IEEE Spectrum - North American - March 2015 - 54

DefeNsive weapoNs: rules-based filtering

INTERNET OF THINGS DEVICE
ACCEPT/PROCESS
COMMUNICATION
COMMUNICATION

RULESBASED
FILTERING

FILTER
DROP

WHITE
LIST 1

WHITE
LIST 2

COMMUNICATION

FIRMWARE
BLOCKER

DROP

BUMP IN THE WIRE
RULES-BASED
FILTERING

COMMUNICATION

NETWORK/
NETWORK/
INTERNET
INTERNET

COMMUNICATION

HARDWARE SOFTWARE

system and the network to which it is attached to detect, block,
and report suspicious activity. But the software for firewalls
and antivirus programs takes up a lot of storage space and
requires a lot of processing power to run. Most things in the
Internet of Things can't handle the software.
we have to take a DiffereNt approaCh. For the most part, the

gadgets that make up the Internet of Things are what we call
embedded systems-that is, dedicated computers that perform
specific functions within more complex systems. For instance,
they might control the operation of a machine within a waterprocessing plant, manage the lighting of a smart home, or
monitor an organ in the human body. Limiting the function
means they can be small, fast, and efficient.
The security systems must be just as specialized, protecting only against the specific attacks to which the equipment
is vulnerable. Yet we don't want to completely reinvent the
wheel each time we create a new smart thermostat or television, so we also need a system that's flexible enough to shield
devices as diverse as automobile communication gateways,
home printers, and smart door locks.
To do this, you need to pay as much attention to what you
omit from the embedded security system as to what you
include. What we don't need are systems with powerful pro54

mar 2015

north american

SPectrUm.ieee.orG

NETWORK/
INTERNET

[top] uses a small set of policies-such as no
unauthorized remote updates of embedded
firmware-to block dangerous commands from
getting past a simplified firewall. rules-based
filtering systems can also consult white lists of
trusted computers so that only "good guys" have
access to certain functions. a "bump in the wire"
approach relies on a small, dedicated piece of
hardware and software that sits between an iot
device and the internet; a bump in the wire can
shield devices that don't have built-in protection.

cessing engines and large databases of virus
signatures and other chunks of code that
act as fingerprints to help detect known
ACCEPT/
threats. Instead of databases, IoT security
PROCESS
COMMUNICATION
can use rules-based filtering.
To understand how this works, let's look
at a home printer; it's similar to a lot of other
IoT devices. A printer has only a few communication ports and a limited number of
communication protocols. It supports both
print commands, which may be sent from
any other device, and administrative commands that are accepted only if received from
a few predetermined computers. A small set
INTERNET
OF THINGS
of simple firewall policies known as a white
DEVICE
list is all it takes to enforce these two distinct
communication policies. One set of white-list
rules allows communication from any device
that knows the printing protocols. Another
white list specifies that administrative commands will be processed only if they are from a machine on the
white list. An additional rule blocks print commands that contain embedded firmware updates to make sure that malicious
users cannot modify the behavior of the printer.
The complete firewall policy may consist of as few as 5 to 20
rules as opposed to the 200 to 2,000 rules of a typical business
computer's firewall. This smaller, faster, simpler approach
to an IoT security system does not compromise security; it
allows anyone to print with the machine while preventing
malicious users from changing settings, downloading firmware, or performing other harmful actions (like sending
copies of anything you print to a third party). Other, specific
sets of rules could protect door locks, cars, or pacemakers.
some of the major pLayers in the embedded-systems market-
Green Hills, Intel, McAfee, Mentor Graphics, Renesas, Wind
River, and Zilog-are already incorporating such embedded
security technology into the hardware and software building
blocks used for IoT devices. These companies typically don't
make the connected products themselves but rather the processors and operating systems used to build IoT equipment.
But given that some devices in the Internet of Things are rarely
replaced, it will likely take a decade or two-or more-to bring
all systems up to modern security standards. New systems
iLLustratioN by

Mark Montgomery

http://SPectrUm.ieee.orG

Table of Contents for the Digital Edition of IEEE Spectrum - North American - March 2015