IoT Security in Smart Cities

Transcription

1 IoT Security in Smart Cities

2 SIRUS Belgian software company Small and agile company focused on innovation Software craftsmanship where architecture and design are key elements Technology is our DNA Focus on Smart Cities, IoT & Cloud Microsoft gold partner

3 Who Am I? Passionate about Technology (IoT, AI, chatbots, blockchain, big data) Startups & entrepreneurship Background Sirus IoT Digipolis Antwerpen, Digipolis, Imec Architect on Smart Meter, Grid & user Contact gert.detant@sirus.be

4

5 In 2014, 54 per cent of the world s population lives in urban areas, a proportion that is expected to increase to 66 per cent by Projections show that urbanization combined with the overall growth of the world s population could add another 2.5 billion people to urban populations by 2050, with close to 90 percent of the increase concentrated in Asia and Africa, according to a new United Nations report launched today.

6 Challenges for a City? Mobility (Transport and ICT) Economy (Competitiveness) People (Social and Human capital) Environment (Natural Resources) Governance (Partcipation) Living (Quality Of Life) Giffinger (2007)

7 Rain In 2h 43m City IoT Platform 490 KW Produced Trash Level 75% Fine Dust 50 µg/m³ Feedback City feels save Field Gateway Bike Rental 2 Available Wifi Hotspot Feedback Person in distress 302 KW Produced Dining Fully Booked Smart Light Smart Traffic A smart city is an urban place that uses Information and Communication Technologies (ICT) and their role in economic development, building an infrastructure to enable greater connectivity between businesses, citizens or government, or all three What is a Smart City?

8 How to build a Smart City? TOP DOWN holistic total solution government in driving seat technology-driven Bottom UP experimental small scale smart citizen holds central position

9

10

11 The smart City Platform User Centric Cloud Enabled Co-Created Data-Driven Service Oriented Pluggable

12 Communications patterns

13 Non-functional requirements Open Source Distributed & Decoupled Interoperability Scalability Security Open Standards Legacy & heterogeneous Robustness Privacy

14 Current Cases in Antwerp Smart Zone City as a Data Broker Safe Crossing Smart Lightning Smart logistic (last mile) Smart Trashbin Food Surplus Synchronicty European project around an API for the City Smart Transportation Circular south enabling renewable energy New City Development Select4Cities European Smart IoT City Platform

15 Smart Sensors Uncontrolled Area City Network Basic Sensors

16 Smart Sensors Uncontrolled Area LoRa (max 51 to 222 bytes)) City Network Gateway LPWAN Basic Sensors Gateway Sigfox (uplink 12 bytes Downlink 8 bytes)

17 Smart Sensors Uncontrolled Area City Network City Network Internal Network Gateway Data Lake Basic Sensors Gateway

18 Smart Sensors Uncontrolled Area City Network City Network Internal Network Gateway Data Lake Basic Sensors Gateway

19

20 The hacker news

21 WIRED Hackers Remotely Kill a Jeep on the Highway

22 Smart Sensors Basic Sensors Uncontrolled Area City Network Firmware updating Bad implementations Default passwords Tampering with devices Tampering the measurements Battery exhausting Interpreting the signals Vendor out of business (new markets) Security

23

24

25 Smart Sensors Basic Sensors Uncontrolled Area Gateway Gateway City Network Security Jamming the communication Spoofing sensors Man in the middle attacks Evesdroping Replay attacks Disconnecting the sensor Location determination

26 Gateway City Network City Network Internal Network Data Lake Security DOS attack on the wireless gateway DOS attack on the internet facing server Weak passwords & broken authentication Injection Eavesdropping on the gateway Tampering the gateway OWASP

27 Smart Sensors Keys everywhere Uncontrolled Area City Network City Network Internal Network Gateway Data Lake Basic Sensors Gateway

28

29 Challenges for Privacy Building Trust How to ask specific consent to the citizens, visitors? How to handle temporary consent? How to implement the transparency? How to protect the data at rest and in transfer? How to prevent data attacks? Regulations What will the GDPR bring?

30 Challenges for Privacy Example data attack 3 months of credit card records 1.1 million people 4 spatiotemporal points are enough to uniquely reidentify 90% of the individuals - de Montjoye et al, 2015

31 Privacy by design 7 principles 1. Proactive not Reactive : Preventative not Remedial. 2. Privacy as the Default Setting. 3. Privacy Embedded into Design. 4. Full Functionality : Positive-Sum, not Zero-Sum. 5. End-to-End Security : Full Life Cycle Protection. 6. Visibility and Transparency : Keep it open. 7. Respect for User Privacy : Keep it individual and user-centric.

32 How we started Gathered information internal & from the community Network security & Security officer IMEC & Marc Vael Meetups around IoT & Security From the feedback we decided to build a treat model for security & privacy We tried to make the treats as clear as possible with examples and real cases For each treat we identified a mitigation method Wherever we can we choose standard and proven technologies For each project we take into account the privacy by design principles We are building classifications for the different projects Re-assess with each iteration

33 Conclusion Smart cities can help cities to tackle a number of the challenges it faces Implementing Security and Privacy right, still poses some challenges and is best implemented as an iterative process. Always ask if you should not if you could! Dr Ian Malcom --

34 Thank You!