© 2017 Venable LLP

Identity and the Internet of Things

Jeremy Grant

Managing Director, Technology Business Strategy

jeremy.grant@Venable.com

@jgrantindc

NIST IOT Cybersecurity Colloquium - October 19, 2017
© 2017 Venable LLP

IOT: Why identity matters

2
© 2017 Venable LLP

IOT: Why identity matters

3
© 2017 Venable LLP

The relevant acronym

ID

4

IOT

IDentity of Internet of Things 
© 2017 Venable LLP

Let’s turn this into a good thing!

5
© 2017 Venable LLP

Evolution

6

1993 2017

If your dog is on the Internet, 

how do you know it’s not a toaster?
© 2017 Venable LLP 7

Or – how do you make sure that someone 

can’t take hack into your toaster and use 

it to control your dog? 
© 2017 Venable LLP

Authentication is important to ID-IOT

But it’s not the only thing

8
© 2017 Venable LLP

The “5 As” of Identity

Authentication

• The means by 

which a receiver 

of an electronic 

transaction or 

message makes 

a decision to 

accept or reject 

that transaction 

or message*

• Is a device what 

it claims to be?

• Is the entity 

seeking to 

control a device 

who or what it 

claims to be?

Authorization

• What actions is 

a device – or an 

entity seeking 

to control a 

device –

authorized to 

perform?

• How are 

permissions or 

delegations 

granted or 

revoked? 

Analytics

• Detecting 

whether 

identities are 

being used 

improperly or 

suspiciously –

and triggering 

additional, 

appropriate 

controls

Audit

• Looking back to 

review events 

and confirm the 

identity system 

was being used 

properly

• Determining 

what happened 

if it was not

Administration

• How is the 

identity system 

governed?

• How are the 

policies and 

processes of the 

identity system 

managed? 

• How are new 

devices and 

entities added 

or removed 

from the 

identity system? 

9

*Asia-Pacific Economic Cooperation (APEC) Report, 2002
© 2017 Venable LLP

Why the “5 As” of Identity Matter

• Most IoT devices connect – at some point – to the cloud

• Human control of – and access to – these devices is generally 

controlled by traditional identity solutions

• A full-lifecycle approach to identity is needed to govern access 

to Things on the Internet

10
© 2017 Venable LLP

Let’s go back to Authentication

Default passwords are bad.

11
© 2017 Venable LLP

Let’s go back to Authentication

But...how much will changing 

passwords help?

12
© 2017 Venable LLP

The security value of passwords

13
© 2017 Venable LLP

Authentication in IOT: What’s Better?

The ideal (from a security perspective): cryptographic keys

But in the IOT, not all the “T’s” have the same capabilities. 

• The “things” we are connecting to the Internet vary widely...

• ...as do the chips within them 

14
© 2017 Venable LLP

Not all crypto works in all things

15
© 2017 Venable LLP

So we’ll need different types of authentication

• PKI/X.509 certs are highly secure – but not feasible in many 

devices, and may be overkill

• FIDO standards (aka “PK without the I”) can deliver PK-based 

security with less overhead

• Constrained devices will likely need something else – more work 

needed here

• 2016 Cornell paper* declared there are 40+ authentication 

protocols which may apply – and noted many have 

shortcomings

16

*https://arxiv.org/pdf/1612.07206.pdf
© 2017 Venable LLP

Also: there are different authentication use cases.

17
Cloud 

Services

IoT 

Gateway

Router

4

3

1 2

2 3

2

4

1. User to Cloud Service

2. User to Device

3. Device to Device

4. Device to Cloud Service

Different authentication use cases

Thanks to 

NokNok Labs 

for Ideas and 

content here!
© 2017 Venable LLP

Keep in mind

• Some devices will be connected directly to the Internet

• Some won’t – but will be connected to other devices that are

• Any device could be an attack point

Secure identity for every connected device becomes very 

important

19
© 2017 Venable LLP

Summary: Where Work is Needed

1. Guidance on how to handle the “5 As” of the IOT Identity life cycle

– Authentication

– Authorization

– Analytics

– Audit

– Administration

2. Specific work on Authentication for IOT

– Passwords aren’t the only answer

– Lightweight crypto – to enable strong ID-IOT authentication in devices of all 

shapes, sizes and capabilities 

– Focus on the 4 major use cases – and are there others?

20
© 2017 Venable LLP

One more thing...

21
© 2017 Venable LLP

We need to prevent a race to the bottom.

22
© 2017 Venable LLP

We need to prevent a race to the bottom

• Many IOT vendors – who want to do the right thing – are 

expressing concerns that the market won’t

• Economics at play may disincentivize “good” security behavior if 

there is no forcing function

– If building in security adds 10% to the cost, will anyone buy it? 

23
© 2017 Venable LLP

Amidst concern that laws or regulations would 

be too heavy handed – and stifle innovation –

what can government do?

24
© 2017 Venable LLP

What government can do

Standards

Enforcement Frameworks

25
© 2017 Venable LLP

Questions? 

Jeremy Grant

Managing Director, Technology Business Strategy

jeremy.grant@Venable.com