{"id":655,"date":"2020-01-15T17:16:27","date_gmt":"2020-01-15T17:16:27","guid":{"rendered":"https:\/\/blog.pufsecurity.com\/?p=655"},"modified":"2022-04-06T05:37:55","modified_gmt":"2022-04-06T05:37:55","slug":"is-blockchain-the-silver-bullet-of-iot-security","status":"publish","type":"dlp_document","link":"https:\/\/www.pufsecurity.com\/zh-hant\/document\/is-blockchain-the-silver-bullet-of-iot-security\/","title":{"rendered":"Is Blockchain the Silver Bullet of IoT Security?"},"content":{"rendered":"\n
<\/p>\n\n\n\n
Blockchain has been proposed as a \u201cTrusted Mechanism\u201d for crypto-currency, asset transfer and distributed computing without centralized servers\/databases and the needs of trusted intermediaries \/ third parties. Since IoT devices are typically autonomous, distributed, unsupervised, and physically exposed, therefore it seems logical that Blockchains and IoTs are good matches. <\/p>\n\n\n\n
<\/p>\n\n\n\n
However, there is always a price to pay in adopting any new technology as an industrial solution and Blockchain is no exception! While the incorporation of Blockchain into IoT solutions introducing both a distributed ledger for managing ownership of digital assets as well as a generator for cryptographic proofed transaction data to ensure IoT data provenance, quality, and security, there are many challenges of deploying Blockchains in IoT security. The challenges include <\/p>\n\n\n\n
<\/p>\n\n\n\n
\u201c Proof-of-Work\u201d in Blockchains are computationally expensive with limited efficiency and the requirements of increased storage capacity for ever growing Blockchain ledger, etc. <\/p>\n\n\n\n
<\/p>\n\n\n\n
Consequently, Blockchain is not a panacea for IoT security and there are business applications of IoT which may not be suitable to adopt Blockchain for security solution. Therefore, \u201cTo use or not to use Blockchain for IoT security\u201d is a germane question to ask and an important decision to make for every stake holder who is involved in IoT security. <\/p>\n\n\n\n
<\/p>\n\n\n\n
In this column, after a brief introduction we first discuss the importance of providing highly scalable data integrity and authentication down to the hardware\/chip level for IoT security. Next, we discuss securing IoT with Blockchain and the pros & cons as well as the challenges of deploying Blockchain in IoT. Third, we discuss the suitability of adopting Blockchain to protect both IoT security and privacy for certain mission critical IoT applications. At end, we conclude that after using Blockchain for IoT, we still need a hardware-assisted Blockchain (e.g., PUF + Blockchain) to provide a robust and sustainable security for both IoT devices and IoT data. <\/p>\n\n\n\n
<\/p>\n\n\n\n
<\/p>\n\n\n\n
<\/p>\n\n\n\n
Per IBM [1], there are three key benefits of using Blockchain for IoT, namely 1) Build trust, 2) Reduce costs, and 3) Accelerate transactions. Technically speaking Blockchain and IoT are good matches because IoT applications are by definition distributed and Blockchain is designed as a basis for applications that involve transactions and interactions to provide useful functions such as: 1). Alternative to central authority and centralized databases, 2). Allowing a group of connected computers to maintain a single distributed, updated and secure\u202fledger through the use of peer-to-peer (device-to-device) interaction, 3). Establishing Trust through immutable, time-stamped records and providing useful device security (e.g., ensuring data provenance, and data non-forgeability). <\/p>\n\n\n\n
<\/p>\n\n\n\n
However, there is no free lunch in adopting any new technology for IoT and Blockchain is no exception! While the incorporation of Blockchain into IoT solutions could introduce both a distributed ledger for managing ownership of digital assets and a generator for cryptographic proofed transaction data to ensure IoT data provenance, quality, and security, there are many challenges of deploying Blockchains in IoT security. The challenges include \u201c Proof-of-Work\u201d in Blockchains are computationally expensive with limited efficiency and the requirements of increased storage capacity for ever growing Blockchain ledger, etc. <\/p>\n\n\n\n
<\/p>\n\n\n\n
Although superficially the distributed Internet of Things (IoT) meets Distributed Ledger Technology (Blockchain) quite well, when compared to traditional centralized databases, Blockchains are inefficient and require increased storage capacity. Consequently, Blockchain is not suitable to provide IoT security for all business applications of IoT. Therefore, \u201cTo use or not to use Blockchain for IoT security\u201d is a germane question to ask and an important decision to make for every stake holder who is involved in IoT security. <\/p>\n\n\n\n
<\/p>\n\n\n\n
<\/p>\n\n\n\n
<\/p>\n\n\n\n
IoT refers to uniquely identifiable objects and their virtual representations in an Internet-like structure. In IoT, tens, hundreds or thousands of novel innovative, connected devices have emerged to interconnect and interact with one another in every sector to improve the quality of our lives in every area. IoTs typically have access to sensitive, personal information, and they also introduce a wide variety of new security issues for attackers to exploit including connecting new Internet capable devices, like TVs, home security systems, automation. Also, lot of IoT sensors and\/or end-devices generate massive privacy or confidential data, thus the confidentiality or privacy threats are real. IoT devices are distributed, unsupervised, and physically exposed. Therefore, attackers can physically tamper with IoT devices which makes software-only protections inadequate and ineffective to deal with such attacks. Furthermore, IoT threats & attacks rely on well-known security weaknesses such as unpatched software, weak or default passwords, insecure boot, insecure update & upgrade, etc. Generally speaking, the integrity and denial-of-service (DoS) threats are much worse and more devastating in IoT and IoT systems are also very vulnerable to integrity and DoS attacks. <\/p>\n\n\n\n
<\/p>\n\n\n\n
Securing distributed IoT networks requires verifying the authenticity of data and identities of devices. IoT needs an effective and efficient encryption to provide secure communication between IoT nodes. It also needs to use cryptographic protocols based authentication and attestation that require unique, randomly generated, and closely guarded cryptographic keys for each IoT device. However, IoT devices are not designed with security in mind. For example, there is lack of encryption and other security safeguards deployed in home automation hubs that could facilitate burglary, stalking, and spying. Furthermore, IoT relies on microcontrollers with limited memory and computational power at end-devices which makes key generation and storage problematic in IoT systems. <\/p>\n\n\n\n
<\/p>\n\n\n\n
To sum up, since software-based security is insufficient to protect IoT from fraud, tampering and other integrity and DoS attacks, it is important to provide a hardware-assisted Blockchain (e.g., PUF + Blockchain) for robust, sustainable and simultaneous device and data security in IoT [8]. <\/p>\n\n\n\n
<\/p>\n\n\n\n
<\/p>\n\n\n\n
<\/p>\n\n\n\n
A Blockchain originally called block chain, is a growing list of records, called blocks, that are linked using cryptography. Blockchain basics can be found in [2,3,4]. <\/p>\n\n\n\n
<\/p>\n\n\n\n
The key components used in blockchain are depicted as follows: <\/p>\n\n\n\n
<\/p>\n\n\n\n
A possible working scenario for IoT Blockchain could be proposed as follows similar to the one given in [4]: <\/p>\n\n\n\n
<\/p>\n\n\n\n
The pros and cons of Blockchain have been discussed extensively in the open literatures [5,6,7]. Below is a synopsis of the pros, cons and the challenges of securing IoT with Blockchain: <\/p>\n\n\n\n
Pros<\/strong>: <\/p>\n\n\n\n Cons:<\/strong><\/p>\n\n\n\n Challenges<\/strong>: Superficially Blockchains and IoTs are good matches purely based on their distributed nature, however, there are still many challenges of deploying Blockchains in IoT security. The challenges can be summarized as follows [9,10,11,12]: <\/p>\n\n\n\n <\/p>\n\n\n\n <\/p>\n\n\n\n <\/p>\n\n\n\n As discussed in the previous section, there are many challenges that need to overcome before Blockchain could be successfully deployed in IoT security. In general, most IoT\u202fnetworks consist of lightweight, low-power devices, and the potential to generate the levels of energy and processing power required for deploying Blockchain are often limited or expensive. Therefore, this presents a major drawback to the use of Blockchain in IoT [13]. However, recently there is progress in the space of IoT-optimized Blockchain\u202fsolutions demonstrates the clear potential for Blockchain\u202fto help secure the IoT [14]. In [14], a lightweight instantiation of a Blockchain particularly geared for use in IoT for Smart Home by eliminating the Proof-of-Work (POW) and the concept of coins. They proposed an online, high resource device, known as \u201dminer\u201d that is responsible for handling all communication within and external to the home. At the end, they presented simulation results to highlight that the overheads (in terms of traf\ufb01c, processing time and energy consumption) introduced by their approach are insigni\ufb01cant relative to its security and privacy gains. <\/p>\n\n\n\n <\/p>\n\n\n\n Both [13,14] presented encouraging news on the progress of deploying Blockchain in IoT security, however there are still lot of work to be\u202fdone to research an effective, efficient, resilient and trusted approach to deploy Blockchain for the mission critical IoT networks like Internet of Vehicles (IoV), Smart Grid, or Smart City applications.<\/p>\n\n\n\n <\/p>\n\n\n\n <\/p>\n\n\n\n <\/p>\n\n\n\n It is generally agreed that Blockchain is not a panacea to solve all the security issues in the\u202fIoT and there are several technical stumbling blocks or security challenges which need to be overcome by each IoT network before\u202fBlockchain could become a viable security solution. <\/p>\n\n\n\n <\/p>\n\n\n\n The transaction validation process by traditional POW involves significant amounts of energy and computational power to process the\u202fauthentication, access to a network of independent\u202fnodes, and delays as each block in the chain is authenticated by those decentralized nodes. Furthermore, each IoT Blockchain node replicates and stores a copy of a synchronized distributed ledger database which grows in size with time when more and more transactions are processed. All of these stumbling blocks underline the need of an IoT-optimized Blockchain\u202fsolutions to facilitate the use of Blockchain for IoT security. Finally, an IoT-optimized Blockchain also needs to use cryptographic protocols based authentication and attestation that require unique, randomly generated, and closely guarded cryptographic keys (i.e., HRoT or PUF) for each IoT device. <\/p>\n\n\n\n <\/p>\n\n\n\n Consequently, we concluded that it is both necessary and sufficient to have a hardware-assisted Blockchain (e.g., PUF + Blockchain) to provide a robust and sustainable security for both IoT devices and IoT data. <\/p>\n\n\n\n <\/p>\n\n\n\n <\/p>\n\n\n\nThe suitability of deploying Blockchain for IoT security and privacy<\/strong> <\/h2>\n\n\n\n
Conclusion<\/strong> <\/h2>\n\n\n\n
Reference<\/strong> <\/h2>\n\n\n\n