Security, confidentiality and privacy in iot

1. www.nr.no
Security & Privacy in the IoT: threats
and challenges
Mohamed Hamdi
Elgazala technopark, Tunisia
April 28th, 2017

2. Once upon a time, …, in the beginning

3. And now !

4. Evolution of the Internet
4
email WWW phone...
SMTP HTTP RTP...
TCP UDP…
IP
ethernet PPP…
CSMA async sonet...
copper fiber radio...
email WWW phone...
SMTP HTTP RTP...
TCP UDP…
IP, IPSec, NAT, IGP,
Mobile IP, …
ethernet PPP…
CSMA async sonet...
copper fiber radio...
The 7-layer model
is no longer
applicable
Internet evolution

5. IoT reference model
5

6. If the Internet was a country …
► The only countries in the world with a bigger GDP than the
United Internet would be the U.S., China, Japan and India
(Boston Consulting, 2016)
► What if the metaphor is extended to GNP and NNP
▪ Gross National Product
▪ Net National Product
6
Geographic boundary
Citizenship

7. Challenges
7
► Scaling
▪ Can/how do the SWE standards work in an IoT environment on a large scale –
billions/trillions or more sensors/“things”?
► Discovery
▪ How do I find sensor services? How do I make my sensors discoverable? Is there a
central catalog or set of catalogs or a search engine for the sensor web where I go to
find services, or is there some peer-to-peer mechanism where sensors/services notify
me of their availability?
► Performance
▪ Moving towards event-driven, publish/subscribe, CEP mechanisms to optimize the flow
of information  information can be stored as needed, filtered and sent to the
appropriate recipients/applications
► Standards Harmonization
▪ Multiple sensor and IoT standards need to be harmonized in order to realize
interoperability across sensor systems
► Big Data
▪ Sensors and the IoT add to the growing amount of monitoring data that is available to a
wide range of users. How do we effectively analyze all of this data and ensure that
meaningful and relevant data and decisions are made?

8. Security challenges
8
NEW ATTACK
STRATEGIES ARE
RENDRED POSSIBLE
BY THE EVOLUTION
OF TECHNOLOGY
CLOUD
COMPUTINGNew deployment models
Virtualization
Risk sharing
BIG DATA
Complexity of cryptographic
routines
Multiple processing needs (e.g.,
search, aggregation)
Dramatic increase in size
IoT
No IP addresses
Limited CPU, memory, and
storage resources
Dynamic time-space behavior
SOCIAL NETWORKS
New types of communities
New types of threats

9. Data lifecycle
9

10. Questions…
► Storage
► Retention
► Destruction
► Auditing, monitoring and risk management
► Privacy Breaches
► Who is responsible for protecting privacy?
10

11. Madrid resolution (2009)
► Approved by data protection authorities of 50 countries
► Framework for international standards on privacy and data
protection
► Defines a set of principles and rights
▪ for protecting privacy with regards to processing of personal data
and
▪ Facilitate international flow of personal data
► Encourages countries to implement proactive measures to
promote better compliance with data protection laws and
adapt information systems for processing of personal data
11

12. Privacy by design1
► EU review of Data Protection Directive in 2011
▪ Principle of privacy by design
▪ Implement privacy enhancing technologies (PETs)
▪ Privacy by default settings
▪ EU rules must apply if personal data is handled abroad by
companies active in EU market
► Privacy by design binding for
▪ Data controllers
▪ Developers
▪ Business partners
► Need for standardized privacy protection measures
12

13. Privacy by design2
► 7 principles
▪ Data minimization
▪ Controllability
▪ Transparency
▪ User friendly systems
▪ Data confidentiality
▪ Data quality
▪ Use limitation
13

14. Open Problems
► Privacy/Lawful interception
► Anonymity/Forensics
► Pseudonyms/Privacy
► Federated identities/anonymity/privacy
14

15. Privacy/lawful interception
15
LEA
3 GMS node
Administration
Function
IRI
CC
Delivery
Function
3GMS
IRI
CC
LEA
NETWORK RELATED
DATA
TECHNICAL INTERCEPTION
HANDOVER INTERFACE
INTERCEPT
REQUEST
INTERCEPT
REQUEST
MOBILE TARGET

16. Anonymity/authentication
16

17. Federated
identities/anonymity/privacy
17

18. Thank you
18