Making IoT Scalable, Simpler and SAFEr

The growth of connected devices is unlocking new services across M2M and consumer IoT use-cases. ABI Research predicts annual revenues from IoT services will hit $460 billion by 2026.

IoT services are enabled by devices collecting, processing and sending data, quite often sensitive or personal, to the cloud. A key factor in the widespread deployment of IoT services is the ability for key stakeholders – end-users and service providers – to trust that the data gathered and transmitted to the IoT cloud is done so securely, in order to protect its integrity and the resulting integrity of the service.

Global authorities, industry bodies, governments and regulators are therefore working collaboratively towards defined IoT guidelines and mandates. This activity is particularly advanced in Europe. The General Data Protection Regulation (GDPR) defines strict penalties for device manufacturers and service providers who do not protect consumer privacy. A robust certification framework has also emerged, with the ENISA Cybersecurity Act and Eurosmart IoT Certification Scheme requiring IoT devices to undergo penetration testing from state-of-the-art independent security laboratories prior to deployment.

The challenges of remotely provisioning, managing and updating credentials across millions of different devices throughout their entire lifecycle to ensure this security and privacy are myriad. It's the ability to protect IoT data communications in a simple, standardized manner at scale, however, that has emerged as a key industry challenge.

Market Fragmentation – A Key Challenge

Leveraging a hardware secure element (SE) as a "Root of Trust" to execute security services and store security credentials is an essential step in the development lifecycle to guarantee end-to-end security for IoT products and services. It's also a key recommendation of the GSMA IoT Security Guidelines.

There are several proprietary hardware SE solutions available to deliver this root of trust, but market fragmentation introduces a key challenge. Connected devices must be modified to access security services from different SE providers, which creates significant design issues and is unsustainable at scale given the ever-increasing size and diversity of the IoT ecosystem.

The SIM on the other hand, in combination with supporting over-the-air provisioning and management infrastructure, is fully standardized. When used as the hardware Root of Trust in an IoT device, it promotes interoperability across different vendors and more consistent use by IoT device makers and service providers.

An additional advantage is that the SIM has advanced security and cryptographic features, including a securely designed central processing unit (CPU) and dedicated secure memory to store operating system programs, keys and certificate data. This protects IoT devices from various hacking scenarios, such as cloning, physical attacks to a single device and remote attacks from the internet to numerous devices.

Although this advanced functionality and infrastructure means the SIM can effectively function as the hardware Root of Trust in an IoT device, the fragmentation challenge isn't completely removed. This is because device middleware must still be modified to enable access to the SIM services.

It was apparent, therefore, that removing this design hurdle was critical to the development of a scalable, secure IoT ecosystem.

Introducing IoT SAFE

It’s widely recognized that industry collaboration is key to promoting a secure, interoperable connected future. To further extend the capability of the SIM, GSMA and SIMalliance have partnered on IoT SAFE (IoT SIM Applet For Secure End-2-End Communication).

IoT SAFE directly addresses the significant challenge of industry fragmentation. By specifying a common API and defining a standardized way to leverage the SIM to securely perform mutual authentication between IoT device applications and the cloud, it's far easier for IoT device makers to execute security services and manage credentials across millions of devices.

And as all of the critical security functions are executed on the SIM rather than untrusted areas of the device, the robustness of the mutual authentication is assured. Also, a remote interface enables the management of the secure IoT applet throughout its lifecycle.

Delivering Flexibility and Maximizing Investments

The benefits of IoT SAFE go beyond scalability and security. For example, as security functions can be delegated to the SIM, device makers aren't solely dependent on cloud provider services to secure their products and solutions.

In addition, SIMs are already widely deployed to ensure trusted connectivity across the mobile ecosystem.

“For over 25 years the SIM has been the ‘Root of Trust’ for the mobile industry, its security constantly evolving over this period so that today the SIM secures over 9.4 billion cellular-connected devices,” said Graham Trickey, Head of IoT, GSMA. “IoT SAFE extends the security capabilities of the SIM even further to secure new IoT services end-to-end, underpinning a new generation of IoT services and billions of new IoT devices.”

An estimated 5.6 billion SIMs were shipped in 2018 alone, with estimated total shipments from 2013 to 2018 hitting 32 billion. This can be leveraged to deliver enhanced security for devices with minimal additional investment.

IoT SAFE enables all ecosystem players to homogenously leverage the advanced features of the SIM and the supporting infrastructure to deliver enhanced security at scale, increasing flexibility and maximizing investments.