With the rise of the Internet of Things (IoT), the world is becoming connected in ways we could not have previously imagined.

Cisco projects that by 2020, 50 billion devices will be connected. It seems that Nikola Tesla’s prediction, given in a 1926 interview with Colliers magazine, has come true: “When wireless is perfectly applied the whole earth will be converted into a huge brain, which in fact it is, all things being particles of a real and rhythmic whole…and the instruments through which we shall be able to do this will be amazingly simple compared with our present telephone. A man will be able to carry one in his vest pocket.”

The Internet of Things is creating seemingly limitless opportunities to enhance our lives. However, with its opportunities come threats as well. The more connected the world is, the greater the need for security. Until recently, public key infrastructure (PKI) has quietly worked on the sidelines but had yet to have its moment in the spotlight. IoT is creating that moment for PKI.

Trust and control are the two facets of security that IoT is primarily concerned with. This is hard to achieve on the grand scale of IoT, but one thing is for sure: cryptography is going to play a central role in making it happen.

>See also: Next big thing: Preparing for the Internet of Things in the enterprise

Of course, crypto and PKI technologies are nothing new and have already been proven in large-scale systems, like the global payments network and for protecting data across the World Wide Web (SSL).

However, securing the IoT brings some new challenges that might force businesses to rethink traditional assumptions around key management and the impending security threats.

Decision making for infrastructure systems can now be assisted by sensors that record environmental and other readings. This will enable basic decisions, such as which control valve to turn on or off, or when to shut off someone’s electricity.

These devices must provide trustworthy information, sometimes directly to the user and sometimes to the infrastructure provider (such as the energy utility), often employing data analytics that span millions of such devices taking system-wide decisions.

Users, service providers or even regulators need to be sure that they are talking to the correct device, that the device is functioning effectively, is configured correctly, has not been tampered with, is not providing incorrect or altered information, will do what it is supposed to, and that no one can interfere along the way.

It is a significant challenge to establish trust across a broad range of disparate devices on a massive. The devices themselves are out on the front line, in hostile environments or susceptible to physical attacks, and the networks they communicate over are usually untrusted and difficult to secure.

Additionally, back-end systems and data repositories where information is aggregated, analysed and decisions taken is also an attractive targeted.

There’s certainly the threat of a homeowner cheating the electric company, that’s nothing new, but the sheer scale of IoT creates a new set of threats.

Under the control of malicious insiders or hacktivists, thieves or terrorists, the IoT could quickly become the Internet of Listeners or the Army of Things.

Assurance, scale and technology

For IoT to succeed, secure communications, mutual authentication and high-integrity messaging — all at an Internet scale — will be absolutely necessary.

Having secured network-connected devices for decades, digital certificates issued by a PKI are well situated to serve as the online identity for those things.

PKI has performed well for years in trusted environments where hundreds of millions of device certificates have been deployed for ATMs, cellular base stations and smart phones.

While the things in the IoT have much in common with such devices, they do raise some new issues around assurance, scale and technology.

>See also: 4 things that will happen in the Internet of Things space

To start with, there’s a distinction between public PKI applications and private or closed PKI applications when it comes to assurance and validation.

Common PKI applications, such as email security and even SSL, often require a level of public trust – the ability for anyone to validate the assurance claims made by the PKI based credentials, such as certificates.

This requires the ability to equip all potential receivers to test the claims of all potential senders and, even harder, to revoke the ability to make claims if trust is lost.

In many ways, the situation in IoT is easier because many IoT deployments don’t need public trust – they are closed systems.

For instance, if a certificate in a vehicle is used only to communicate telemetry data back to the manufacturer, no other third party needs to rely on that certificate or the PKI that issued it.

Furthermore, revocation checking and online validation may no longer be required since the organisation in control will already know the status of its own devices in the network and won’t need to rely on checking the status of credentials of the device itself.

Scale provides the next hurdle. Billions more devices will be connected soon, if IoT predictions prove correct.

Although PKI deployments certainly exist that have the ability to manage millions of certificates, most operate at levels significantly smaller.

The magnitude of many IoT deployments will make systems with tens or even hundreds of millions of credentials commonplace.

The good news is that many of these devices’ deployments will be relatively static, credentials will have relatively long lifecycles and changes might be rare – but in very large systems, even a relatively small change can be an operational nightmare.

Finally, technology presents a challenge. Unlike traditional PKIs and connected devices (ATMs, servers, even smartphones), the IoT will be populated by extremely low-power and low-budget devices – saving microwatts of power or cents to bill will be important.

Traditional cryptography is not designed for these environments. Cryptography is mathematically intensive, and that requires CPU power.

Another related problem is credential generation. Making good keys (just special random numbers) is not easy and making them in high volumes, for example on a production line, can quickly become a bottleneck.

Again, the good news is that crypto algorithms designed for low-power devices and rapid key generation already exist and have been widely proven. Generally falling into the category of elliptic curve cryptography (ECC), this technology is rapidly growing in terms of availability.

The human ingenuity that made the Internet of Things possible has hurtled onward to create more and more applications for its use. All of these opportunities require security.

>See also: Securing the Internet of Things: is the web already breaking up?

It’s important, then, to rethink traditional assumptions about key management. We are living in a transitional phase in which changes need to be made quickly in order to address the threats that are being innovated right along with the IoT.

All those new certificates that the onslaught of connected devices will require must be taken into account as well.

PKI has been quietly providing security for the last two decades; expanding its use as a trust anchor makes perfect sense for the IoT. PKI has an impressive track record of solving high-assurance problems and looks to be the answer for managing the IoT’s digital certificates.

Sourced from Richard Moulds, Thales e-Security