PKI: The Security Solution for
the Internet of Things

PKI: THE SECURITY SOLUTION FOR THE INTERNET OF THINGS

Table of Contents
1
1
2
4
7
8

Executive Summary
The Emergence of the Internet of Things
Security Risks in Networked Devices
PKI’s Foundation of Strong Security
Example PKI IoT Deployments
PKI is the Solution for IoT Security

PKI: THE SECURITY SOLUTION FOR THE INTERNET OF THINGS

Executive Summary
In 1982, a compromised software that controlled pumpspeeds and valve settings deployed, making pressures in theTrans-Siberian Pipeline skyrocket. This resulted in a huge

1and Electronics Engineers points out, “When you’re looking
at authenticating devices, the only real standards at the
moment that offer any real interoperability tend to be Public
Key Infrastructure (PKI).”

three-kiloton, non-nuclear explosion so big that it was seen

Gartner touts PKI as a leading choice for information andfrom space.

communication security because of the inherent flexibility

Today, companies are deploying billions of Internetconnected devices into mission-critical systems. Mass
deployment results in security risks with implications thatgrow with the number of deployed devices. Bad actors

and wide range of applications. PKI delivers the essential
authentication and encryption components needed by the
IoT for data security, making it a proven solution and marketready platform for IoT device security today.

can easily compromise and misuse unsecured devices forThis white paper will discuss security challenges

nefarious purposes.

IoT providers face, the crucial need to secure communication

Public Key Infrastructure (PKI) is the foundation of securing
Internet of Things (IoT) devices. As an accepted and wellestablished standard, PKI is a core component of data
confidentiality, information integrity, authentication, and data
access control. PKI is the foundation required to secure thecommunication between IoT devices and platforms.
Securing the IoT is dependent on ensuring the proper
security development and deployment that incorporates
the three key elements of trust: core device security, dataand personal privacy, and adherence to standards andcritical maintenance.

in IoT ecosystems, and that PKI is the tried-and-true
technology solution for authenticating and encrypting
device communication.

The Emergence of theInternet of Things
The IoT is transforming the world we live in. IoT is often
defined as a network of physical objects that can interact
with other Internet-enabled systems and devices to share
information and perform actions based on manual user
input or an automated controlling system. IoT promisesinterconnected systems, data, and devices between the

Ensuring that IoT solutions and projects meet these key trust

physical world and the online world for increased efficiency

elements is not only important for today’s threat landscape,and business growth, as well as improved quality of life.

but also for the future product and service lifecycle

IoT is expected to offer advanced connectivity of devices,challenges, which would otherwise inhibit the future successsystems, and services that goes beyond machine-to-machineof these solutions.

communications (M2M) and covers a variety of protocols,

PKI is uniquely positioned to deliver on the necessary andcritical security needs of the IoT. The Institute of Electrical

domains, and applications.

PKI: THE SECURITY SOLUTION FOR THE INTERNET OF THINGS

2

Recent reports by Gartner estimate that there are more thanA number of vertical markets are already integrating

2.9 billion networked IoT devices available to consumers inconnected devices into processes, infrastructures, andsmart environments today. Factor in smart devices in use for

workflows contributing to what we call the “Internet

corporate, medical, or non-traditional smart industries andof Everything.”

the number of Internet-connected devices in use today ismuch bigger.

Connected devices range from smart heart-monitoring
devices, wireless insulin pumps, biochip implants for plants
and animals, built-in sensors for automobiles, to smart
appliances. The connection between these embedded

IOT OFFERS A POTENTIAL ECONOMIC IMPACT OF$4 TRILLION TO $11 TRILLION A YEAR IN 2025

devices (including smart objects) will usher in automation
for nearly all fields while also enabling advanced applications
like a smart grid, and expanding into areas, and expanding
into areas, e.g., smart cities, etc. McKinsey estimates that IoT
has a total potential economic impact of $3.9 trillion to $11.1
trillion per year by 2025.
As the number of networked devices continues to grow,the capabilities of IoT systems will diversify the type of
networked devices, requiring better security as we bringconnectivity, transportation systems, energy infrastructure
grids, and healthcare monitors to communities everywhere.
However, despite the various specifications and capabilitiesof these systems and devices, the underlying need for criticalsecurity and authentication is shared.

Security Risks in Networked Devices
While delivering on the promise of streamlined efficiencies
and operational insights, smart devices in the IoT alsopresent a new and more widespread threat to users andpersonal data. Current threats to IoT devices have moved
beyond simple proof-of-concepts, and it is expectedattackers will continue to explore the developments intechnology and accelerate ways potential threats can berealistically exploited.

PKI: THE SECURITY SOLUTION FOR THE INTERNET OF THINGS

3

IoT solutions and implementations must account for thea service provider’s infrastructure, which makes scalable

necessary and fundamental needs of secure systems andsystems a challenge to ongoing data security.

data, including the three core goals of information security:
confidentiality, availability and integrity.

Each IoT device is uniquely identifiable through its embedded
computing system but is able to interoperate within theexisting Internet infrastructure. Securing these Internetconnected devices and platforms requires a thoroughunderstanding of the makeup of the IoT information stack, itsvarious elements, and the specific security requirements of
those layers.
For example, an IoT application that collects data frommultiple connected devices may have entirely different
security requirements than the actual device itself. Security
must be considered and addressed throughout each partof a device’s information architecture in the IoT. The OpenWeb Application Security Project’s (OWASP) list of top IoT
vulnerabilities demonstrates the critical concern that proper
data security, identity, and trust play in developing solutions

Confidentiality ensures privacy. Access to informationmust be restricted to those authorized to view the data andfor the IoT. The list includes the following as the most critical
existing attack vectors for IoT and networked devices:

the storage, and transmission of the information must be•

Unsecure Web Interface

encrypted to prevent unauthorized access to data being•

Data Privacy Concerns•

Unsecure Device Software/Firmware

Access controls are also part of availability. Availability•

Insufficient System/Identity

ensures that hardware, applications, and systems are•

Authentication

properly accessible to authorized entities and are performing•

Unsecure Cloud Backend Systems•

Poor Transport Encryption

Integrity ensures data remains consistent and accurate•

Implementation

during transit or as it is accumulated. Any solution that meets•

Unsecure Network Services

these three goals needs to be able to scale beyond current•

Unsecure Mobile Connections

Internet levels of service. Large-scale IoT deployments often•

Poor Physical Device Security

communicated between systems and devices.

intended functions.

mean more complex requirements or a larger burden on

PKI: THE SECURITY SOLUTION FOR THE INTERNET OF THINGS

4

PKI’s Foundation of Strong Security
IOT INFORMATION STACK

PKI has been the backbone of Internet security since its
inception through the use of digital certificates. PKI inherently
delivers the basic and essential elements of privacy incommunications using encryption and authentication. PKI’s
unique role in the history of data and identity security and its
ability to facilitate the secure transfer of information acrossnetworks makes it the clear solution for IoT service providers
to ensure proper data security, authentication, andmutual trust.
Digital certificates have been used to secure networked
devices, such as servers, routers, printers, and fax machines
for decades. Because of the proliferation of new smart
devices, the emergence of IoT adds complexity into anorganization’s security and trust ecosystem. One of the

Security implementations are not simply about encrypting
data, they also ensure the proper deployment andconfiguration of security across the various layers ofcommunication within individual devices and acrossintegrated systems.
Security in IoT implementations must be a critical component
either during the device design and manufacturing phase or
during the initialization phase or a product update. Correctly
implemented, secure IoT deployments should ensure that thebasic security requirements needed for data confidentiality,
data integrity, and data accessibility are properly configured
as part of the solution. For some, IoT deployments security
has been an afterthought, causing some connected device
manufacturers to retrofit devices with solutions that insulatethem from malicious entities. Security built into design is asuperior approach—something the Internet industry alreadyknows too well.

differentiators of IoT from traditional networked systems isthe diversity of the networked devices, however, the common
layers of the connected ecosystem found in traditional
networked devices makes PKI a strong solution for securing
the IoT.
PKI enables safe authentication of users, systems, anddevices without the need for tokens, password policies,
or other cumbersome user-initiated factors. With PKI, IoT
solutions can enable direct authentication across systems
in a decentralized handling of authentication. While notvulnerable to common brute-force or user-deception
attacks, PKI facilitates the secure storage and transmissionof sensitive information. This protects it from malicious
actors even if a data stream or data source were captured
or compromised. Modern-day PKI is secure and cannot be
replicated when using modern-day cryptography.

PKI: THE SECURITY SOLUTION FOR THE INTERNET OF THINGS5

PKI has the capability to address the security needs of at-rest

confidence that the entity at either end of a data transaction

and in-transit data. Additionally, PKI ensures the integrity ofor authentication event is who it claims to be. Identity

data acquired from sensors or other intelligence systems.

verification is a fundamental element for effective security

PKI also facilitates the verification of proper availability

and networked device trust. It is also a pre-requisite forand access for protocol and application configuration, or

proper identity management, which is a requirement forinteraction with data stored in the device, thus ensuring

robust security implementations.

the complete coverage of data and system confidentiality,
integrity, and availability.

PKI’s existing infrastructure of identity vetting completed
by publicly trusted and audited Certificate Authorities

PKI solution providers are uniquely positioned to addressprovides the necessary foundation for IoT organization

the security needs of the growing IoT community.

authentication. PKI certificates are evidence that theCommercial PKI vendors can deliver the specific security

identity of organizations, domains, and devices was properly

components, trust anchors, flexible and scalable platforms,

established because certificates cryptographically bindand the expertise needed to properly secure IoT devices. A

public keys to such identities. Pre-vetting capabilities andcomprehensive PKI solution includes the hardware, software,

on-demand issuance, like DigiCert’s Managed PKI for IoT

people, policies, and procedures needed to create, manage,

performs, enable one-time pre-verification or real-time

distribute, use, store, and revoke digital certificates, as well asverification to perform the identity assurance needed by IoT

manages the encryption process used to secure information

projects and systems.

in communication between systems and devices.

PKI & DATA SECURITY
PKI is an open standard, free to be adopted, implemented,
customized, and extended. This makes PKI the clear choicefor organizations that are adding connectivity to systems,
services, and smart devices. With the greater emphasis today
in smart devices, smart grids, networked health data systems
and devices, as well as networked infrastructure, data

PKI provides the core competency and unique value toenable trusted connections between networked devices,cloud services, smart infrastructure, and “things.” This is
the authentication component IoT needs for its security.
In these areas of security, PKI excels as a proven solution.
Gartner, IEEE, and other industry groups tout the flexibility
and wide range of applications of PKI as a leading choice for
information and communication security.

security is of the utmost concern.

PKI & FLEXIBLE DEPLOYMENTThe most effective mechanism to mitigate the risk

While every IoT device varies in its utilization andassociated with information stored and exchanged

implementation, PKI offers flexible deployment options in

between networked devices is to ensure that strong identity

order to cater to the critical authentication and encryption

assurance and authentication is required for any access tocapabilities of unique devices.

sensitive data assets. Identity assurance is the measure ofPKI: THE SECURITY SOLUTION FOR THE INTERNET OF THINGS

6

The availability of network connectivity, a device’s internalduring device manufacturing process by a hardware

memory or computational power, or regular maintenance or

manufacturer or deployed remotely during a customer’s initial

updates are all important factors that impact the security

device setup or configuration.

deployment of an IoT device.
Performance, capability, and availability of platform flexibility
or project customization will vary greatly between Certificate
Authorities. Some of these differences include the following:•

Custom profiles, key usage fields, and OIDs•

Shorter and longer validity periods for certificates•

Custom certificate subject fields•

Stronger cryptographic hashes and algorithms•

Direct-to-root-chained certificates hashes
and algorithms•

High availability of systems and distribution of

PKI & SYSTEM SCALABILITY
There are needs for specialized IoT PKI platforms in orderto provide the scalability and dependability required frompossible implementations of networked devices and to
mitigate the risks associated with networked devices.
Addressing the growing demands from IoT projects requiresa more comprehensive PKI solution from an IoT-focused
Certificate Authority. Selecting the right Certificate Authority
with specialized systems, industry knowledge, and technicalexpertise must be a key consideration during the IoT security
development and vendor selection process.

services worldwide

In addition to the sheer number of devices that require•

Revocation checking performance

security implementations, IoT providers should consider how•

Flexible trusted roots and revocation options•

Scalable from thousands to millions to billions
of certificates

Additionally, numerous certificate management protocols
exist as part of a security certificate enrollment and device
deployment process:•Simple Certificate Enrollment Protocol (SCEP)•

Certificate Management over CMS (CMC)•

Enrollment over Secure Transport (EST)•Enterprise API

PKI security allows for a variety of deployment approaches,
which makes PKI the most flexible solution for securing IoT
devices. This level of flexibility enables PKI to be implemented

their IoT needs will impact their CA. Device manufacturers
need to consider critical implications for IoT devices, such as
computational power and device memory, in order to meetthe performance and capacity needs of the chosen
security solutions.
Even with low computational power and memory,
cryptographic algorithms can often still be computed withinreasonable time. If cryptography can’t be added to theindividual device, then the first step is to secure the hub orcontroller at the next level in the ecosystem. Devise a plan toprovide a truly secure infrastructure in the short future.
IoT implementations can either be open systems, whereusers decide to join on-demand, or closed systems, where
IoT solution providers control the deployment. Some key
considerations for IoT PKI implementations include thePKI: THE SECURITY SOLUTION FOR THE INTERNET OF THINGS

massive size, scale, and scope of IoT solutions. Most PKI
certificate implementations deal with significantly smaller
implementations than new IoT PKI requirements. IoTproviders will need to find a Certificate Authority with ascalable infrastructure to meet their needs.
IoT device management, as well as key and certificate
lifecycle management, requires the combined analysis ofdevice capabilities and supporting Certificate Authority cloudinfrastructure. Ongoing maintenance for device and security
components required to secure data will drive how you
manage the provisioning and management process of device
certificates and keys throughout a device’s lifecycle.

7

Example PKI IoT Deployments
DigiCert recently partnered with media streaming solution
provider Plex to deploy one of the largest public IoT
implementations using publicly trusted certificates.
With the increasing use of streaming personal media online,
along with Plex’s own commitment to software security, thePlex team selected DigiCert’s IoT PKI platform to secure its
media streaming platform and user devices. Enabling PKI
certificates for its software and user devices ensures Plex
users the highest security and privacy assurance. Because
Plex is used on computers, TVs, and mobile devices, thesituation demanded a ubiquitous solution, which

PKI & STANDARDSDigiCert provided.

Legislative and industry bodies have addressed the unique

The Plex streaming server’s automatic update process

nature of data security within different IoT verticals. Dataenabled Plex to deploy fully vetted x.509v3 DigiCert

security requirements such as HIPAA, PCI, FERPA, CALEA,

certificates automatically to customer devices already inand others, are evaluated to ensure the standards areproduction—a seamless security implementation. IoT APIs

sufficient to secure IoT devices and make sure providers

enabled automatic and on-demand certificate request,deliver proper security.

issuance, and deployment in real time, without the need for

While some data and device security standards may not be in

expensive device maintenance or user input.

place or government mandated yet, we know that encryption

In addition to data security, this IoT PKI implementation

and authentication will be part of whatever finalized

delivered publicly trusted certificates that now allows users

standards are developed for IoT security.

to see the trusted padlock, indicating secure access to their

Knowing this, IoT providers must consider the damage orsafety implications that a security lapse or data compromise
could have on their—or their clients’—organization. Data loss

personal media dashboard. The added assurance of privacy
and public trust delivered a solution that private certificatesor self-signed certificates could not provide.

or injuries to users who depend on smart devices could proveThis IoT PKI deployment process is accomplished bydetrimental to an organization and to the mass adoption ofleveraging DigiCert’s IoT management platform and APIs

these new IoT technologies. PKI provides the highest level ofto provision trusted certificates during manufacturing, on-authentication and encryption to ensure data integrity for

demand, and update stages to renew and update

IoT devices.

public certificates.

PKI: THE SECURITY SOLUTION FOR THE INTERNET OF THINGSPKI is the Security Solution for
IoT Security
PKI has a history as the de-facto standard for Internet
security and has the developing specifications toaccommodate the requirements of diverse IoT deployments.
Therefore, PKI is the best option for solution providers tosecure data and connected devices.
When correctly implemented, PKI can build and support

8

PKI and the spawned trust communities cover the criticalsecurity requirements IoT projects need, providing theencryption, authentication, and data integrity that create
the foundation of trust. IoT PKI platforms also deliver thescalability and flexibility that providers need as they movethrough testing, production, and deployment requirements.
PKI is poised to accommodate and leverage its existing
technologies for the specific and increasingly diverse needsof the IoT.

security and trust in IoT ecosystems. PKI’s role in IoTprovides strong identity authentication and creates thefoundation of trust that systems, devices, applications, andusers need to safely interact and exchange sensitive data.

Anderson, M. “Looking for the Key to Security in the Internet of Things,” IEEE Spectrum, 2014.
Evans, D. (April 2011). “The Internet of Things: How the Next Evolution of the Internet Is Changing Everything” (PDF).
Cisco. Retrieved 9 September 2015.
Höller, J., Tsiatsis, V., Mulligan, C., Karnouskos, S., Avesand, S., Boyle, D.: From Machine-to-Machine to the Internet of Things:
Introduction to a New Age of Intelligence. Elsevier, 2014, ISBN 978-0-12-407684-6.
Miessler, D. (2015, August). IoT Attack Surface Mapping DEFCON 23. Retrieved April 6, 2016, fromhttps://www.owasp.org/images/3/36/IoTTestingMethodology.pdf.
Monnier, O. : A smarter grid with the Internet of Things. Texas Instruments, 2013.
“What is PKI? - A Complete overview , January –23, 2015”. Retrieved 2015-02-24.

© 2017 DigiCert, Inc. All rights reserved. DigiCert is a registered trademark of DigiCert, Inc. in the USA andelsewhere. All other trademarks and registered trademarks are the property of their respective owners.