World Class Standards The security challenge Devices are not reachable Most of the time a device is not connected Devices can be lost and stolen Makes security difficult when the device is not connected Devices are not crypto-engines Strong security difficult without processing power Devices have finite life Credentials need to be tied to lifetime Devices are transportable Will cross borders Devices need to be recognised by many readers What data is released to what reader? 6

World Class Standards Security work in an Internet of Things Assurance Risk analysis Device analysis Crypto capability and export analysis RFID tags will not do crypto for some years Security objective Privacy protection Identity protection Traffic analysis protection Identity and identifier management Separation of identity and identifier (see TR ) 7

World Class Standards Relationships TISPAN Developer of the Design for assurance paradigm EG TR TS TS MTS Developer of the Making better standards approach OCG-SEC General guidance SAGE Guidance on cryptographic capability SCP Smartcard and tag development 8