We believe that we are on the verge of the Internet of Things - PowerPoint PPT Presentation

We believe that we are on the verge of the Internet of Things explosion. Now is the time to make sure that IoT incorporates everything we’ve learned about digital security and infrastructure resiliency over the last 20 years of the Internet. 1

SECURITY BEGINS WITH IDENTITY

IDENTITY User name and password

IDENTITY Smartcard

IDENTITY Biometrics

IDENTITY Certificate

IDENTITY AE5021 B3209A API KEY FEA409

IDENTITY TRUST

IDENTITY APPLYING THESE MECHANISMS TO IOT AND M2M

IDENTITY PROGRAMMATIC PHYSICAL AE5021 B3209A FEA409

CERTIFICATES PUBLIC KEY INFRASTRUCTURE (PKI) l Trusted and well established technology l Allows for mutual authentication l Can be used for message signing

CERTIFICATES

CERTIFICATES $$$$$ $$$$$ COST $$$$$

CERTIFICATES SECURITY

CERTIFICATES CERTIFICATE AUTHORITY SECURITY - Revocation Certificate Online Revocation Certificate List Status Protocol

CERTIFICATES CERTIFICATE AUTHORITY SECURITY - TRUST

CERTIFICATES CERTIFICATE AUTHORITIES SECURITY - TRUST

CERTIFICATES CERTIFICATE AUTHORITIES SECURITY - TRUST Certificate Authority A device123.example.com Certificate Authority B device123.example.com

CERTIFICATES MANAGEMENT

CERTIFICATES INTEROPERABILITY FOO.COM BAR.COM CERTIFICATE CERTIFICATE AUTHORITY AUTHORITY

CHALLENGES How do we deploy PKI at Internet of Things scale. l Keep cost low l Be interoperable l Deploy at scale l Improve security

DNS-BASED AUTHENTICATION OF NAMED ENTITIES

DNSSEC Provides a secure global registry l Highly scalable

DNSSEC Provides a secure global registry l Highly scalable l Globally distributed

DNSSEC Provides a secure global registry l Highly scalable l Globally distributed l Resilient

DNSSEC Provides a secure global registry l Highly scalable l Globally distributed l Resilient l Standards based

DNSSEC Provides a secure global registry l Highly scalable l Globally distributed l Resilient l Standards based l Ubiquitous

DNSSEC Provides a secure global registry l Highly scalable l Globally distributed l Resilient l Standards based l Ubiquitous l Secure

DNSSEC . root key Provides a secure global registry .com key l Secure .example.com key l Cryptographically signed l Supports delegation zone.example.com … .... … .... … ....

DANE RFC 6698 - establishes new record types for DNS Allows publishing of certificate data in DNS Data integrity validated by cryptographic signature zone.example.com … .... … .... … ....

DANE RFC 6698 - establishes new record types for DNS l Effectively replaces local CA store as means of validating certificates l Allows records to be queried in real time l Allows records to be cached for specific amount of time l Removes the need for CRLs and OCSP l Can work with CA issued certificates or self signed certificates

DNS Registry Device provisioning device1.example.com device2.example.com Device creates public/private keypair device3.example.com device4.example.com Public key is published in DNS device5.example.com … .... deviceX.example.com Sensor Keys

DNS Registry device1.example.com device2.example.com device3.example.com device4.example.com device5.example.com … .... deviceX.example.com Sensor DNS “TLSA” record maps device name to public key Device only needs name does not need published IP address Keys

DNS Registry device1.example.com device2.example.com device3.example.com device4.example.com device5.example.com … .... deviceX.example.com Sensor IoT Platform Sensor initiates TLS connection to IoT Platform Keys

DNS Registry device1.example.com device2.example.com device3.example.com device4.example.com device5.example.com … .... deviceX.example.com Sensor IoT Platform TLS handshake includes device name and public key Keys

DNS Registry device1.example.com device2.example.com device3.example.com device4.example.com device5.example.com … .... Recursive DNS Server deviceX.example.com IoT Platform queries secure DNS for public key for device Sensor IoT Platform Keys

DNS Registry device1.example.com device2.example.com device3.example.com device4.example.com device5.example.com … .... Recursive DNS Server deviceX.example.com IoT Platform retrieves public key from secure DNS Server Sensor IoT Platform Keys

DNS Registry IoT Platform compares device's published key with the key used during negotiation device1.example.com device2.example.com device3.example.com device4.example.com = ? device5.example.com … .... deviceX.example.com Sensor Keys

DNS Registry The keys match so the client certificate is validated device1.example.com device2.example.com device3.example.com device4.example.com device5.example.com … .... deviceX.example.com Sensor Keys

DANE Advantages of DANE l Highly scalable l Economically viable l Highly secure l Limited scope of trust l Instant revocation l Transparency

WHAT NOW ? COMMUNITY ENGAGEMENT Working with the community on DANE enablement across the stack including crypto libraries and common runtime frameworks. FEEDBACK We'd love to talk! email us at iot@verisign.com 50

We believe that we are on the verge of the Internet of Things - PowerPoint PPT Presentation

We believe that we are on the verge of the Internet of Things explosion. Now is the time to make sure that IoT incorporates everything weve learned about digital security and infrastructure resiliency over the last 20 years of the Internet.

Grass Verge Damage Maintenance Responsibility Highway Verge HCC as Highways Authority Amenity

On the Verge: The Transformation of Long-Term Services and Supports 1 Research Methodology

Special Parish Liaison meeting Highways verge maintenance John Richardson Head of Community

We are on the verge of the greatest expansion of human culture and economy that has ever been

UPPI LEU Walk: Implementation Strategy on the Verge of a Supply Chain Converted to non-HEU

Beyond the Higgs Boson Particle Physics at the Verge of More Discoveries? Matthias Neubert

Distributed Resources By Bryce Yonker on the Verge For CEDMC Nov 2020 Mission: Promote and

On the Verge of a Biologics Golden Age David Meininger Executive Director, Molecular Discovery

No Yes Do you use the Internet to do homework? Do you use the Internet to follow your

Banks on the verge of a crisis: phase transitions and hysteresis in banking systems Tomaso Aste 1

MENA Information Security Conference 2017 On the Verge : Combating Cyber Threats leveraging Threat

Verge of Retirement Firings Do Not Nullify Section 1114 Protections July/August 2005 Mark G.

Respecting Privacy with Look alike data sets Tim Garnsey - Director - Verge Labs

Creating Web Farms with Linux (Linux High Availability and Scalability) Horms (Simon Horman)

Creating Web Farms with Linux (Linux High Availability and Scalability) Horms (Simon Horman)

Communication security over the Internet The big picture Me Internet Resource Internet

How do you Improve on the Internet? The eXpressive Internet Architecture: The Internet has been

IOC: Internet of Composites IOC: Internet of Composites IOC: Internet of Composites IOC: Internet

Enabling the Internet of Everything with 3G The Internet of Everything The Next Era of

Good morning! Internet, Web, Intranets, and Extranets Use and Functioning of the Internet

Internet Atlas: A Geographical Database of the Physical Internet Active Internet Measurement

History of the Internet Pat Morin COMP 2405 Outline Origins of the Internet Internet

BUDGET JUNE 2010 WEBINAR Goodman Jones LLP Graeme Blair, Tax Partner 020 7874 8835

Internet routing is based on routing protocols that collect the input data No off-line route