Although a public key infrastructure (PKI) has many benefits, it still has some considerations that need to be properly addressed for it to be an acceptable security solution for IoT devices. Here are a few PKI considerations as it relates to Internet of Things security solutions in hardware and large-scale device deployments.
Interested in learning how to scale PKI for securing your IoT devices? Download our free white paper:
One drawback of PKI and asymmetric cryptography is the solution’s complexity and the intensive mathematical computations needed to perform operations. When PKI was first developed, its target applications were servers, datacenters and web hosting. In these environments, security was implemented in software and the PKI was typically implemented by a dedicated team of experts.
Setting up PKI requires that the customer understands how to define the architecture needed based on the use cases. The customer needs to define the format of its certificates and the security policy around the management and protection of the PKI ecosystem. A PKI hierarchy must also be implemented to make sure proper security protocols and cipher suite modules are used. Finally, because the private signing keys are the authorities that enable access to the ecosystem, they need to be securely hosted and periodically audited for policy compliance.
Digital Certificate Authentication Components
Although asymmetric cryptography requires the protection of only the signing private key, not the verifying public key, any entity that needs to prove (authenticate) its identity needs to hold a private key. A digital certificate is similar to a passport in that they both include two critical authentication components:
- Something that proves the credential originated from an authorized source and was not altered
- Something that proves the credential actually belongs to the bearer
On a passport, the embedded graphics and physical security features make it very difficult to fake and alter the document. Examining the physical security features helps prove that the document is authentic and originated from the government. The picture on the passport proves that the bearer of the passport is the owner.
For digital certificates, the asymmetric cryptographic signature on the certificate allows the recipient to use available public keys to verify the origin of the certificate and also prove that the data within it has not been modified. It proves authenticity and is akin to a passport’s holographic security features.
The digital certificate contains a public key in addition to its certificate data. The public key is mathematically related to a specific private key. When a digital certificate is presented, the public/private key pair relationship proves (via a random number challenge) that the device that presented the certificate actually possesses the unique private key associated with that certificate.
Through this example, you can see why protecting any private key is vitally important— because it is used to prove rightful ownership of a digital certificate.
Every member of an ecosystem needs a certificate to gain access, and therefore every member of an ecosystem needs a private key that is well protected. Furthermore, the generation/creation of the public/private key pairs needs to be tightly controlled to prevent unauthorized access or leakage of private keys.
In the days when only servers hosted in protected datacenters needed to authenticate themselves, key generation and storage was typically performed in software because those systems were generally not physically accessible and did not permit access to protected key storage.
Scale was quite different: The number of websites at the time was relatively small and easier to manage. Even today, there are approximately 1.8 billion websites in total around the world, although only about 250 million of them are active. That number may seem large, but the scale of IoT and small embedded systems is measured in billions of microcontrollers sold per year. The IoT future will involve generating and properly storing private keys on a scale at least an order of magnitude larger than web server certificates.
Scaling PKI to Secure IoT Devices
The current technology of PKI can theoretically support that future, but the logistics of making it happen at that scale is a whole new problem. IoT devices are meant to be deployed in the field and in places that are physically accessible to the public. Yet, the devices must hold a private key so that they can authenticate themselves to gateways, servers and cloud service software. For PKI to work for IoT, it needs a method to provide strong protection for private keys stored in small devices that have limited compute power— and be able to do it economically on a massive scale.
To learn more about how you can use PKI to secure your IoT devices at scale, download my free white paper: