Overcoming four key IoT secure messaging challenges
BlogSeptember 29, 2016
David Ingham
Red Hat
THE OPEN SOURCE WAY BLOG. Secure, real-time communication technology is an essential requirement for military Internet of Things (IoT) solutions. There are numerous protocols for communication between IoT devices, and between the devices and back-end systems. Messaging solutions should be able to to support these various protocols across heterogeneous, physically distributed systems while enabling the security and integrity of information flows. They should also be highly scalable, able to accommodate potentially hundreds of millions of devices. And since delay or loss of data is not an option, they should feature strict availability and reliability requirements.
A standards-based messaging infrastructure with strong security is a critical component for successful deployments. Whether you are an architect designing a military IoT system, or are in the process of developing such a solution, a messaging strategy is essential to your current and future plans. Let’s take a look at some considerations regarding messaging and how it can impact the effectiveness of your IoT implementation.
We’ll begin by defining messaging for the IoT. Essentially, bi-directional messaging over a range of protocols is what makes the IoT possible. IoT is the term used to define a broad set of use cases where physical objects are connected to the internet or a network, sending data to be processed and analyzed to drive some immediate action and longer term value. This device-generated data is typically pushed into existing enterprise-grade systems and applications. Messaging infrastructure provides the connectivity among all these pieces in an IoT system – from devices to gateways to the enterprise and cloud.
There are four primary challenges to secure IoT messaging. Let’s take a look at each, and explore how they can be addressed.
Interoperability
Many agencies are running different devices, runtime environments, protocols and technologies, all of which need to be interoperable with each other. When defining the messaging requirements of an IoT system, one must consider the various messaging protocols that might be used in these environments. Consider that there are numerous messaging protocols (AMQP, MQTT, CoAP, etc.) being used in IoT systems today. Also, many IoT systems use multiple protocols within their architectures – where different devices and applications have different functional requirements and resource constraints. The messaging platforms and protocols used should be flexible in order to grow with IoT systems that are often in place for up to a decade or more.
Deployment environment
Edge networks or devices themselves may not be stable, or have limited resources. As a result, IoT networks can be less reliable and have high network transmission costs and constrained bandwidth. Any communications technology used to address IoT needs to be able to retain information when the network connection is lost, and use an efficient communications protocol to reduce overhead.
Scalability
What was adequate for enterprise messaging can’t scale to support most IoT use cases, so horizontal scale needs to be leveraged. But bandwidth constraints and high transmission costs, combined with the high volume of data being generated at the device level, can make it difficult to scale IoT systems.
There are two aspects of scalability to consider. It is critical that the entire system is designed in such a way that adding resources increases system capacity. A good example of this is sharding-capable messaging, where messaging traffic loads can be split across multiple messaging servers, each taking part of the load, and aiding in scalability. Since it may not be practical to increase the capacity of some resources (such as edge networks), it is also critical to be able to most efficiently use those resources so that they don’t restrict the ability to scale up the capacity of the overall system.
Security
Finally, security should be implemented throughout the end-to-end IoT architecture, as the devices and networks introduce new opportunities for malicious entry into the system. Secure messaging - with encryption, network layer security, authentication and authorization – should be a priority from early in the design phase of any IoT project.
Regardless of the protocol or messaging platform you select for your IoT architecture, there are some best practices that can help to enable the security of your end-to-end system. Let’s take a moment to examine each of these.
First, multi-tiered IoT architectures should be designed with security and integrity in mind from the outset. Measures can be taken to secure the messages sent and received at every step in the value chain: the devices and/or gateways should provide message payload encryption, and secured transport (whether for MQTT or AMQP for example).
In the network/transport tier, device identification and authentication are needed so that only trusted devices can send data. A certificate-based system using X.509 certifications, a Certificate Authority, and a unique signed certificate on each device is a good approach.
Finally, it is important to incorporate message decryption and checksum verification for secure transport. The previously mentioned X.509 certificates also manage the crypto keys. Note that encryption both hides the contents of messages as well as detects any changes to the message. Critical systems should consider redundancy and fail-soft or fail-over capabilities at all levels.
Open source messaging platforms can provide long-term support for your IoT environments. As many deployments of devices in IoT can last decades, there needs to be assurance of long-term supportability, security, and backward compatibility. Your messaging platform should address the need to move data asynchronously between sensors and control points using open standards-based messaging, and provide support for the protocols commonly used in IoT. And finally, it must meet the high-throughput low-latency and reliability requirements demanded by military-grade IoT environments.
For more thoughts on IoT, take a look at this blog on IoT security, and this one on IoT’s impact on military embedded systems.
