Biology, Deceit & Security in the Internet of Things

Over the last several months, Jim Hogan and I have been kicking around ideas with regard to the issue of security in the Internet of Things (IoT). This all began with an off-hand comment I made at a Hogan panel at DAC. The idea is that some non-traditional approaches to security at the system-level -- particularly based on biological analogies -- should become relevant. This topic surfaces from time to time (there was even a blog about it last year in EETimes), but rarely seems to go very deep. We thought it was time to drop down a level and to delve into why this should be relevant to the IoT and how the mechanics might work. We hope you find it interesting.

Alternative security strategies Security techniques in the Internet have largely drawn inspiration from physical security -- keys, firewalls, trusted zones, and more. However, there are other possible sources of inspiration, biology being an obvious example.

We routinely talk of viruses, but that analogy extends only to the concept of a malicious attacker and the spread of infection, not so much to methods of defense. This is unfortunate, because the ability of living organisms to defend against infection should be just as much a source of inspiration. After all, life has evolved some pretty sophisticated defenses against pathogens over billions of years.

Biological analogies for security in cyberspace have been investigated in a number of papers (e.g., "The Biological Analogy and the Future of Information Security"), but they have not seen wide-scale adoption. Furthermore, these methods are all rooted in what one might consider the "classical" Internet -- workstations, laptops, even tablets and smartphones connected through wired and wireless channels to the Internet at large. We argue here that new challenges suggested by the burgeoning IoT may re-awaken interest in biological strategies for defense.

First, some definition and motivation. The IoT is a forecasted extension of our current Internet to connect not just computers and communication devices as we currently understand them, but also devices we wear (jewelry and clothing), medical devices implanted in our bodies, intelligent appliances in our homes, sensors attached to points of stress on bridges, buildings, airplanes, and ships, along with sensors and actuators in roadways, on the power distribution grid, and in many more applications in factories, departments stores, malls, and elsewhere. This is not just connecting for the sake of connecting -- all of this technology can enhance our health and safety, optimize our use of resources, and further improve our quality of life, but only if IoT devices can connect to the Internet so we can manage and automate control and monitoring of this widely-distributed network.

The number of devices and sensors (the "edge-nodes") required to support this (hopefully) utopian vision is no longer scaled by the human population, but rather by the number of "things" to be interconnected. Some estimates place the number of likely edge-nodes as high as one trillion. To put that number in perspective, such a system could scale up the number of devices connected to the Internet today by a factor of one thousand. We are now at the early stages of this adoption curve.

One trillion is an interesting scale -- one at which we arguably do not have a lot of engineering experience. However, it is a common scale in biology; a newborn child, as just one example, contains around a trillion cells and is surprisingly well-defended against infectious attacks through a sophisticated immune system for detection, counter-attack, and isolation; also through redundancy, which enables recovery from partial losses resulting from an attack.

While we should be careful not to over-stretch this analogy, perhaps we have something to learn from how nature has fashioned such capable systems. More particularly, biology can help us think in a different way about defense -- at the system level -- when much of our security design today is focused at the unit-level. Deception, which we'll touch on later, is another system-level strategy.

Throughout the remainder of this article, what we will suggest is intended to augment -- not replace -- existing strategies, which will continue to be essential and which must continue to evolve rapidly.

To Page 2 >

Read this article:
Biology, Deceit & Security in the Internet of Things