Smart Cities

The Vulnerability of Things & the Need for Lightweight Encryption in Smart Devices

The Internet of Things (IoT) in smart buildings, homes, and cities has triggered a digital revolution for the built environment. Billions of sensors and devices now transmit real-world data to cloud computing systems in order to help us understand the physical world in quantifiable digital terms. IoT data is often sensitive in terms of privacy and security, however, and small IoT devices often lack the electrical or computational power to support sophisticated security protocols. This creates a “vulnerability of things” that could turn the IoT into a danger for society and undermine the promising digital revolution in the built environment. “Over the coming years, billions of additional IoT devices and sensors are slated to come online. However, users now realize that these devices are not designed with cybersecurity in mind,” says Michel Girard, a senior fellow at the Centre for International Governance Innovation. “Minimum CPU and memory capacity are needed for users to manage and […]

Stay ahead of the pack

with the latest independent smart building research and thought leadership.

Have an account? Login

Subscribe Now for just $200 per year per user (just $17 USD per month) for Access to Quality Independent Smart Building Research & Analysis!

What Exactly Do you Get?

  • Access to Website Articles and Notes. Unlimited Access to the Library of over 1,700 Articles Spanning 10 Years.
  • 10% discount on ALL Memoori Research reports for Subscribers! So if you only buy ONE report you will get your subscription fee back!
  • Industry-leading Analysis Every Week, Direct to your Inbox.
  • AND Cancel at any time
Subscribe Now

The Internet of Things (IoT) in smart buildings, homes, and cities has triggered a digital revolution for the built environment. Billions of sensors and devices now transmit real-world data to cloud computing systems in order to help us understand the physical world in quantifiable digital terms. IoT data is often sensitive in terms of privacy and security, however, and small IoT devices often lack the electrical or computational power to support sophisticated security protocols. This creates a “vulnerability of things” that could turn the IoT into a danger for society and undermine the promising digital revolution in the built environment.

“Over the coming years, billions of additional IoT devices and sensors are slated to come online. However, users now realize that these devices are not designed with cybersecurity in mind,” says Michel Girard, a senior fellow at the Centre for International Governance Innovation. “Minimum CPU and memory capacity are needed for users to manage and maintain IoT devices and keep them cybersafe. The breakneck speed of innovation, the intense competition between vendors to capture new markets, and the absence of safety and security regulations with respect to internet-related technologies have contributed to the current situation. As a result, every region of the globe has witnessed IoT cybersecurity breaches.”

Our latest assessment of the number of connected devices in operation in the commercial smart building’s vertical is for the installed base of connected devices to grow from 1.7 Billion in 2020 to just under 3 Billion by 2025 representing a CAGR of 10.8%. Meanwhile, malicious “PowerShell” scripts on IoT endpoints increased 1,000% in 2018 according to Symantec. Attacks on IoT devices tripled in the first half of 2019, according to CSO Online, who warn that the increased bandwidth of connected devices brought about by 5G will further increase IoT vulnerability. And, according to Cisco, the total number of IoT-based DDoS attacks worldwide will reach 15.4 million by 2023.

As connected devices play increasingly more pervasive and important roles of our lives, IoT cybersecurity issues become catastrophes waiting to happen. The unavoidable lack of computing capacity in these small, low-cost, low-power devices requires us to take an entirely new approach to cybersecurity, one that doesn’t depend on computing power but instead creates security while embracing the limitations of small but numerous IoT devices. That has become the focus of significant research in recent years as the growing problem begins to get the attention it deserves in academic and industry research.

“The things in the IoT environment are constrained due to the limited battery life, size, and computation, therefore, they cannot support the existing security solutions. The traditional cryptography algorithms and security schemes are insufficient for the ever-evolving IoT applications which require scalable and robust solutions,” explains a paper by Muhammad Usman of Chosun University in South Korea. “This requires the development of novel designs and architectures to effectively deal with the security and privacy issues suitable for the resource-constrained devices in the IoT. The resource-constrained devices in the IoT cannot utilize state-of-the-art encryption algorithms, thus the development of lightweight encryption algorithms is indispensable.

One of the many companies striving to provide lightweight encryption for IoT devices is Polish startup Cyberus Labs. Founded in 2016, the Katowice-based startup has created a password-free solution designed to provide secure authentication and communication encryption using one-time-use tokens to authenticate both human users and smart devices. The cloud-based human-to-machine element of the authentication is built around sound, where a sonic signal is simply sent from one device to another, without the need for actionable credentials like passwords. Cyberus are set to launch a lightweight encryption solution in 2021 that will be available as a downloadable version on the Microsoft Azure Marketplace platform.

“Today, 80% of all data traffic between smart devices is unprotected. I think this will be one of the biggest challenges and one of the biggest investment opportunities in cybersecurity because we don’t have another choice,” says Marek Ostafil, cofounder of Cyberus Labs. “One of the biggest mistakes we’ve made was continuing using compromised authentication systems based on passwords in the world of IoT. Machine-to-machine authentication of billions of devices has been based on passwords. Right now there is a little bit of panic trying to figure out how to protect all this mess,” he added. “We’re not trying to build another wall of the fortress. We just eliminated the weakest element.”

Due to the large variety and heterogeneity of IoT devices and the security objectives of the applications using them, lightweight cryptographic algorithms for the IoT have proved challenging, however. Difficulties exist, both in terms of providing adequate security and in relation to the impact on device performance, necessitating significant compromises versus the cybersecurity levels we are used to in larger, more powerful devices. Such compromises may, therefore, limit the type of applications that we can apply IoT devices to in the long-term, at least until a secure lightweight solution is developed.

An experimental 2020 study, conducted by researchers from the University of Ulster and Manchester Metropolitan University, evaluated several legacy encryption/decryption techniques and compare them with more recently proposed lightweight techniques. The results clearly show that the hardware-oriented lightweight techniques perform significantly worse than the legacy techniques when they are implemented in software. Developers of IoT security systems, therefore, need to be mindful of the type of platform that a candidate encryption/decryption technique was developed for.

The IoT still represents the future, a future where the lines between the physical and digital worlds are blurred to create a data-rich, efficient, and intuitive connectivity-enabled new reality. However, unless we can solve the severe cybersecurity issues associated with the IoT, the continued proliferation of smart devices could have a severe impact on our built environment. We have waited too long to take this problem seriously but innovations by various companies now give us hope that the IoT future we have been promised can be secured.

Most Popular Articles

Witco Acquisition
Smart Buildings

Consolidation in the Workplace Experience Market as Witco Acquires SharingCloud

This Research Note examines what’s behind Witco’s latest move to acquire SharingCloud. We review the deal in the context of the startup’s development, funding, prior acquisitions, and strategy. Witco Profile Witco, a Parisian startup was founded in 2016 as MonBuilding, serving the French and Canadian enterprise market for workplace engagement apps. After raising 2 million […]

Axis Communications Financials 2023
Security

Axis Communications Video Surveillance Business & 2023 Financials Examined

In this Research Note, we examine the Axis Communications video surveillance business. This analysis is based on Canon’s 2023 Results Presentation 30 January 2024, Axis Communications 2023 Sustainability Report, 22 May 2024, and Memoori analysis. Founded in 1984 with headquarters in Lund, Sweden, Axis Communications offers products and services for video surveillance and analytics, access […]

Complimentary Article You Can't Design a Truly Smart Building Without Human Resources!
Smart Buildings

#Podcast 31: You Can’t Design a Truly Smart Building Without Human Resources!

In our Podcast series “Sh*t You Wish Your Building Did!”, Memoori explores the intersection between technology and commercial buildings through interesting conversations. For Episode 31, we were joined by Tomás Mac Eoin from Master Systems Integrator (MSI) Hereworks to Discuss their Swift HR Concept. The Swift HR concept envisions a cross-functional team, led by Human […]

Subscribe to the Newsletter & get all our Articles & Research Delivered Straight to your Inbox.

Please enter a valid email

Please enter your name

Please enter company name

By signing up you agree to our privacy policy