Security and Privacy in the IoT Flashcards
(37 cards)
Privacy vs. Security
What is security? What is privacy? (or its goal)
Security - protect the data
Privacy - protect the user
Issues with the IoT systems (4)
Hardware heterogeneity
Limited resources
Big data generation
Need for complex data protection and access measures
Hierarchical IoT System (and give the 3 layers)
- Application layer - Applications/Services, Operation and Management
- Transportation later - Access Network
- Perception layer - WSN
“The quality or state of being secure- to be free from danger”
Security
A successful organization should have multiple layers of security in place: (6)
Physical security
Personal security
Operations security
Communications security
Network security
Information security
The protection of information and its critical elements, including systems and hardware that use, store, and transmit information.
Give its necessary tools (5)
Information security
Necessary tools:
- policy
- awareness
- training
- education
- technology
CIA TRIAD
________ - To ensure protection against unauthorized access to or use of confidential information
________ - To ensure that information and vital services are accessible for use when required
________- To ensure the accuracy and completeness of information to protect business processes
Confidentiality-Integrity-Availability (CIA)
- Confidentiality
- Availability
- Integrity
Which should weigh more security or usability?
usability
Why learn IoT security from payment industry?
IoT systems face the same problems as ___________ faced before
- Initial design was for private point to point network the moved to _______ and later on the ______
- Started with basic security then found the security flaws and attached more complex security requirements later
- Low security devices from early design are still out there and used in compatible _________
card payment systems
- IP network; internet
- fall-back mode
model of payment ecosystem and who are involved
Four-Party Model
- consumer
- merchant
- issuing bank
- acquiring bank
Simplified Authorization Flow for Card Payment
- The customer make a payment. Enter cardholder data into the__________ (POS, e-commerce website).
- The merchant sends card data to an ________ who will route data to through the payments system for processing. For e-commerce, a _______ may redirect website to the acquirer.
- The __________ sends the data to Payment brand.
__________ forwards the data to the issuer. - The _______ verifies and make approval. For e-commerce, a payment gateway may redirect website to the issuer (ex. Verified by ______)
- If the issuer agrees to fund the purchase, it will generate __________ and routes back to the card brand.
- Payment brand forwards the authorization code back to acquirer/processor.
- The acquirer/processor sends the authorization code back to the merchant.
- The _______ concludes the sale with the customer.
- merchant payment system
- acquirer/payment processor, payment gateway
- acquirer/processor
- Payment brand; issuer; VISA
- authorization number
- merchant
________ standard size (normally ID-1) card that has embedded integrated circuit with microprocessor
ISO/IEC 7810
What can a smart card provide? (4)
personal identification
authentication
data storage
application processing
There are different designs or types of smart cards such as: (3)
- Contact smart card - ISO/IEC 7816
- Contactless smart card - ISO/IEC 14443
- Hybrid
Inside a smart card (7)
CPU
Security logic
Serial I/O Interface
Test Logic
ROM
RAM
EEPROM
- microprocessor
- cryptographic co-processors
- random number generator
CPU
Detects abnormal condition (e.g. low voltage)
security logic
contacts the outside world
serial I/O interface
Self-test procedure
test logic
Basic Security Feature
Hardware (5)
Software (5)
Hardware
- closed package
- memory encapsulation
- fuses
- security logic (sensors)
- cryptographic co-processors and random generator
Software
- decoupling applications and operating system
- application separation (Java card)
- restricted file access
- life cycle control
- various cryptographic algorithms and protocols
The two primary types of smart card operating systems are: (2)
Fixed File Structure
Dynamic Application
What Card OS?
- files and permissions are set in advances by the issuer
- seldom used for payment cards
Fixed File Structure
What Card OS?
- enables developers to build, test, and deploy different card application securely
- updates and security are able to be downloaded and dynamically changed
- ________ and _______ are the two main OS standards
Dynamic Application
- MULTOS and JavaCard
- A standard, flexible tool box
- a known language and an easy tool for applet developers in cards
- requires the addition of Global Platform (or similar) to manage the card and its applets
JavaCard
