Re: Access control for IoT

On Mon, 2016-01-18 at 10:59 -0800, Tony Arcieri wrote:
> On Mon, Jan 18, 2016 at 10:42 AM, Valerio Bellizzomi <[email protected]>
> wrote:
> 
> > most devices used for IoT come with 32K of memory, do not run true
> > operating system, they run small programs that provide only the required
> > control/information functionality. Those devices have ethernet or wifi
> > links. How do you implement access control given that the device will
> > connect to a local server?
> 
> 
> As I said in my last message:
> 
> 
> > > All that said, as far as I can tell there really isn't anything to
> > > recommend so far that remotely resembles a real option in this space. The
> > > best I can recommend are half-baked research projects.
> 
> 
> As to how these research projects are trying to solve these constraints:
> 
> - Minimize cryptographic primitives: instead of bundling both a hash
> function and symmetric cipher (possibly as hardware), use a hash function
> to implement an Even-Mansour stream cipher
> - Minimalistic transport encryption: abandon TLS and ship a tiny,
> constrained transport encryption protocol
> - Software update framework: support incremental download, data-at-rest
> authentication, and reflashing of device firmware with a fallback to the
> old firmware on error
> 
> Even without the IoT constraints these are challenging engineering goals in
> and of themselves. I'll point to transport encryption (specifically key
> exchange) as the thing that's most routinely screwed up with homebrewed
> protocols.
> 
> Just getting the above right forms the baseline of a secure system, and is
> already exceedingly difficult to the point few systems manage to do it in a
> remotely secure manner. User-friendly access control is gravy.

there is some crypto in the form of a library, ok, or even as hw module.

I've seen software update is a process that needs the device powered off
and on some devices the reflashing is via usb cable.

It depends, if there is a full OS, it can do updates via remote link.