Centric connect.engage.succeed

Blockchain and Securing Distributed Things

Geschreven door Ben van Lier - 14 februari 2017

Ben van Lier
In October 2016, the systems of Dyn, a US-based company that specialises in services such as domain name registration and management, came under a massive DDoS attack on an unprecedented scale. The attack, executed by around 100,000 devices, including routers, IP cameras and digital video recorders, caused major problems for websites of companies across Europe and the US, The Guardian reported [1]. The likes of Spotify, Netflix, Amazon, GitHub, Reddit, CNN, Twitter and PayPal were all affected. The individual devices were infected with a computer virus called Mirai [2], which bundled the individual and distributed devices into a whole, in this case a botnet, which was able to launch a debilitating cyber attack on Dyn.

The attack by the Mirai botnet showed that distributed and individual devices that are interconnected in a network can form an unexpected whole with capabilities that are almost inconceivable on the level of the constituent devices separately. Aside from that, the attack sparked more widespread debate on the security of devices that are interconnected in the (Industrial) Internet of Things.

(Industrial) Internet of Things

In the years to come, objects such as television sets, washing machines, (robot) vacuums, (robot) lawn mowers and lighting in our homes will be networked on an increasing scale. The number of wearables we humans wear on our bodies and which communicate with a network through a smartphone is also set to grow enormously. Things like cars, aircraft engines, wind turbines or MRI scans at the hospital will all be interconnected in the Industrial Internet of Things. In the words of Schneier [3]: “Your modern refrigerator is a computer that keeps things cold. Your oven, similarly, is a computer that makes things hot. An ATM is a computer with money inside. Your car is no longer a mechanical device with some computers inside; it’s a computer with four wheels and an engine. Actually, it’s a distributed system of over 100 computers with four wheels and an engine. And, of course, your phones became full-power general-purpose computers in 2007, when the iPhone was introduced.”

The meteoric increase in the number of objects that are interconnected in networks, and which exchange and share data and information with each other and with humans, also throws up new and largely unknown security issues that can no longer only be tackled on the level of the device or by one single company or individual country.

In a report published in 2016, EY [4] warned that: “IoT networks face a security challenge because they may have thousands, millions or even billions of small devices with valuable data distributed across them. They also face a management challenge in coordinating and acting on the information the network produces, and an accounting challenge in determining and sharing the value created by network participants.” According to Dickson [5], such security issues are caused largely by the fact that today’s IoT ecosystems rely on existing centralised communication models for identification, authentication and connection of devices. He pointed out that: “Connection between devices will have to exclusively go through the internet, even if they happen to be a few feet apart.” In his view, a more decentralised approach could solve many of the security issues. Individual objects that are interconnected in an (Industrial) Internet of Things could communicate on a more decentralised level and based on peer-to-peer communication, which would reduce the costs and risks involved in such communications and the need for centralised and vulnerable data storage. Such a distributed approach, where individual and distributed objects are connected only to objects they know and recognise, can, according to Dickson, prevent: “a failure in any single node in a network from bringing the entire network to a halting collapse.”

Blockchain and securing distributed things

The Security Framework [6] that was published recently by the Industrial Internet of Things Consortium describes security as: “the condition of the system being protected from unintended or unauthorized access, change or destruction.” Weyns [7] (2012) pointed out that a distributed system that is connected to a network such as the (Industrial) Internet of Things: “consists of multiple software components that are deployed on multiple nodes connected via some network.” In Weyns’ view, such a decentralised and distributed environment calls for a different approach to the coordination of decision-making processes executed by networked systems (combinations of hardware and software). He claimed that these decentralised and mutual decision-making processes are responsible for coordination and alignment of the functioning of multiple systems that have to simultaneously and jointly execute tasks within the network.

Lamport [8] described such a principle of decentralised decision-making by distributed entities, providing an example of a decision-making procedure based on a protocol he developed for the functioning of a fictitious parliament where “legislators continually wandered in and out.”

Contrary to today’s parliaments, members of Lamport’s part-time parliament each have their own ‘ledger’, in which they personally record decisions made, i.e.: “the numbered sequence of decrees that were passed.” Although these individual ledgers take away the need for centralised registration, they do require an “atmosphere of mutual trust” between the members of parliament. Decentralised registration of decisions calls, according to Lamport, for a protocol that ensures consistency in the registration of decisions made. One of the requirements of this protocol is that decisions in individual ledgers be recorded using: “a pen and a supply of indelible ink.” The protocol furthermore specifies rules aimed at enabling consensus-based decision making on legislation.

According to Lamport, there is a clear similarity between how members of his fictional parliament make legislative decisions and how distributed systems make decisions on their functioning. He claimed that each individual member of parliament that takes part in a vote can basically be considered as a networked object, much like a server in a network. Laws passed by parliament by consensus can be compared to a change to the current status of a distributed system, such as a database/ledger.

For Barnas [9], such a distributed decision-making process enables the exchange and sharing of data and information between random objects without any other entity being able to take over or control this process. According to Barnas, manipulation of mutually exchanged data and information is also complicated by the fact that data and information can only be recorded after consensus has been reached between the systems involved through a vote. As soon as decisions have been recorded in a distributed manner, they can no longer be changed or deleted simultaneously across the network. In Barnas’ view, such a distributed approach leads to a situation where: “blockchains are capable of operating successfully and securely on the open internet, without a trusted central authority, and while fully exposed to hostile actors.” Such blockchains create what Barnas called: “trustworthy systems in a trustless world.”

Conclusion

It is undeniable that existing approaches to security that look only at security on the level of individual and isolated objects are no longer tenable in our increasingly interconnected world. Slowly but surely, we are going to have to accept that we live in a world that we share with networked objects. To raise the level of security within this interconnected world, we, as humans, are going to have to accept that we have to delegate security responsibilities to these objects themselves. Such a transfer of responsibility is possible only if we enable objects to make and record decisions that are relevant to them in terms of guaranteeing their security in a specific context. To do so, we humans have to learn to think from the perspective of a new and complex whole where separate and interconnected objects are autonomous and self-regulating.

  • [1] https://www.theguardian.com/technology/2016/oct/26/ddos-attack-dyn-mirai-botnet
  • [2] https://www.theguardian.com/technology/2016/oct/26/ddos-attack-dyn-mirai-botnet
  • [3] ag.com/selectall/2017/01/the-internet-of-things-dangerous-future-bruce-schneier.html
  • [4] Blockchain reaction. Tech companies plan for critical mass EY 2016
  • [5] https://techcrunch.com/2016/06/28/decentralizing-iot-networks-through-blockchain/
  • [6] Industrial Internet of Things Consortium. Industrial Internet of Things Volume G4: Security Framework V1.0 19-09-2016
  • [7] Weyns et al. 2012 On patterns for decentralized control in self-adaptive systems in Lemos, R. de et al. (Eds.): Self-Adaptive Systems, LNCS 7475, pp. 76–107, 2012. Springer-Verlag Berlin Heidelberg 2012
  • [8] Lamport. L. (1998) The Part-Time Parliament
  • [9] Barnas, N. B. Major, USAF (2016) Blockchains in national defense: trustworthy systems in a trustless world. A Research Report Submitted to the Faculty In Partial Fulfillment of the Graduation Requirements Maxwell Air Force Base, Alabama, June 2016

Ben van Lier works at Centric as Director Strategy & Innovation and, in that function, is involved in research and analysis of developments in the areas of overlap between organisation and technology within the various market segments.

       
Schrijf een reactie
  • Captcha image