Internet of things: new security and privacy challenges

The Internet of Things, an emerging global Internet-based technical architecture facilitating the exchange of goods and services in global supply chain networks has an impact on the security and privacy of the involved stakeholders. Measures ensuring the architecture’s resilience to attacks, data authentication, access control and client privacy need to be established. An adequate legal framework must take the underlying technology into account and would best be established by an international legislator, which is supplemented by the private sector according to specific needs and thereby becomes easily adjustable. The contents of the respective legislation must encompass the right to information, provisions prohibiting or restricting the use of mechanisms of the Internet of Things, rules on IT-security-legislation, provisions supporting the use of mechanisms of the Internet of Things and the establishment of a task force doing research on the legal challenges of the IoT. a 2010 Prof Rolf H. Weber. Published by Elsevier Ltd. All rights reserved. 1. Internet of Things: notion and technical primarily RFID-tagged items (Radio-Frequency Identificabackground The Internet of Things (IoT) is an emerging global Internetbased information architecture facilitating the exchange of goods and services in global supply chain networks. For example, the lack of certain goods would automatically be reported to the provider which in turn immediately causes electronic or physical delivery. From a technical point of view, the architecture is based on data communication tools, Internet of Things – Need k and locate assets; the u Kevin Ashton in a prese , From Internet of Data to onference-lux_en.pdf). ackground of the IoT see ternet of Things, Berlin/H k/London 2008. vices for the Internet of ting see Davy Preuvene a note 4, 288, at 296 ss. olf H. Weber. Published b tion). The IoT has the purpose of providing an IT-infrastructure facilitating the exchanges of ‘‘things’’ in a secure and reliable manner. The most popular industry proposal for the new IT-infrastructure of the IoT is based on an Electronic Product Code (EPC), introduced by EPCglobal and GS1. The ‘‘things’’ are physical objects carrying RFID tags with a unique EPC; the infrastructure can offer and query EPC Information Services (EPCIS) both locally and remotely to subscribers. The for a New Legal Environment? [2009] 25 Computer Law & Security niversal, unique identification of individual items through the EPC ntation in 1998 (see Gerald Santucci, Paper for the International Internet of Things, at p. 2, available at: ftp://ftp.cordis.europa.eu/ Christian Floerkemeier/Marc Langheinrich/Elgar Fleisch/Friedeeidelberg 2008; Lu Yan/Yan Zhang/Laurence T. Yang/Huansheng Things, Thesis, Berlin 2008, 30/31; to the details of the service ers/Yolande Berbers, Internet of Things: A Context-Awareness y Elsevier Ltd. All rights reserved. c o m p u t e r l a w & s e c u r i t y r e v i e w 2 6 ( 2 0 1 0 ) 2 3 – 3 0 24 information is not fully saved on an RFID tag, but a supply of the information by distributed servers on the Internet is made available through linking and cross-linking with the help of an Object Naming Service (ONS). The ONS is authoritative (linking metadata and services) in the sense that the entity having – centralized – change control over the information about the EPC is the same entity that assigned the EPC to the concerned item. Thereby, the architecture can also serve as backbone for ubiquitous computing, enabling smart environments to recognize and identify objects, and receive information from the Internet to facilitate their adaptive functionality. The central ONS root is operated by the (private) company VeriSign, a provider of Internet infrastructure services. The ONS is based on the well-known Domain Name System (DNS). Technically, in order to use the DNS to find information about an item, the item’s EPC must be converted into a format that the DNS can understand, which is the typical, ‘‘dot’’ delimited, left to right form of all domain names. Since EPC is encoded into syntactically correct domain name and then used within the existing DNS infrastructure, the ONS can be considered as subset of the DNS. For this reason, however, the ONS will also inherit all of the well-documented DNS weaknesses, such as the limited redundancy in practical implementations and the creation of single points of failure. 2. Security and privacy needs 2.1. Requirements related to IoT technology The described technical architecture of the IoT has an impact on the security and privacy of the involved stakeholders. Privacy includes the concealment of personal information as well as the ability to control what happens with this information. The right to privacy can be considered as either 7 Fabian, supra note 6, at 33. 8 EPCglobal, Object Naming Service (ONS) Version 1.0.1, at para 4.2, available at: http://www.epcglobalinc.org/standards/ons/ ons_1_0_1-standard-20080529.pdf. 9 Fabian, supra note 6, at 1. 10 EPCglobal, Object Naming Service (ONS) Version 1.0.1, supra note 8, at para 5.2. 11 For more details see Weber, supra note 1. 12 Seda F. Gürses/Bettina Berendt/Thomas Santen, Multilateral Security Requirements Analysis for Preserving Privacy in Ubiquitous Environments, in: Bettina Berendt/Ernestina Menasalvas (eds), Workshop on Ubiquitous Knowledge Discovery for Users (UKDU ’06), at 51–64; for privacy as freedom see Gus Hosein, Privacy as Freedom, in: Rikke Frank Jørgensen (ed.), Human Rights in the Global Information Society, Cambridge/Massachusetts 2006, at 121–147. 13 Gürses/Berendt/Santen, supra note 12, at 54. 14 See also Ari Juels, RFID Security and Privacy: A Research Survey, IEEE Journal on Selected Areas in Communications, Vol. 24, 2006, 381–394, at 383; Marc Langheinrich Marc/Friedemann Mattern, Wenn der Computer verschwindet, digma 2002, 138–142, at 139; Friedemann Mattern, Ubiquitous Computing: Eine Einführung mit Anmerkungen zu den sozialen und rechtlichen Folgen, in: Jürgen Taeger/Andreas Wiebe (eds), Mobilität. Telematik, Recht, Köln 2005, 1–34, at 18 s. a basic and inalienable human right, or as a personal right or possession. The attribution of tags to objects may not be known to users, and there may not be an acoustic or visual signal to draw the attention of the object’s user. Thereby, individuals can be followed without them even knowing about it and would leave their data or at least traces thereof in cyberspace. Further aggravating the problem, it is not anymore only the state that is interested in collecting the respective data, but also private actors such as marketing enterprises. Since business processes are concerned, a high degree of reliability is needed. In the literature, the following security and privacy requirements are described: Resilience to attacks: The system has to avoid single points of failure and should adjust itself to node failures. Data authentication: As a principle, retrieved address and object information must be authenticated. Access control: Information providers must be able to implement access control on the data provided. Client privacy: Measures need to be taken that only the information provider is able to infer from observing the use of the lookup system related to a specific customer; at least, inference should be very hard to conduct. Private enterprises using IoT technology will have to include these requirements into their risk management concept governing the business activities in general. 2.2. Privacy enhancing technologies (PET) The fulfilment of customer privacy requirements is quite difficult. A number of technologies have been developed in order to achieve information privacy goals. These Privacy Enhancing Technologies (PET) can be described in short as follows: Virtual Private Networks (VPN) are extranets established by close groups of business partners. As only partners have access, they promise to be confidential and have integrity. However, this solution does not allow for a dynamic global information exchange and is impractical with regard to third parties beyond the borders of the extranet. Transport Layer Security (TLS), based on an appropriate global trust structure, could also improve confidentiality and integrity of the IoT. However, as each ONS delegation step 15 Mattern, supra note 14, at 24. 16 See Benjamin Fabian/Oliver Günther, Distributed ONS and its Impact on Privacy, 1223, 1225, available at: http://ieeexplore.ieee. org/stamp/stamp.jsp?arnumber1⁄404288878. 17 For RFID authentication see Juels, supra note 14, at 384 s; Rolf H. Weber/Annette Willi, IT-Sicherheit und Recht, Zurich 2006, at 284. 18 See also Eberhard Grummt/Markus Müller, Fine-Grained Access Control for EPC Information Services, in: Floerkemeier/ Langheinrich/Fleisch/Mattern/Sarma, supra note 4, at 35–49. 19 Fabian, supra note 6, 61 s; Benjamin Fabian/Oliver Günther, Security Challenges of the EPCglobal Network, Communications of the ACM, Vol. 52, July 2009, 121–125, at 124 s. 25 Jürgen Müller/Matthias Handy, RFID als Technik des Ubiquitous Computing – Eine Gefahr für die Privatsphäre?, at 17, available at: c o m p u t e r l a w & s e c u r i t y r e v i e w 2 6 ( 2 0 1 0 ) 2 3 – 3 0 25 requires a new TLS connection, the search of information would be negatively affected by many additional layers. DNS Security Extensions (DNSSEC) make use of public-key cryptography to sign resource records in order to guarantee origin authenticity and integrity of delivered information. However, DNSSEC could only assure global ONS information authenticity if the entire Internet community adopts it. Onion Routing encrypts and mixes Internet traffic from many different sources, i.e. data is wrapped into multiple encryption layers, using the public keys of the onion routers on the transmission path. This process would impede matching a particular Internet Protocol packet to a particular source. However, onion routing increases waiting times and thereby