Demystifying Internet of Things Security Successful IoT Device/Edge and Platform Security Deployment — Sunil Cheruvu Anil Kumar Ned Smith David M. Wheeler Demystifying Internet of Things Security Successful IoT Device/Edge and Platform Security Deployment Sunil Cheruvu Anil Kumar Ned Smith David M. Wheeler Demystifying Internet of Things Security: Successful IoT Device/Edge and Platform Security Deployment Sunil Cheruvu Anil Kumar Chandler, AZ, USA Chandler, AZ, USA Ned Smith David M. Wheeler Beaverton, OR, USA Gilbert, AZ, USA ISBN-13 (pbk): 978-1-4842-2895-1 ISBN-13 (electronic): 978-1-4842-2896-8 https://doi.org/10.1007/978-1-4842-2896-8 Copyright © 2020 by The Editor(s) (if applicable) and The Author(s) This work is subject to copyright. All rights are reserved by the Publisher, whether the whole or part of the material is concerned, specifically the rights of translation, reprinting, reuse of illustrations, recitation, broadcasting, reproduction on microfilms or in any other physical way, and transmission or information storage and retrieval, electronic adaptation, computer software, or by similar or dissimilar methodology now known or hereafter developed. Open Access This book is licensed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons license and indicate if changes were made. The images or other third party material in this book are included in the book’s Creative Commons license, unless indicated otherwise in a credit line to the material. If material is not included in the book’s Creative Commons license and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder. Trademarked names, logos, and images may appear in this book. Rather than use a trademark symbol with every occurrence of a trademarked name, logo, or image we use the names, logos, and images only in an editorial fashion and to the benefit of the trademark owner, with no intention of infringement of the trademark. The use in this publication of trade names, trademarks, service marks, and similar terms, even if they are not identified as such, is not to be taken as an expression of opinion as to whether or not they are subject to proprietary rights. While the advice and information in this book are believed to be true and accurate at the date of publication, neither the authors nor the editors nor the publisher can accept any legal responsibility for any errors or omissions that may be made. The publisher makes no warranty, express or implied, with respect to the material contained herein. Managing Director, Apress Media LLC: Welmoed Spahr Acquisitions Editor: Natalie Pao Development Editor: James Markham Coordinating Editor: Jessica Vakili Cover designed by eStudioCalamar Cover image designed by Freepik (www.freepik.com) Distributed to the book trade worldwide by Springer Science+Business Media New York, 233 Spring Street, 6th Floor, New York, NY 10013. Phone 1-800-SPRINGER, fax (201) 348-4505, e-mail [email protected], or visit www.springeronline.com. Apress Media, LLC is a California LLC and the sole member (owner) is Springer Science + Business Media Finance Inc (SSBM Finance Inc). SSBM Finance Inc is a Delaware corporation. For information on translations, please e-mail [email protected], or visit http://www.apress.com/ rights-permissions. Apress titles may be purchased in bulk for academic, corporate, or promotional use. eBook versions and licenses are also available for most titles. For more information, reference our Print and eBook Bulk Sales web page at http://www.apress.com/bulk-sales. Any source code or other supplementary material referenced by the author in this book is available to readers on GitHub via the book's product page, located at www.apress.com/978-1-4842-2895-1. For more detailed information, please visit http://www.apress.com/source-code. Printed on acid-free paper I dedicate this book to my readers for their curiosity to learn. My wife Sunitha, a divine presence and guidance constantly channels my creative energy to empower the world with my wisdom. My daughter, Ria is an inspiration with her intuitive perspective, and her critique of the draft was instrumental in transforming the content for the audience. — Sunil Cheruvu To my wife Manju and children, Induja and Abhiram for their constant encouragement, support and curiosity during the writing process. I want to thank my parents, teachers and friends for their continued guidance in learning new things and sharing my knowledge with others. — Anil Kumar This book is dedicated my wife KJ who gives unconditional support for all the things I aspire to both vocationally and otherwise and to our children Hayden, Addison, Gavin and Janelle for courageously pursuing their dreams; and to Thomas for always being willing to think out of the box. — Ned Smith To my lovely wife – Without your encouraging support, strategic insights, and challenging questions, I would not have accomplished all that I have. To my wonderful children – Listen to your mother! — David M. Wheeler Table of Contents About the Authors ..............................................................................xiii Acknowledgments ............................................................................xvii Foreword ...........................................................................................xix Introduction .......................................................................................xxi Chapter 1: Conceptualizing the Secure Internet of Things ...................1 The BadUSB Thumb Drive .....................................................................................2 Air-Gap Security ....................................................................................................3 Stuxnet ..................................................................................................................4 Designing Safe and Secure Cyber-Physical Systems ...........................................6 Constrained Computing and Moore’s Law ..........................................................10 Trusted IoT Networks and the Network Edge ......................................................13 Conclusion ..........................................................................................................20 Chapter 2: IoT Frameworks and Complexity ......................................23 Introduction .........................................................................................................23 Historical Background to IoT ...............................................................................24 IoT Ecosystem ...............................................................................................27 Elements of an IoT System .................................................................................32 IoT Device ......................................................................................................32 IoT Network ...................................................................................................38 IoT System Management ...............................................................................39 v TABLE OF CONtENtS IoT Framework ..............................................................................................45 Summary IoT Framework Considerations .....................................................58 IoT Framework Architecture ................................................................................58 Data Object Layer ..........................................................................................59 Node Interaction Layer ..................................................................................60 Platform Abstraction Layer ............................................................................61 Platform Layer ...............................................................................................63 Security Challenges with IoT Frameworks ....................................................64 Consumer IoT Framework Standards ..................................................................66 Open Connectivity Foundation (OCF) .............................................................67 AllSeen Alliance/AllJoyn ................................................................................78 Universal Plug and Play .................................................................................82 Lightweight Machine 2 Machine (LWM2M) ....................................................88 One Machine to Machine (OneM2M) .............................................................96 Industrial IoT Framework Standards .................................................................104 Industrial Internet of Things Consortium (IIC) and OpenFog Consortium .....105 Open Platform Communications-Unified Architecture (OPC-UA) .................111 Data Distribution Service (DDS) ...................................................................117 Framework Gateways .......................................................................................131 Framework Gateway Architecture ...............................................................133 Security Considerations