How blockchain can secure the IoT

The unprecedented distributed denial of service (DDoS) attack involving as many as 100,000 compromised devices in the Mirai botnet that nearly brought the internet to its knees in 2016 was a stark reminder of the sorry state of internet of things (IoT) security.

At the heart of the problem is the security architecture of the IoT, an inherently distributed client-server model that uses a central authority to manage IoT devices, along with all the data generated across an IoT network.

For IoT data to be trusted, all trust requests are aggregated into a single location, creating a single point of security intelligence that has, at times, compromised IoT security, leading to Mirai-style botnet attacks, according to Joseph Pindar, director for strategy in the CTO office at Gemalto, and co-founder of the Trusted IoT Alliance, a non-profit group that advocates the use of blockchain to secure IoT ecosystems.

In these attacks, IoT devices are unable to adapt their behaviour because they are not considered “smart” enough to make security decisions without the help of the central authority.

Pindar said blockchain removes this single point of decision-making that leads to failure, by enabling device networks to protect themselves in other ways, such as allowing devices to form group consensus about what is normal within a given network, and to quarantine any nodes that behave unusually.

The second aspect, he said, is to form trust in IoT data by enabling what he called the five digital security primitives: availability, auditability, accountability, integrity and confidentiality.

In blockchain, data is automatically stored in many locations and is always accessible to users. For auditability and accountability, a private, permission-based blockchain is used – where all users are authorised to access the network – and because all data stored on the blockchain is signed, each device is accountable for its actions.

For integrity, blockchain is, at its core, a public ledger of data entries – every deletion or correction of data is entered – and as the entries are confirmed by the network, a complete chain of events is created, said Pindar.

Blockchain is already being used in industries such as retail, where blockchain startup BitSE’s Vechain platform is being used to demonstrate the provenance of high-value goods, including premium wines and Louis Vuitton handbags, to Chinese consumers who have a particular need to understand the authenticity of goods.

Pindar also gave the example of San Francisco-based Chronicled, which has applied blockchain to pharmaceutical supply chains to ensure tailored gene therapy drugs are delivered to the right person.

“By utilising a secure IoT platform, they are also able to attest to the quality levels of the drugs and to ensure that these drugs do not fail during the supply process, which could impact the efficacy when taken by the patient,” he said.