Can Lightweight Encryption Save Us from the Internet of Things?

The billions of tiny devices that make up the internet of things have effectively spread to every corner of the globe and integrated themselves into almost everything: televisions, sneakers, automobiles and light bulbs.

They are even starting to appear in our top military technology and deep in our manufacturing processes. Although individually limited in function, they easily combine into huge data-collecting networks that provide insights that were never before possible to visualize. But they are also extremely vulnerable to attack, as we first learned with the Mirai bot network, and countless exploits that followed.

In a way, IoT is a lot like fire. If carefully controlled, it can do some amazing things like cook food and keep us warm. It can even perform advanced functions like working as a core component in the generation of electricity. But it can also burn us, or quickly spread out of control. Imagine if fire could be hacked and controlled, just like the current generation of IoT devices. The Mirai bots were hijacked and used to create a massive denial-of-service attack that brought down many of the biggest websites on the Internet for several hours.

What makes each IoT device special is also what makes it vulnerable. They are tiny, and normally only possess enough intelligence to perform a single function. That’s why they can fit almost anywhere. But unfortunately, given our current technology, that does not leave a lot of room for things like memory, processors or any good way to increase computing power. If you try to add power to an IoT device, you end up also increasing its size, power requirements, heat generation and other factors. At some point, it’s no longer an IoT device, and can’t perform its role as one.

The fact is that because of size and processor constraints, most IoT devices have no security at all. Others like web cameras ship with basic password protection, which is better than nothing, but then users forget to change the default passwords, leaving the device vulnerable to a simple dictionary attack. And while I have recently reviewed programs that are designed to protect IoT by installing them behind a dedicated frontend system, manufacturers themselves seem to have little interest in adding native security. And home users probably won’t have access to enterprise-level cybersecurity platforms.

The National Institute of Standards and Technology believes it has the answer and is trying to work with industry and even individuals to develop standards for lightweight encryption. This is a project that NIST began quite some time ago, back in 2013 to be exact. But it has taken this long, and several workshops, to get the Lightweight Cryptographic Project to a point where we can almost start deploying the kinds of protection that IoT needs, and that we need from our IoT.

At this stage in the project, a lot of work has already gone into developing the algorithms that will make up the lightweight encryption schemes. NIST is trying to pull them together and develop a standard that is easily implementable for most new IoT devices. A solicitation for ideas is now open. The deadline for submissions is next February.

Honestly, adding encryption to something as tiny as an IoT sensor seems like a pretty tall order. NIST would like whatever standard is eventually approved to take quite a few factors into consideration. They include attack resistance, cost considerations, the performance of the device once encryption is added, the ability to use the standard in all IoT devices including those deployed in operational technology, and the suitability of the new protection for use with both hardware and software IoT.

The agency plans to take the most promising submissions and open them up for anyone to try and hack. Any selected submission will also need to be based on algorithms and techniques that are in the public domain to encourage their adoption and royalty-free use.

Over the next year, I am looking forward to testing out some of the proposed standards. I may be a little skeptical that encryption could actually work for IoT, but I recognize how important it is to make it work. As a government project, perhaps IoT encryption is not as exciting as going to the moon or Mars, but it’s something that is sorely needed as we continue to deploy billions and billions more unprotected sensors and devices. If we don’t do something like this soon, then we are simply adding more fuel to the pending IoT fire, and I have little doubt that it will eventually burn.

John Breeden II is an award-winning journalist and reviewer with over 20 years of experience covering technology. He is the CEO of the Tech Writers Bureau, a group that creates technological thought leadership content for organizations of all sizes. Twitter: @LabGuys