How SDN and Blockchain can help with IoT Privacy and Security?

As the enterprise embraces IoT for industrial usage and many home-based automation solutions, IoT systems are becoming the target for attackers. The Mirai Botnet attack on Dyn (a company that controls most of internet’s DNS infrastructure) was a perfect example of the attacks the world has experienced impacting sites like Twitter, Reddit, Netflix, CNN, and many more. In the same way, attackers are increasingly exploiting vulnerabilities of many IoT systems to steal data generated by IoT sensors, gaining control of devices to perform malicious activities, or just take down the network for fun. 

Apart from security, privacy concerns are raised with growing usage of IoT applications. Wearable devices or home-based IoT devices collect a huge amount of personal data and data about the user environment. Privacy concerns are critical for health-related data from usage of medical robotic and fitness devices. Sensitive information can be easily disclosed due to poor network segmentation and loopholes in the IoT ecosystem.

(Image: Shutterstock)

Possible reasons?

• Manufacturers developed IoT systems with lower consideration of security aspects. Reasons could be a lower demand for IoT devices in the market and lack of concern by hardware manufacturers who are focusing on rapid production, speed, and efficiency of devices.
• IoT systems or devices are built with low computing capabilities. No additional hardware or software was dedicated to hunting down attacks by analyzing logs generated while malicious activities by attackers.
• Attacks made to the application level of IoT devices are visible to the network. For example, a brute force attack on front-end IoT portal can impact the network as the application, and network layers are tightly coupled. An intermediate system is missing to analyze the instructions send to network resources in typical IoT based networks.
• A client-server architecture to manage the IoT devices and data gathered from the IoT network. This model has a single point of security intelligence which may get compromised, which can lead to DDoS attacks like Mirai Botnet.

How can SDN help?

Multiple companies are evaluating the use of Software Defined Networking (SDN) technology to tackle the security issues of an IoT device network. It is a cost-effective software-based solution as compared to solutions which may have a manual intervention to each of the devices in IoT network.

By separating the control plane from data or forwarding plane from independent network devices, SDN allows a network to be centrally managed and monitored. SDN simplifies network configuration by dynamically programming and restructuring of network settings from central SDN controller. This further enables software-defined security for network allowing capabilities of malicious quarantine activities and prevents DDoS types of attacks. It becomes easy to define security policies for a network with the software-controlled nature of SDN network.

Application of SDN in IoT based network enables the SDN controller to get input from front end IoT application to make decisions for traffic management. Using SDN, a feedback system can be formed within IoT devices and the SDN controller. In this system, information of security breaches is passed to the SDN controller, which manages several programmable switches. Any attack is logged by the SDN controller, which clock the attack closer to source and further spread awareness about the attack in the whole network connected by central SDN controller. This attack information can be shared among multiple connected controllers to block similar malicious activities before affecting the peered network.

In the above case SDN controller acts as a firewall, but at a central location. It incurs delays and overloads to the SDN controller. Another approach could be to deploy a set of firewalls at different network segments to respond to attacks in each specific segment. This allows one to configure automated responses from IoT devices and isolate the whole network, reducing the need to look after every attack on IoT network.

SDN technology is still not robust enough to prevent an attack on the IoT devices themselves. But SDN can help reduce the impact on the whole network of IoT devices.

How can Blockchain help?

The blockchain is based on the concept of decentralization of data. That means copies of the same data are kept at multiple nodes in the network. With blockchain technology, any transaction of data can be tracked by trusted nodes participating in a network.

The main reason that blockchain can be considered for IoT security and privacy is that blockchain has data protection and security mechanisms built into the design itself. This can prevent IoT devices from forwarding malicious data or information to other devices. Also, blockchain technology follows digital security requirements like availability, accountability, integrity, and confidentiality. Decentralization of data makes data highly available for devices in the network (availability). As devices in blockchain network are authorized, any transaction of data must undergo agreement from other devices (accountability). Any sent data is received at the node without any changes is checked within a blockchain network (integrity). Data is received only within the network of trusted devices (confidentiality).

As IoT devices have fewer resource capabilities for performing intelligence operations, they must depend on a central server to make decisions related to data gathering, storage, and security. With blockchain application in IoT devices network, devices can form a trusted network by establishing a shared key among themselves. With this, any abnormal or unusual activity due to external interference can be tracked and quarantine.

As telecom networks are moving to high bandwidth and low latency 5G network, it will become imperative for IoT system to have strict security rules. In this case, implementation of blockchain in IoT systems can be crucial to hunting down external malicious interference and identity management as well.

Role of governments for IoT security

Investment in IoT will be growing in upcoming years. We will be surrounded by connected devices more than ever. Questions around security and privacy of IoT enabled applications will also go wider. Consumers and businesses must find ways to tackle those obstacles. Governments are also diving into IoT cybersecurity concerns. US government passed the bill described as “Internet of Things Cybersecurity Improvement Act of 2017” where it is stated that IoT devices should be patchable and allows to change default credentials to access firmware of devices. To protect the privacy of telecom subscribers in India, Telecom Regulatory Authority of India (TRAI) proposed a draft to enforce adoption of blockchain technology as Regulation Technology (RegTech). As per the statement, “Blockchain has proven useful where the objective is to cryptographically secure information and make it available only on a need to know basis. Yet none may deny their actions or tamper with records, once recorded on the distributed ledger, which uniformly enforces compliance.”

Conclusion

We have evaluated SDN and blockchain technology for security and privacy of the IoT ecosystem. SDN can be helpful in making IoT network secure to block cyber-attacks in a short amount of time after detection. Blockchain technology is preferred to enforce privacy for IoT enabled devices and for maintaining trust within the IoT network. But still, it is the responsibility of IoT devices manufacturers to put more emphasis on the security aspect of IoT devices itself rather depending on supporting technologies.