hey welcome to cloud on air live
webinars from Google cloud we're hosting
webinars every Tuesday my name is
Anthony possum art the head of product
for our cloud IOT offering and today
we're gonna be talking about IOT
security and how to make your solutions
secure you can ask questions anytime on
the platform and we have Google Earth on
standby to answer them so let's get
started
so making IOT solutions secure security
is top of mind for everybody it's it
it's mostly driven because of all the
recent attacks and it's been in the news
around a IOT security you know think
about Mira Mira I was taking over some
cameras in the wild and using them to do
didn't distributed denial-of-service
attacks that was 2.5 million devices
affected by this kind of attack more
recently things like meltdown inspector
literally touched about every computer
out there including IOT devices that
without was that was a big one that
needed to be solved so all those
security issues and even a more recent
one with z-wave are putting a lot of
pressure into IT professionals and and
people working in IOT to really make
those solutions secure so today we're
going to talk about how to make that
secure there's more and more devices out
there you know a lot of people throw big
numbers what I like to look at is the
current number of devices and the growth
it's about eighty four point eight point
four billion devices connected today
it's growing about 30% a year what that
tells me it's the attack surface is
actually growing rapidly it's not so
much the number of devices just every
new device out there is a new
opportunity for an attacker to take over
and cause sun damage so that's that's
what worries some about the growth and
it can come from everywhere we've seen
for example there was a hack in a casino
in the US where the casino got hacked
through a fishtank thermostat so some
attacker got into that thermostat I was
in the casino and through that
thermostat I get access to the network
and got access to a bunch of data from
the players in the casino that was a
pretty big deal they actually didn't
discover that attack for a little bit of
time and we're wondering why this
thermistor I was sending so much data
out to the cloud well now they know what
it was a little bit of a big deal but
that shows you the importance of
securing the IOT devices not only the
network itself 71 percent of the attacks
go and detected so that's that's a big
number we need to do better here and
it's really more than money it's also
the reputation you've probably heard
about the Equifax breach where all those
social security number information about
users were pulled out of their system
early really really worrisome to be
honest their stock price fell 30 percent
right the same day I mean the day after
the the the attack was was unveiled and
that's that's pretty rough I know you're
talking millions of dollars lost because
of that attack so it's not just money
it's also a reputation I don't know if I
would trust Equifax anymore maybe but
it's you got to really consider the the
cost of being hacked as a device and
being in the news and people talking
about your your devices being hacked
that's sometimes more important than
just the money so security cannot be an
afterthought it has to be built in your
system has to start from the ground up
as you're building your solution and
also we'll look at how you know some
ways to retrofit those solutions but it
cannot be an afterthought and this is
the subject here the problem is it's
really complicated you talk about
mechanical designs and PCB designs we're
talking about the supply chain and
securing the supply chain talking about
the firmware development and security
firmware the network connectivity your
cloud back in your mobile and web apps
even the processing and analytics the
support over time something that people
overlooked often they'll secure device
but what happens two years from now five
years from now how do you keep that
device secure and the overall cost and
ROI and the business model associated
you have to think about all of this as
you're building a solution and security
has to come in all of those items as
well so we're going to look at four
different areas of your solution
starting from hardware and connectivity
how to secure that the IOT platform the
device management the ETL ingestion how
to secure that the Big Data ml and AI
and then the mobile web and back-end
that cuts across the stree three buckets
will focus more on the hardware in
connectivity and the IOT platform today
we'll assume that the security of mobile
apps web apps and you know big data on
email that's kind of taken care of
because the subject is more around the
IOT side of things so first thing is to
choose a platform that is secure and you
know you can cover yourself you trust
but you have to verify this why for
example the Google cloud platform as ISO
certification HIPAA compliance no
FedRAMP a lot of the certification that
are verified by third-party vendors to
say yes Google Cloud is secure you can
trust them put your data in there but
also we are working with other
institutions like the FDIC or no some
some of the other logos in there to
really stay ahead and look at the
security holistically and really try to
find those those problems before they
occur so that's a very important effort
that Google's undertaking making the
Google cloud platform extremely secure
for your solution we really built that
solution at Google from the ground that
we're thinking security at the hardware
level any software the storage the
identity you know looking at the network
and operations of that network really
thinking security at every layer of that
cake here to make sure that we offer
those secure solution for you and you
can trust that cloud infrastructure for
your application your analytics your ml
and AI you can trust those to build your
IT solution so to illustrate how you can
secure your IT solution we really want
it to go through a little bit of a story
time and tell the story of a company and
you know you can pick any name I'll take
Acme who for example and take a company
that wants to build an IOT device today
what do they have to look at and what do
they go through in their journey to a
solution and to make that secure so they
have to look at encryption obviously of
data
authentication of devices and users at
the manufacturing security at the boot
and at the key rotation over time so
those are five elements that are really
important to look at as they're building
your solution so we're going to go
through each of them and see how to to
make that secure so the first thing is
data encryption so data encryption here
we're talking about data encryption in
transit TLS is what most people should
be using it's a very standard protocol
you can know it's used to connect to
your bank if you're familiar with that
I mean TLS is very well known it's very
well deployed it's been battle tested
this is something that you should always
have between your device and the cloud
platform the Google cloud platform you
should be using TLS for data encryption
in transit that's very important and
that's a given that's the first thing so
they say okay well use ACK missus well
use TLS to communicate between our
device and we will go have that for
great now how do you efendi Kate we have
encryption we need to authenticate those
devices there's two really two ways to
authenticate devices if you wish there's
kind of a certificate based
authentication and a password based
authentication do not use password based
for devices password are for human you
know password is what is a is an element
that somebody has in their head and the
head is the secure storage you're not
supposed to write it down in a post-it
and put it on your keyboard that's not
how you do it you keep it in your head
and then because I know the password I
can authenticate so that I'm the secure
element here the problem with the
password is if somebody else knows your
password that other person is you
there's no validation that you are you
are the person you say you are you're
just showing a password and it says I am
me and it's that's why the secure
storage in your head is very important
is to prove that it is you but the
problem that's the main issue with the
password password is you with a
certificate there's a certificate
authority that validates that what
you're presenting as an identity is
actually you so that authority will say
yes yes that public key that certificate
great that's device ABC and that's great
so you should always use sir
ticket for devices because you don't
have a head as a secure storage as a
human does so this is very important and
also that third-party validation of the
identity is very important so use
certificate for devices fine
so Acme says okay well use TLS for
encryption will use certificate for
identity but then I have a I have
certificate so I have public keys and
private keys how do I give those keys to
my manufacturer how do I put those keys
on my device and that's actually a
pretty big problem it is there there's
several ways you can do that you can
create a file with all the keys and send
that file to your manufacturer that's
one way to do it you have to trust your
manufacturer at this point because the
manufacturer has like seize your keys
and they can actually copy those keys if
their malicious a bit it does happen
fairly often then the manufacturer will
generate all your devices and your
device is fine and then all of a sudden
you see maybe 10% of those devices or
rogue devices are fake devices but using
valid keys the copies of existing keys
because they were in a file and they've
been copied so it's a little bit of an
issue so that's not really a good way to
do it the other ways to say hey
manufacturer you're gonna put you're
gonna do an API call every time you're
gonna flash that firmware and my
identities you're gonna do an API call
to a back-end to get the keys right on
time the manufacturers hate that because
it slows down the manufacturing process
so imagine that you will call they get
the kid the key that's a roundtrip
you know they get to download that key
they have to flash it then they go to
the next device that's fairly slow and
what happens sometimes is that call
doesn't work but that calls to slow its
slowing down the manufacturing process
which adds cost to you so when they do
that they will actually charge you way
more than just a standard manufacturing
process that goes really fast so that's
costing a lot of money and they usually
don't like that actually a lot of math
structures don't even have their
manufacturing line connected to the
internet that they don't even allow you
to do this so you revert to giving them
a file with the copies of the keys so
that's not that's not great so we need
to find we need to find a solution for
that
Els mutual authentication so this is the
authentication we say what we're gonna
use we were going to use certificates
great so the certificate can be used to
authenticate the cloud like you would
authenticate with your bank when you do
that the bank knows it's you know it's
the bank but the bank doesn't know it's
you until you put your username password
it's the same for device they can
authenticate the cloud the cloud needs
to authenticate the device so it's a
mutual authentication both ways and you
can use TLS with you a lot to do that
there's good and bad for it it's not all
good so we'll look at that and finally
secure boot we want to make sure that
what the device is running when it boots
is what's supposed to be running the
first thing that a hacker will do when
they get on to a device they'll modify
the firmware so the device cannot do
what it's supposed to be doing Mira I
was doing that Mira I would get on the
device shut off everything every other
connection and reconfigure itself so
nobody else could come in actually would
shut down any other Mira attack which
was pretty good but it would shut down
any access to the device then it would
reconfigure the device to do what it
wanted it to be to do so make sure that
when the device boots there's a
validation of the firmware that says yes
yes it is right it is the right firmware
and it's supposed to boot the right way
and it's doing the right thing so I let
the device boot so that's secure boot
and that's really important to implement
in your device and the key rotation is
something that is actually forgotten
quite often you need to think more than
a year away you know think four years
five ten years fifteen years in
manufacturing we see 15 20 years
sometimes Keys will rotate will have to
be rotated sometimes they're corrupted
there's been a hack in your back-end
system in your CA the keys have been
exposed you have to rotate them maybe
the CA has to be rotated at a few years
and that's very important that's hard to
do so you have to really consider
throughout your design that the keys are
ephemeral and will have to be changed so
that's something very important to
consider when you build your device
think that your key are not going to be
permanent and will have to be rotated
how
your software and humor manages that to
make sure that that's feasible over time
that's very that's a very important
point that's often time overlooked so if
you look at all the challenges so you
need certificates and a certificate
authority and there's complexity coming
with that the manufacturing cost and
risk associated with transferring the
keys to your manufacturer that's the
problem
TLS and TLS mutual loss is actually a
little bit bloated and hard to maintain
so we'll see we'll see how we can solve
this keys are extremely difficult to
store securely in fear Moya if it's fume
wear or software somebody can have
access to it somebody can reverse
engineer the code can decompile and can
get access to those keys it's extremely
hard to secure any key in a theme where
you have to do secure boot and you have
to have key rotation management so those
are six points that are really big
challenges and at this point you're
probably thinking man this is a problem
like how am I going to secure my IOT
devices this is too complicated so let's
see how we can help with that
so let's talk a bit about Google Cloud
IRT the Google car diode chip platform
is a set of services one of the most
recent it's called coyote quartz the big
one on the left here clarity core has
two components a device manager where
you'll declare your devices your
attributes your registries your access
controls all of that and your keys
you're gonna store your keys in there
the public keys and then you have a data
bridge or broker for mqtt and HTTP to be
able to communicate bi-directionally
with the devices and between the devices
and the cloud all the data coming into
cloud IT core is passed on to cloud
pub/sub a globally available messaging
service from pub/sub you can trigger
your cloud function serverless functions
and compute you can trigger data flows
that can do streaming analytics over a
certain period of time can do
transformation and any kind of operation
at very high scale from there you'll go
into storage in BigTable
bigquery maybe fire store
and trigger cloud ml training if knitted
those trainings could be used by data
flow or cloud functions to do inferences
and then pass back to the device
eventually on the far right data studio
and data lab and analytics are allow you
to visualize data silly little time
series you know see any information you
need about your your your data coming
from the devices
that's our cloud IOT platform it's a
fully managed platform quadratic or is
not installed or deployed or configured
in terms of shard size or anything it's
a global service it will be accessible
anywhere in the world and it's scalable
for you one device million device
doesn't really matter you just throw
whatever you have at it it will scale up
and down to you need so how do we secure
that step one use a secure element use a
crypto chip this is super important I
cannot emphasize that enough you should
use a crypto chip in your device if you
can the private key from secure chip are
never exposed they are generated inside
the hardware private keys generated
inside the hardware the public key is
generated and then exposed so it can be
distributed to to the backend this is
super important we have a great
partnership with microchip here on that
you're talking a sub dollar and it's
really cheap to add and it saves you a
ton of trouble you can send that crypto
pre-configured to your manufacturer
anywhere in the world even if you don't
trust them doesn't matter because they
can't read anything from that chip
they'll just be able to solder it to
your PCB design and then you're good to
go the identity has been burned onto the
device it's super secure there's really
no copying of keys possible there's no
API calls that the manufacturer has to
do there's no constraint so the cost of
manufacturing is actually much much
cheaper and it often time compensate for
the price of the chip so that's super
important I've seen customers having to
add three or four dollars to do custom
manufacturing for each of the devices if
you use this there's no more custom it's
a single thing so you'd save three or
four dollars for it
a chip that costs less
and a dollar so that's that's a very
good value prop you should really use a
crypto chip the clip that you can also
do secure boot by the way so you can
have the signature of your firmware
inside the crypto chip when the device
boots there's a signature there's a hash
that's calculated of your firmware it's
passed to the crypto the critical say
yes or no and then the device can boot
or not so you're doing secure provision
you have a keys cheaper manufacturing
and more secure manufacturing you're
doing secure boot with this and also
we'll see you'll be able to do key
rotation with this so this is very
important even if you feel it's a little
bit expensive please do it it will save
you a ton of time will save you a lot of
trouble down the line so use a secure
element second be authentication I was
talking about mutual life from TLS
mutuality is great that there's kind of
a lot of downside to it so we recommend
using a jot for authentication jawed is
something that's used by web web
services in general and then it's a
standard it's a JSON web token the way
works and I have a little schema the
schematic after that is you establish a
TLS session with the Google front end
and you were in the world as I said card
IOT core is a global service so anywhere
in the world you'll hit that Google
Google front end with a TLS session
you'll establish that TLS session with
Google front end great no problem
then you're going to establish your own
qtd session over TLS to do that you're
going to use username and password from
MQTT so you're not using the mutual loss
at this point you're just establish your
TLS session that's it my name qtt
session has user name and password to
connect statement of your qtt has user
name password username is actually not
used we don't you can put anything you
want in there you say ignore or empty
doesn't matter
the password is actually not a password
it's a it's a jot token a JSON web token
that has has a bunch of information
about the device the device ID all of
that that is signed by the private key
so encrypted and signed by the private
key of the device with a little crypto I
showed you earlier that crypto is
capable of signing that job I could
although all the
to do it without crypto so it's very
easy to do you sign that jut with your
private key and you pass it as your
password that jut will be valid from
whatever you want to 24 hours maximum so
you will have to rotate every 24 hours
at minimum so that jar is signed and
passed to IOT core IOT core we'll look
at the device ID we'll find the public
key and validate that the private
signature that the signature from the
private key is actually valid and here
you go you have your device ident
occation so using that system you get
mutual authentication from both cloud
and device without using the TLS mutual
of feature we support ECC and RSA on IOT
core and that crypto that I showed you
can do both as well little schematic to
bring it to life we have the provisioner
the provisioner is a person is a company
we will buy the chips from from
microchip microchip will configure those
keys with your CA and your certificates
the private key is inside the public is
passed to you the provisioner will run
that script to put all the public keys
in device manager all the public keys
are put there the device are not even
created but all the public is already
there the device the crypto is passed on
the device burned on it the device wakes
up for the first time creates the jot
signs the drug with the crypto connects
to the broker the jar is verified we
already have the public keys there we're
all good to go it works so that's
basically doing that you've solved all
of your problems so it's really it's
really nice so why not TLS mutual law
why using jar instead first thing is you
achieve mutual authentication with dot
and TLS both so you will achieve the
same level authentication of
authentication and security with both
solution the benefit are that the TLS
attack is much smaller all you need is
establish the TLS session with the cloud
that's all you don't need to use the TLS
the mutual loss section of that stack
which make that stack much much smaller
for example we've gone from 150 200k
roughly to 10 K for the entire stacks
that's a big difference especially for
devices that often time have 32 K of
memory or 64 K of memory you can't put a
full TLS stack in it you have to use a
different solution this is what it
brings you you can bring as much smaller
stack the speed is faster because you
don't have to do that whole new
handshake and mutual off every time you
establish the TLS session all you have
to do is one TLS boom username password
you're done it's much faster less
consuming in bandwidth there's no
dependency on the TLS stack you use you
do not have to use a special TLS stack
that's optimized that has mu2 alot
optimized and all that you can use any
TLS tack you want open source ones are
very good because the only thing you use
is the TLS session with your cloud so
that's less dependent if you have to
update the TLS stack at some point from
one point two to one point three for
example your code is not dependent on
that tli stack the fact that you use a
crypto is not dependent on that TLS tag
so the upgrade of the TLS that gets much
easier much less risk much less testing
to be done supports crypto because your
code does it not the TLS stack no
dependency again the ease of evolution
or the stack as I said there's no no
validation of your code your code
doesn't change you can change the tear
cycle you want your car's gonna be the
same it's gonna generate the dot sign it
put it as a password in MQTT Connect
very easy and then how do you support
multiple certificate here with card IT
core you can use up to 3 certificate so
3 public keys per device Valley public
keys per device so what you'll do is you
have your public key you want to rotate
it you'll create a second public key
you'll put it there you will relent ik 8
you will also enjoy with the first one
download you know all the information
you need for using the second key then
rotate because both can be used at the
same time and then you'll invalidate the
first one so you could do those rotation
up to 3 keys at the same time and you
could do those rotation very easily it's
much harder to do with the material off
because the TLS tag has to know where
the certificates are etc because you're
again dependent on the TLS tag so by
using the Judd
touken and the signature with IOT core
you're simplifying your life a whole
bunch versus TLS mutual love for bigger
devices there's an added layer security
that you can use for MCU class devices
you'll have to use whatever you know
Mongoose OS or Express logic or any of
the know zephyr from the Linux
Foundation you should have used some of
those but for larger devices that have
CPU class processors you can use Android
things Android things is the optimized
version of Android for devices it is a
secure OS from the ground up it is a
full OS we will provide we as the Google
will provide secure patches OS updates
like we would do on your phone if you
have an Android phone you get all those
updates you don't have to really think
about it versus if you have a linux
server for example in the cloud and when
the updates are available you have to go
patch and update and maintain and test
all that we do all that for you with
Android things so you do not have to
manage those those environments on your
own Google will provide you the firmware
update that the OS update the security
patches and the infrastructure to deploy
those though those patches to the
devices through the same back-end that
actually deploys updates to your Android
phones it's a very battle tested back in
those update processes have been used
millions hundreds of millions of times
already it's a very secure way to send
those updates very secure way to have an
OS that you don't have to worry about
other benefits you can use Android
developers to build apps on Android
things it's the same IDE same language
same same everything it's really the
same as an Android device very easy to
deploy an application you can run
tensorflow models on android thing so
run machine learning intelligence on the
edge and you also have the cloud IOT
connectivity as part of the u.s. so you
can communicate with cloud IOT core in
the cloud iot platform very easily by
using android things so it's a good
option the only downside of android
things it's you have to use certified
some
so system on modules certified hardware
that we have tested and validated to
work with Android things so we have
relationship with Qualcomm we then XP
with arm I believe some others I can't
remember exactly the full list but we
have a bunch of modules like that and
you can use and those are the only
approved hardware or some that can be
used by anything so the only downside so
if it's possible for you to choose one
of those everything is a great option
otherwise you'd have to revert to
something else and I believe that's
about it if you want to know more about
cada ot you can go in that simple URL
cloud google.com slash IOT you'll find
no sample code you'll find example
documentation a little bit of an
overview of the infrastructure I invite
you to come to next it's in a couple
weeks that's something you really want
to see there's gonna be a lot of IOT
talks over there and that's about it so
stay tuned for the live Q&A we'll be
back in less than a minute
you
hey welcome back for the Q&A around the
security and IOT so we have a few
questions from the audience here so I
just look at that I like the use of a
hardware root of trust but many of our
customers don't have that in their
current design what can they do that's a
good question because I was emphasizing
you know the use of hardware and it's
true there's a lot of harder out there
that don't have root of trust so how do
we handle that so as if you're at first
you don't have to use the root of trust
you can still connect to IT core and
benefit from the jaw authentication from
the independence on the TLS stack and
all the security of the backend so
that's let's put it that way you can
still use a clarity core without the
root of trust that's totally fine if you
don't have one but you want to add one
to your design there's several ways to
do that those little crypto I showed you
that the microchip point for example use
it I Square C as a protocol to
communicate with node in the rest of the
board the PCB it's on of course is very
common on most devices and you'll find a
lot of retrofit hardware that you can
add to an I square C bus on the hardware
either through a hat that you plug in
there's a nice hat that exists on for
PI's for example as an example put a hat
it has the crypto on it you can use that
to retrofit design and the cool thing
about I square C is you can do it hot so
you don't have to shut down the device
that's pretty close you just add that
crypto to existing devices other
customers I've seen doing is they use
communication chips so for example you
have a device that's not connecting like
a manufacturing you know a PLC on a
manufacturing line that is not connected
to the Internet they'll add a
communication module and inside that
communication module like a Wi-Fi or
Ethernet you'll have a crypto already in
there that you can start using and
actually the encryption is all dealt by
the communication devices itself not the
MCU not the MCU or the CPU so that's a
great way to also retrofit without
touching the existing design just add
the communication chip
Wi-Fi internet whatever serial and then
add the crypto that has the crypto
embedded in it so that there are ways to
do that it's mostly a retrofit world but
it's easy to retrofit because of the
ICRC Committee
that's a very standard another question
it still seems like the best way to
secure devices is changing changing
devices I assume should we wait until is
there any reason for the customers to
hold off any longer
so I think the question here is more
around we need to change everything to
be secure but I don't think that's a
good I think you shouldn't you shouldn't
hold off I think you know if you're
doing a design today if you put a
hardware route of trust on it if you put
a little creek though you're basically
future proof you'll be able to update
that hardware address if you need you'll
be able to rely on that hardware route
of trust to do a lot of security
improvement like irritation new
generation of certificates validation of
boot firmware images and all of that so
there's no and there's no reason to wait
I think overall the security is there
it's a matter of implementing it and
we've seen that it could be complicated
but with a solution with IOT core with
the hardware root of trust in the
partnership with microchip for example
the those things are very much solved
and there is solutions for security
today and you shouldn't wait you
shouldn't wait you can be secure pretty
easily today if with the solutions we
have out there so there's no reason to
wait in terms of Christ you said sub $1
this is still very expensive for small
devices are there ways to lower this
cost so yes about its sub dollar and it
depends on on the volume obviously but
it's not it's not over $1 depends on
volume so I would say you know if you're
looking at low-cost devices you know
people that have bombs that are now
maybe 20 30 bucks or even less that
means you're already looking often time
at fairly high volumes because otherwise
you can't get those bombed down and that
means that you're gonna get volume
discounts as well on those chips so
you'll be way lower than $1 so that's
what this one thing to know if you have
volume you know sub dollars as a
guidance but you get volume discounts on
that the other thing is you have to
think about the cost holistically it's
not just the cost of the bomb it's what
it saves you
Manufacturing cost in maintenance in no
reputation cost a dollar amount lost
through a hack that could happen and the
ease of maintaining that over time
there's a ton of costs maintaining
things over time maintaining things
secure over time that this little crypto
sub dollar will solve for you and to in
my opinion it is well worth it to spend
that the bomb will be a little higher
for your devices but it's so much
cheaper overall holistically then you
know then you can you can really see or
get without it there are other questions
and this coming up okay so I mean well
stay tuned for the next session we have
a siege at efficiently migrating data
into the Google cloud platform which
should be pretty interesting thank you