Securing the Internet of Things: ‘Side channel attacks’ expose sensitive data collected by IoT devices
German startup introduces technology that facilitates wider use of encryption as IoT expands
By Byron Acohido, ThirdCertainty
Core insight: IoT devices collect data and connect to the Internet. In doing so, they emit signals known as “side channels.” These signals show levels of power consumption at any given moment, as well as electromagnetic and acoustic emissions. An attacker can overcome the encryption protecting an IoT device by executing what’s known as a “side channel attack.”
In a side channel attack, the intruder eavesdrops on the device’s side channel emissions and takes note when an encryption key is used to access the device. This tiny amount of information can then be used to, in effect, duplicate the key.
Emerging exposure: Compared to attacking the mathematical properties of encryption, side-channel attacks require much less time and trouble to correctly guess a secret key. They require inexpensive equipment, can take just minutes to execute successfully and are very difficult to detect.
Wider implications: As IoT expands, a myriad of cheap, low-power devices will record data and interact with humans and companies across the Internet in countless ways. As IoT devices and systems become cheaper and more ubiquitous, device manufacturers likely won’t have much incentive to invest in complex security mechanisms. Cyber criminals will take advantage using well-understood hacking techniques, such as side channel attacks.
Excerpts from ThirdCertainty’s interview with Christian Zenger, who is project manager of PhySec, a startup, based in Bochum, Germany, that is seeking to make IoT systems less susceptible to side-channel attacks.
3C: How common are side channel attacks?
Zenger: Not all attackers and affected vendors make attacks public. However, in academia, side channel attacks were responsible for some of the most spectacular attacks with dramatic real-world implications. One prominent example was the attack on the KeeLoq cipher, a remote key-less entry system used in many cars. The attacker was able to clone car keys from a distance.
Another attack broke the security of the Mifare DESFire smart cards used for cashless ticketing in public transportation systems. A third attack targeted so-called FPGA devices typically used to protect against theft of intellectual property. Research has shown these attacks can target any industry and can enable large scale car theft, ticket manipulation and even theft of intellectual property.
3C: What is your solution?
Zenger: We extract random numbers from a wireless channel shared between two parties legitimately using the IoT system, let’s call them Alice and Bob. This sequence of numbers, emitted in the side channels of the device, reflect the physical surroundings and movements of Alice and Bob at a given moment, and thus is highly unpredictable. So if a third party, let’s call her Eve, came along and tried to eavesdrop, she would have to be very close (less than 6.25 centimeters for Wi-Fi) to Alice or Bob in order to listen in.
Physics guarantees that beyond a certain distance, Eve cannot learn anything. By this principle, we have a synchronized random number generator between Alice and Bob and a guarantee that it cannot be eavesdropped if Eve is beyond a defined threshold.
3C: Where might this approach help as the Internet of Things grows?
Zenger: In a smart factory, or a smart home, a set of sensors collects data, sends it to a central gateway, which then stores the data in the cloud. The connection between the sensors and gateway is wireless. The collected data can then be retrieved by a user to visualize information on a smartphone or tablet.
A privacy-savvy company, or an individual user, might like to keep her data to herself and not share it with the cloud storage provider or the manufacturer of the sensors. This would prevent a third party from being able to intercept, or manipulate, data moving between sensors and gateways.
Ideally, data would be encrypted on the sensors, and then transmitted and stored in encrypted form and only the user of this data could decrypt it. Our technology can now help to establish this end-to-end scenario for ultra-low-power devices in a user-friendly way.
3C: How might your solution eventually be useful to individual consumers?
Zenger: The consumer is put into control over his data with a solution that is convenient to use. Traditional arguments against end-to-end encryption, like ‘it’s too costly’ or ‘it’s too energy hungry’ no longer apply. Conversely, cloud providers would not need to fear leaks as all data is encrypted.
3C: What else should our audience understand?
Zenger: Security and privacy have to be part of the entire design process of any device that impacts our daily lives. It cannot be an afterthought. Typically, manufacturers want to deliver new products with interesting features and the topic of security is a nuisance for them. Encryption is often just added to a product to tick some marketing box.
However, we have seen in many real-world attacks that these systems never live up to their promises, which results in loss of customer confidence, loss in revenue, and bad public relations.
If ‘data is the oil of the digital economy’ we should care about what happens to our data and who is monetizing it.
More on Internet of Things:
Security must be part of device design as Internet of Things evolves
Samsung’s SmartTV foreshadows Internet of Things eavesdropping
Health care data at risk: Internet of Things facilitates health care data breaches
‘Impenetrable’ encryption arrives to lock down Internet of Things