The IoT Files – intro and security

I will start a series of posts on the IoT (Internet o Things) since it seems me that most of the talking about IoT are missing some key aspects.

I will start with a general introduction, taken from a webinar I delivered recently.

There is a lot of rumors around IoT lately. It seems the new holy grail of the technology industry, the panacea that will solve every business pain and will drive us to the next point.

All those talking are interesting, but somehow a little bit apologetic, since there is a lot of things still to be evaluated in an IoT world, and some could give us some headache and concerns.

so let us start trying to understand what we are talking about when we talk about IoT.

IoT,internet of things is the extension of the consumerization of connected device, that will cover much more than we are used nowadays. the key target of the IoT is the User and its world.

This does not means that IoT is not about scada systems or industrial contol systems, or e-government or smart cities. is all about this and more, but the focus point will be the user, the new hyperconnectd guy: mr Guy Smart.

But aren’t we already hyperconnectd with our always present smartphones, tablets and now smartwatch?

What is the difference between us now and mr Smart?

The difference rely on the level of devicesystems connected that are related to the new user. Way more than the simple phone and watch; we can think of wearable devices, medical devices, glasses for augmented reality, smart shoes that tell us how we walk or belt that monitor pour waste and diet.

But My Smart is not only using those stuffs he wear, he is also living in a hyper connected world. driving a smart car (autonomous and more…) on smart roads, with intelligent traffic lights, in a smart city where he find its smart home.

All connected, all sharing information, all dynamically changing status upon the user request and the context.

A way to live quite different from our actually way of life, since everything can modify the behavior related to the heat of the moment.

All this look wonderful, a personalized environment that follow our needs and provide us a completely new experience. A new industrial revolution able to shape our needs and think and way of life.

But is this real? how far are we from this?

To understand what all this means we should start from the definition of Internet of Things. A good definition is the following:

The  Internet of Things ( IoT) refers to the ever-growing network of physical objects that feature an IP address for internet connectivity, and the communication that occurs between these objects and other Internet-enabled devices and systems.

According to most of the analyst this is the main trend we should expect in the next years.

All analysts forecast billions of devices connected, a great hope for a growing business….

• But is this coming without a price?
• Is this so easy to achieve?
• What are the consequences?

 

IoT is a great opportunity, but is also something should make us think about the consequence. as every thing there is always a price to pay, and we should understand what is this price.

I will try to give a short description of 5 aspects related to IoT we should take care of:

1. Security
2. Privacy
3. Infrastructures
4. Business Models
5. Culture

IoT and Security

I know that security is on everyone mouth recently, the rising of cyber crime and the warfare has put security under everyone attention.

But yet we are far away from a real understanding of what security really is, and what means make security. We usually focus on particular aspect of the security domain, or on specific technologies, forgetting that make security is a complex affair that cope with behavioral science as well as technology. Is more a process than a product or service.

What should be put us on alert is that in a IoT world the dependency of our lifestyle and life from the devices will be so tight that security will assume a completely new meaning for the normal user. We are not talking about an annoying virus on our laptop, but something that can literally kills us as in the case for medical device or smart drive systems.

IoT bring a lot of security concerns, some quite easy to understand, other alas too often neglected. Let us try to name a few:

Hacking

This is something everyone knows, every years the knowledge about hacking rise up as well as hackers ability. Is a never ending run.  But can we try to imagine what would happen in a world where the number of hackable devices is in the range of billions?

This is something we should take into serious consideration, no OS is secure (sorry Linux, Unix and Mac guys) and we are talking of billions of objects that exchange data, transmit data, manipulate data, collect data through sensors. the attacking surface will become incredibly wider, and the result unpredictable.

The classical reactive approach of OS designer have to be radically modified, since this can be the door for a hell. A new security design approach is needed. And don’t think for a moment that IoT device will have few lines of code and therefore easy to be secured. Even the smallest simplest device will have its sensor and will have to communicate data and receive orders (otherwise wold not be SMART). so there is nothing like a simple OS here. beside the smaller the OS the herder can be to secure and patch it. in bigger environment it is a common operation to wrap the vulnerability into something that solve somehow the problem, will this be possible in the smaller IoT OS?

Cyber Criminals

And if the hacking surface will grow, we can expect also criminal activities to grow and find new way to monetize the risks.

For the ones who works in the Cyber Security arena, it is well known that Cyber criminality move more money than drug and weapon illegal market.  this can only grow, making cyber crime more important than ever. And when something is so important, corruption and collaboration between the underworld and the official ones is to be expected.

So IoT brings with him a great concerns from this point of view.

Cyber Warfare

But if it is not a criminal organization, can be a government. Do we really think that this will be an area where government will not play the part? Do we realize that IoT will be tied to our life, and our productive environment. So targeting the IoT could harm a country more than a conventional war, blocking its productive system.

Science Fiction? Try to remember stuxnet and may be we can agree that this is a plausible scenario: a country that attack the IoT infrastructure in order to harm another country.

And if it is not a state, a government can be a terrorist organization, activism …..

Geopolitical Issues

And if it is not on purpose, may be the system can be harmed by geopolitical issues. In an Hyperconnected world damage can be done even targeting something else.

Censorship

Let’s take censorship as an example. we can not realize that censorship can harm the functionality of a device, at the end we are not talking about nor twitter nor facebook, but…

Take your android phone and go to China, as an example, and you will see directly the effect of censorship on IoT. Your wonderful android functions and services will not work since Google has be banned for censorship reasons from china. (Sure you can use VPN, but please, try to see the picture here).

Errors and Incidents

And even if it is not on purpose, accident and errors can anyway harm the system. probably in ways at the moment we still don’t see, due the complex nature of the various interrelationships between the objects.

Compatibility

And if will be not error or incidents the harm can be done by compatibility issues. At the end you will like to change object or location from time to time. some IoT objects will travel with you, compatibility will become a great issue.

What if you change medical device provider and the new does not support vital data taken from the old one? or if you go in place that does not allow the same level of communication? (may be because encryption is not allowed there).

What More?

Many other scenarios can be recalled related to IoT and security, this is not an exhaustive list, but it is good to make the point. Security is a serious issue in an IoT world.

The classical approach that consider security an “Add ON” of IT and a business weight to avoid have to change dramatically. Security Must become part of normal thinking because the risk is higher than ever.

When consider IoT and security ask yourself:

• Would you drive or feel safe in a easy to hack car, in a easy to hack road.
• Would you like to depend on easy to hack medical device?
• Would you like to count on a hackable safe city system?
• ….

We have to realize that Security is important in all realms.

It is not just a product add on §(the antivirus….) but we will have to deal with new things like:

Operating System security

• Vendor Security Approach
• Service Provider Security System
• Supply Chain Security

Authentication

Communication security:

• Reliable
• Protected
• …

Compatibility

Open Sources vs legacy code

Vulnerability and Vulnerability Disclosure policy

Hacking accidents communication

Training and awareness

Reliability

alas we are still far form the arrival.

Next post I will talk about Privacy in the IoT

Related articles

• Building the Internet of Things with OSGi
• The art of augmented reality is very real (video)
• Apple Acquires Flyby Media, Makers Of Tech That “Sees” The World Around You
• The future of historical content delivery?
• Solving the cybersecurity challenges of smart cities
• Why “smart cities” should be an Internet of People, not Things
• FCC Fines Smart City $750K For Blocking Wi-Fi

The IoT Files – intro and security

I will start a series of posts on the IoT (Internet o Things) since it seems me that most of the talking about IoT are missing some key aspects.

I will start with a general introduction, taken from a webinar I delivered recently.

There is a lot of rumors around IoT lately. It seems the new holy grail of the technology industry, the panacea that will solve every business pain and will drive us to the next point.

All those talking are interesting, but somehow a little bit apologetic, since there is a lot of things still to be evaluated in an IoT world, and some could give us some headache and concerns.

so let us start trying to understand what we are talking about when we talk about IoT.

IoT,internet of things is the extension of the consumerization of connected device, that will cover much more than we are used nowadays. the key target of the IoT is the User and its world.

This does not means that IoT is not about scada systems or industrial contol systems, or e-government or smart cities. is all about this and more, but the focus point will be the user, the new hyperconnectd guy: mr Guy Smart.

But aren’t we already hyperconnectd with our always present smartphones, tablets and now smartwatch?

What is the difference between us now and mr Smart?

The difference rely on the level of devicesystems connected that are related to the new user. Way more than the simple phone and watch; we can think of wearable devices, medical devices, glasses for augmented reality, smart shoes that tell us how we walk or belt that monitor pour waste and diet.

But My Smart is not only using those stuffs he wear, he is also living in a hyper connected world. driving a smart car (autonomous and more…) on smart roads, with intelligent traffic lights, in a smart city where he find its smart home.

All connected, all sharing information, all dynamically changing status upon the user request and the context.

A way to live quite different from our actually way of life, since everything can modify the behavior related to the heat of the moment.

All this look wonderful, a personalized environment that follow our needs and provide us a completely new experience. A new industrial revolution able to shape our needs and think and way of life.

But is this real? how far are we from this?

To understand what all this means we should start from the definition of Internet of Things. A good definition is the following:

The  Internet of Things ( IoT) refers to the ever-growing network of physical objects that feature an IP address for internet connectivity, and the communication that occurs between these objects and other Internet-enabled devices and systems.

According to most of the analyst this is the main trend we should expect in the next years.

All analysts forecast billions of devices connected, a great hope for a growing business….

• But is this coming without a price?
• Is this so easy to achieve?
• What are the consequences?

 

IoT is a great opportunity, but is also something should make us think about the consequence. as every thing there is always a price to pay, and we should understand what is this price.

I will try to give a short description of 5 aspects related to IoT we should take care of:

1. Security
2. Privacy
3. Infrastructures
4. Business Models
5. Culture

IoT and Security

I know that security is on everyone mouth recently, the rising of cyber crime and the warfare has put security under everyone attention.

But yet we are far away from a real understanding of what security really is, and what means make security. We usually focus on particular aspect of the security domain, or on specific technologies, forgetting that make security is a complex affair that cope with behavioral science as well as technology. Is more a process than a product or service.

What should be put us on alert is that in a IoT world the dependency of our lifestyle and life from the devices will be so tight that security will assume a completely new meaning for the normal user. We are not talking about an annoying virus on our laptop, but something that can literally kills us as in the case for medical device or smart drive systems.

IoT bring a lot of security concerns, some quite easy to understand, other alas too often neglected. Let us try to name a few:

Hacking

This is something everyone knows, every years the knowledge about hacking rise up as well as hackers ability. Is a never ending run.  But can we try to imagine what would happen in a world where the number of hackable devices is in the range of billions?

This is something we should take into serious consideration, no OS is secure (sorry Linux, Unix and Mac guys) and we are talking of billions of objects that exchange data, transmit data, manipulate data, collect data through sensors. the attacking surface will become incredibly wider, and the result unpredictable.

The classical reactive approach of OS designer have to be radically modified, since this can be the door for a hell. A new security design approach is needed. And don’t think for a moment that IoT device will have few lines of code and therefore easy to be secured. Even the smallest simplest device will have its sensor and will have to communicate data and receive orders (otherwise wold not be SMART). so there is nothing like a simple OS here. beside the smaller the OS the herder can be to secure and patch it. in bigger environment it is a common operation to wrap the vulnerability into something that solve somehow the problem, will this be possible in the smaller IoT OS?

Cyber Criminals

And if the hacking surface will grow, we can expect also criminal activities to grow and find new way to monetize the risks.

For the ones who works in the Cyber Security arena, it is well known that Cyber criminality move more money than drug and weapon illegal market.  this can only grow, making cyber crime more important than ever. And when something is so important, corruption and collaboration between the underworld and the official ones is to be expected.

So IoT brings with him a great concerns from this point of view.

Cyber Warfare

But if it is not a criminal organization, can be a government. Do we really think that this will be an area where government will not play the part? Do we realize that IoT will be tied to our life, and our productive environment. So targeting the IoT could harm a country more than a conventional war, blocking its productive system.

Science Fiction? Try to remember stuxnet and may be we can agree that this is a plausible scenario: a country that attack the IoT infrastructure in order to harm another country.

And if it is not a state, a government can be a terrorist organization, activism …..

Geopolitical Issues

And if it is not on purpose, may be the system can be harmed by geopolitical issues. In an Hyperconnected world damage can be done even targeting something else.

Censorship

Let’s take censorship as an example. we can not realize that censorship can harm the functionality of a device, at the end we are not talking about nor twitter nor facebook, but…

Take your android phone and go to China, as an example, and you will see directly the effect of censorship on IoT. Your wonderful android functions and services will not work since Google has be banned for censorship reasons from china. (Sure you can use VPN, but please, try to see the picture here).

Errors and Incidents

And even if it is not on purpose, accident and errors can anyway harm the system. probably in ways at the moment we still don’t see, due the complex nature of the various interrelationships between the objects.

Compatibility

And if will be not error or incidents the harm can be done by compatibility issues. At the end you will like to change object or location from time to time. some IoT objects will travel with you, compatibility will become a great issue.

What if you change medical device provider and the new does not support vital data taken from the old one? or if you go in place that does not allow the same level of communication? (may be because encryption is not allowed there).

What More?

Many other scenarios can be recalled related to IoT and security, this is not an exhaustive list, but it is good to make the point. Security is a serious issue in an IoT world.

The classical approach that consider security an “Add ON” of IT and a business weight to avoid have to change dramatically. Security Must become part of normal thinking because the risk is higher than ever.

When consider IoT and security ask yourself:

• Would you drive or feel safe in a easy to hack car, in a easy to hack road.
• Would you like to depend on easy to hack medical device?
• Would you like to count on a hackable safe city system?
• ….

We have to realize that Security is important in all realms.

It is not just a product add on §(the antivirus….) but we will have to deal with new things like:

Operating System security

• Vendor Security Approach
• Service Provider Security System
• Supply Chain Security

Authentication

Communication security:

• Reliable
• Protected
• …

Compatibility

Open Sources vs legacy code

Vulnerability and Vulnerability Disclosure policy

Hacking accidents communication

Training and awareness

Reliability

alas we are still far form the arrival.

Next post I will talk about Privacy in the IoT

Related articles

• Building the Internet of Things with OSGi
• The art of augmented reality is very real (video)
• Apple Acquires Flyby Media, Makers Of Tech That “Sees” The World Around You
• The future of historical content delivery?
• Solving the cybersecurity challenges of smart cities
• Why “smart cities” should be an Internet of People, not Things
• FCC Fines Smart City $750K For Blocking Wi-Fi

IoT, Internet of Things or Internet of Terror?

Why we all talk about IoT

I know that there are a lot of good reasons to love the IoT or IoE (where E stand for everything) idea. I can just highlight a couple: Business and easier life.

The business behind IoT

The first point is quite clear, the tremendous growth of the Smart devices has create a new business that has gone beyond any analyst prevision. Nowadays it seems that it is impossible to think a world not interconnected. Anyway there are still great areas of improvement in terms of quality of the services provided and the spread of the population covered.

Source: Euromonitor, ITU, US Census.

If we take a look at the growth of internet users from 1995 to 2014 we can perceive the dimension of this business. But as well we can see that yet the majority of the population is not internet connected. Even in the most developed countries Digital divide is a sensitive matter of discussion, that separate the digital literate from the digital illiterate people.

IoT can dramatically improve this market, while making the separation between digital connected and not digital connected wider. Some efforts are made by government or private company to cover this gap, I think, as an example, the UK effort to cover rural areas or the India project to bring internet for free to poor and not developed areas. But those effort are somehow inadequate to cover the great part of the population that is not connected. And even in developed countries as Italy, digital divide is still not perceived as a problem.

This although statistics tell us that the digital economy can improve company’s revenue and way of life of the population, but at the same time requires skills and infrastructures that, in many cases, are still obsolete.

Source: Morgan Stanley, Capital IQ, Bloomberg.
Note: Market capitalizations are as of May 22, 2015 and December 31, 1995, respectively

 

It is interesting to notice that China and USA are covering the top positions, two countries that heavily invested in developing such technologies (USA as historical leader, China as underdog working to close the technology Gap).

Not to mention the other technological Asian giants, Japan and Korea, that have been anyway able to capitalize this growth.

Now it is clear that to maintain this thread we have to offer something new, and IoT is a good instrument to allow a solid growth in that market that start to show a little slowing:

Offering new Services is the Key to maintain a solid growth. And IoT from this point of view promise a tremendous growth: from demotic to cars, from wearable to control systems IoT can expand exponentially the business related to internet.

Can IoT makes us live better?

But can this means we can have a better life? This is questionable, of course, but overall the life experience with internet is way better than without. We can get access to more services, more communications, more information. Of course all of this has a cost, we still are creating the cognitive infrastructures to manage this enormous flux of information, but it is out of doubt that where internet arrive form a social point of view there is a dramatic change in use and costumes of the population. Sometimes this lead to nasty behaviors, I know, but at the same times it let ideas spreads, and ideas are like a virus so hard to stop when find a channel of infection.

It is not a case that the diffusion of internet saw a revamp of censorship efforts from government, as well as efforts to rules and control this communication (even without citizenship acknowledgment, think of Prism as an example). But I will turn back to this later.

Anyway is clear that the people that have access to the internet can enjoy and use a wider range of information, services and tools that people without internet can’t have. This is just a good justification per se to affirm that IoT can be a powerful instrument to improve our lives.

Thinks about smart object that can help you in the most tedious daily tasks, or able to give you some fun and relax to improve your quality of life, or help you to better manage resources to allow you to make savings…

What challenges ahead

So from this is the picture, a great business chance and a great life improvement, as internet showed us can provide.

But it is right now possible? What are the challenges?

To Connect or not to Connect?

Well there are a lot of things that have to be clarified around IoT. First of all is the business model behind, who will pay the bill?

IoT means always connected object to the internet, able to communicate between them and the owners, and, may be, with something else. A great flux of data that will flood our already congested networks. The connection is one of the main limit at the moment of the IoT approach.

While we like to think connectivity is not an issue, we have to realize that , on the contrary, the issue is quite big. And the obstacle is not technological but business related. Carriers have to change their business model somehow to allow this growth, and this is not an easy task to accomplish.

There are still great obstacle to a real interconnected world, and some are particularly nasty, think at roaming costs as an example.

Since we does not live in a world where a single carrier cover perfectly all the countries, we have to face with a plethora of carriers that cover partially an area. Some areas are well covered, other are suffering bad coverage due to 2 main reasons:

• Lack of connectivity
• Congestions

IoT can just increase this problem exponentially. Even in our better connected areas we can face congestions. One possibility to temporarily mitigate this problem is to allow the device to connect to another carrier if the preferred one is congested, but this will open to the roaming issues mentioned before, as well as the resistance of carrier to open their networks. And if is the case in rural not dense populated areas, can you imagine what they could say in dense populated areas?

Interoperability and universal access

Let be clear, if we think we can create an interconnected world with IPv4 we are out of our mind. There are a world of good reasons to think this is a bad idea, and security is one of them. But there are other considerations to take in account: what protocols and services will be necessary to IoT to work?

Just the simplest example. The real DNS infrastructure is not solid enough to guarantee such device explosion. The hierarchical DNS infrastructure has worked till now, not without some problems. thinking to increase the load of DNS traffic at a greater scale would make the situation unstable and put at risk the basic of communication itself: name resolution.

So different way to resolve address have to be implemented, some effort to implement peer to peer resolution has been done, but still we are far from a solid solution that would allow IoT to growth at the desired scale.

Would be too reductive to think that IoT device does not need a sophisticated name resolution capability, maybe it is the case now, but we should think ahead, what the future improvement could be.

Just, as an example, think of a medical device connected to a person travelling. May be would be useful to allow this device to connect to the closest interface when something happen to the person wearing it, and this can change related to the kind of analysis the device is able to do. Could be a pharmacy or a hospital, or a doctor or whatever. Being able to resolve a complex set of name resolutions would make the difference between a good device and a bad one. Of course we can ask Google to do all the job for ourselves and allow them to decide what are the next name resolution technologies we want, unless you live in china where Google services does not work.

DNS systems demonstrate its limits several times those years, and are also subject to geo political crisis that could badly interfere with an internet of things enabled world.

From a technological point of view the biggest obstacle is still the Operative System under which this IoT will run. The Operative systems, actually, it has not sense to think about a single OS, it would be inapplicable (although some governments would like this approach) so we will have a plethora of different OS running on small machines able to perform complex activities and able to connect in a quasi autonomous way. Interoperability and standardization will be imperative to avoid the chaos. As well as some general agreement on a minimum level of security features related to data acquisition and transmission (including what kind of sensor are allowed), authentication and so on.

There are concerns about privacy, kind of data processed, security also today, can you imagine what would be to be spied by your refrigerator?

But also networks can become our bottlenecks as mentioned before. Being able to set up enough bandwidth and quality of service is mandatory.  And i can just imagine the workload that border routers, firewalls and other network gears will have to deal with.

Wondering if Carriers are preparing themself to face this change (I can’t see good signs at the moment, honestly).

Why IoT scares Me

I confess I am scared by the IoT affair. And there are good reason all related to security and privacy. My concerns are various, and cover a lot of aspects:

From a security perspective I can start from the basic, the operating systems that will run on those things.

I am aware that most of the code will be written in C or assembly like languages, and this open a world of vulnerability, since coding with C allow you to do basically everything with memory and device, and, as a matter of fact, it expose the device to your error. Buffer overflow is a typical example, this vulnerability generally is related to a lack of control in the C code at driver level, where speed and efficiency are mandatory and so controls are not always implemented.

A small lightweight OS would be prone to this kind of error, since it would not implement security controls on top of the driver set.

Let’s then talk about authentication. Another difficult realm to address. The authentication is of course related to the service provided, less important services can use a lighter authentication model, but thin about medical devices, or cars…would you like to leave your authentication efforts to a 4 digit password (“1234” of course) and a username?

But we cannot even force our user to remember 150 hexadecimal digit, right?

Do we want to talk about encryption? I love it till it works. But then we discovered that encryption is all but a simple affair, and as for authentication, it has a very weak point, the key exchange. Encryption per se will not solve all our security concerns during data transfer just because in the IoT world we will let the device manage the process, and since the device is prone to error or hacking also the encryption will be weaker.

Even the strongest encryption is easy to decipher once you have the key.

I don’t know what will be the computational  power of my oven or fridge, considering the growing of processor power we continuously see, probably it will be more powerful than my T440 but I don’t expect a fully implemented OS running on it in the next 5 years (but, may be, I’m wrong and soon we will have an apple fridge that will download our sodas from I-grocery-store).

And there are also the bad guys to take into account: if we are suffering about cybercrime, cyberwarfare, cyberacktivism  right now, what will happen in the IoT world?

Let assume your fridge can make shopping by itself, because it is so smart that understand you finished your eggs, orange juice and milk. it Will have your credit card information, been able to log to the online shop on your behalf and make the shopping. Great!

But what if someone hack the fridge and steal your credit card info, or just force the fridge to buy frozen broccoli that you hate?

Or your medical device report to your insurance company you have symptoms you do not have so that they close your contract with you (don’t worry someone else will arrive to offer a new one, just in case…)

We can expand those silly examples to the whole scale of IoT, and see what kind of playground we are creating for government, cybercriminal and acktivists of any kind. I am sure that NSA and GCHQ guys would be so happy to hack any device they can just to be sure. So if you buy kebab one day you are a villain suspected of terrorism … or in some countries if you eat pork, eat meat on Friday, eat cow …

Internet of Things, Internet of Everything can be a tremendous good thing from both a business and life perspective, but some cautious remarks should be done before we jump into this mess without a parachute. We are just understanding the magnitude of the problem that an always connected world can bring us, better be wise and do not let others to make the choices for us.

Related articles

• Embracing business mobile for many benefits
• Ignoring BYOD Can Be Disastrous To Mobile UC

IoT, Internet of Things or Internet of Terror?

Why we all talk about IoT

I know that there are a lot of good reasons to love the IoT or IoE (where E stand for everything) idea. I can just highlight a couple: Business and easier life.

The business behind IoT

The first point is quite clear, the tremendous growth of the Smart devices has create a new business that has gone beyond any analyst prevision. Nowadays it seems that it is impossible to think a world not interconnected. Anyway there are still great areas of improvement in terms of quality of the services provided and the spread of the population covered.

Source: Euromonitor, ITU, US Census.

If we take a look at the growth of internet users from 1995 to 2014 we can perceive the dimension of this business. But as well we can see that yet the majority of the population is not internet connected. Even in the most developed countries Digital divide is a sensitive matter of discussion, that separate the digital literate from the digital illiterate people.

IoT can dramatically improve this market, while making the separation between digital connected and not digital connected wider. Some efforts are made by government or private company to cover this gap, I think, as an example, the UK effort to cover rural areas or the India project to bring internet for free to poor and not developed areas. But those effort are somehow inadequate to cover the great part of the population that is not connected. And even in developed countries as Italy, digital divide is still not perceived as a problem.

This although statistics tell us that the digital economy can improve company’s revenue and way of life of the population, but at the same time requires skills and infrastructures that, in many cases, are still obsolete.

Source: Morgan Stanley, Capital IQ, Bloomberg.
Note: Market capitalizations are as of May 22, 2015 and December 31, 1995, respectively

 

It is interesting to notice that China and USA are covering the top positions, two countries that heavily invested in developing such technologies (USA as historical leader, China as underdog working to close the technology Gap).

Not to mention the other technological Asian giants, Japan and Korea, that have been anyway able to capitalize this growth.

Now it is clear that to maintain this thread we have to offer something new, and IoT is a good instrument to allow a solid growth in that market that start to show a little slowing:

Offering new Services is the Key to maintain a solid growth. And IoT from this point of view promise a tremendous growth: from demotic to cars, from wearable to control systems IoT can expand exponentially the business related to internet.

Can IoT makes us live better?

But can this means we can have a better life? This is questionable, of course, but overall the life experience with internet is way better than without. We can get access to more services, more communications, more information. Of course all of this has a cost, we still are creating the cognitive infrastructures to manage this enormous flux of information, but it is out of doubt that where internet arrive form a social point of view there is a dramatic change in use and costumes of the population. Sometimes this lead to nasty behaviors, I know, but at the same times it let ideas spreads, and ideas are like a virus so hard to stop when find a channel of infection.

It is not a case that the diffusion of internet saw a revamp of censorship efforts from government, as well as efforts to rules and control this communication (even without citizenship acknowledgment, think of Prism as an example). But I will turn back to this later.

Anyway is clear that the people that have access to the internet can enjoy and use a wider range of information, services and tools that people without internet can’t have. This is just a good justification per se to affirm that IoT can be a powerful instrument to improve our lives.

Thinks about smart object that can help you in the most tedious daily tasks, or able to give you some fun and relax to improve your quality of life, or help you to better manage resources to allow you to make savings…

What challenges ahead

So from this is the picture, a great business chance and a great life improvement, as internet showed us can provide.

But it is right now possible? What are the challenges?

To Connect or not to Connect?

Well there are a lot of things that have to be clarified around IoT. First of all is the business model behind, who will pay the bill?

IoT means always connected object to the internet, able to communicate between them and the owners, and, may be, with something else. A great flux of data that will flood our already congested networks. The connection is one of the main limit at the moment of the IoT approach.

While we like to think connectivity is not an issue, we have to realize that , on the contrary, the issue is quite big. And the obstacle is not technological but business related. Carriers have to change their business model somehow to allow this growth, and this is not an easy task to accomplish.

There are still great obstacle to a real interconnected world, and some are particularly nasty, think at roaming costs as an example.

Since we does not live in a world where a single carrier cover perfectly all the countries, we have to face with a plethora of carriers that cover partially an area. Some areas are well covered, other are suffering bad coverage due to 2 main reasons:

• Lack of connectivity
• Congestions

IoT can just increase this problem exponentially. Even in our better connected areas we can face congestions. One possibility to temporarily mitigate this problem is to allow the device to connect to another carrier if the preferred one is congested, but this will open to the roaming issues mentioned before, as well as the resistance of carrier to open their networks. And if is the case in rural not dense populated areas, can you imagine what they could say in dense populated areas?

Interoperability and universal access

Let be clear, if we think we can create an interconnected world with IPv4 we are out of our mind. There are a world of good reasons to think this is a bad idea, and security is one of them. But there are other considerations to take in account: what protocols and services will be necessary to IoT to work?

Just the simplest example. The real DNS infrastructure is not solid enough to guarantee such device explosion. The hierarchical DNS infrastructure has worked till now, not without some problems. thinking to increase the load of DNS traffic at a greater scale would make the situation unstable and put at risk the basic of communication itself: name resolution.

So different way to resolve address have to be implemented, some effort to implement peer to peer resolution has been done, but still we are far from a solid solution that would allow IoT to growth at the desired scale.

Would be too reductive to think that IoT device does not need a sophisticated name resolution capability, maybe it is the case now, but we should think ahead, what the future improvement could be.

Just, as an example, think of a medical device connected to a person travelling. May be would be useful to allow this device to connect to the closest interface when something happen to the person wearing it, and this can change related to the kind of analysis the device is able to do. Could be a pharmacy or a hospital, or a doctor or whatever. Being able to resolve a complex set of name resolutions would make the difference between a good device and a bad one. Of course we can ask Google to do all the job for ourselves and allow them to decide what are the next name resolution technologies we want, unless you live in china where Google services does not work.

DNS systems demonstrate its limits several times those years, and are also subject to geo political crisis that could badly interfere with an internet of things enabled world.

From a technological point of view the biggest obstacle is still the Operative System under which this IoT will run. The Operative systems, actually, it has not sense to think about a single OS, it would be inapplicable (although some governments would like this approach) so we will have a plethora of different OS running on small machines able to perform complex activities and able to connect in a quasi autonomous way. Interoperability and standardization will be imperative to avoid the chaos. As well as some general agreement on a minimum level of security features related to data acquisition and transmission (including what kind of sensor are allowed), authentication and so on.

There are concerns about privacy, kind of data processed, security also today, can you imagine what would be to be spied by your refrigerator?

But also networks can become our bottlenecks as mentioned before. Being able to set up enough bandwidth and quality of service is mandatory.  And i can just imagine the workload that border routers, firewalls and other network gears will have to deal with.

Wondering if Carriers are preparing themself to face this change (I can’t see good signs at the moment, honestly).

Why IoT scares Me

I confess I am scared by the IoT affair. And there are good reason all related to security and privacy. My concerns are various, and cover a lot of aspects:

From a security perspective I can start from the basic, the operating systems that will run on those things.

I am aware that most of the code will be written in C or assembly like languages, and this open a world of vulnerability, since coding with C allow you to do basically everything with memory and device, and, as a matter of fact, it expose the device to your error. Buffer overflow is a typical example, this vulnerability generally is related to a lack of control in the C code at driver level, where speed and efficiency are mandatory and so controls are not always implemented.

A small lightweight OS would be prone to this kind of error, since it would not implement security controls on top of the driver set.

Let’s then talk about authentication. Another difficult realm to address. The authentication is of course related to the service provided, less important services can use a lighter authentication model, but thin about medical devices, or cars…would you like to leave your authentication efforts to a 4 digit password (“1234” of course) and a username?

But we cannot even force our user to remember 150 hexadecimal digit, right?

Do we want to talk about encryption? I love it till it works. But then we discovered that encryption is all but a simple affair, and as for authentication, it has a very weak point, the key exchange. Encryption per se will not solve all our security concerns during data transfer just because in the IoT world we will let the device manage the process, and since the device is prone to error or hacking also the encryption will be weaker.

Even the strongest encryption is easy to decipher once you have the key.

I don’t know what will be the computational  power of my oven or fridge, considering the growing of processor power we continuously see, probably it will be more powerful than my T440 but I don’t expect a fully implemented OS running on it in the next 5 years (but, may be, I’m wrong and soon we will have an apple fridge that will download our sodas from I-grocery-store).

And there are also the bad guys to take into account: if we are suffering about cybercrime, cyberwarfare, cyberacktivism  right now, what will happen in the IoT world?

Let assume your fridge can make shopping by itself, because it is so smart that understand you finished your eggs, orange juice and milk. it Will have your credit card information, been able to log to the online shop on your behalf and make the shopping. Great!

But what if someone hack the fridge and steal your credit card info, or just force the fridge to buy frozen broccoli that you hate?

Or your medical device report to your insurance company you have symptoms you do not have so that they close your contract with you (don’t worry someone else will arrive to offer a new one, just in case…)

We can expand those silly examples to the whole scale of IoT, and see what kind of playground we are creating for government, cybercriminal and acktivists of any kind. I am sure that NSA and GCHQ guys would be so happy to hack any device they can just to be sure. So if you buy kebab one day you are a villain suspected of terrorism … or in some countries if you eat pork, eat meat on Friday, eat cow …

Internet of Things, Internet of Everything can be a tremendous good thing from both a business and life perspective, but some cautious remarks should be done before we jump into this mess without a parachute. We are just understanding the magnitude of the problem that an always connected world can bring us, better be wise and do not let others to make the choices for us.

Related articles

• Embracing business mobile for many benefits
• Ignoring BYOD Can Be Disastrous To Mobile UC