Space Center receiving telemetry from the Mars Rover. Since there is likely to be a very limited cellular coverage on Mars, this discussion will be limited to more mundane activities here on this planet.
Historically, pre-Internet, the M2M industry did not put a lot of effort into security measures. Most connections were directly wired, either parallel or serial. Serial connections like V.35, RS-232, RS-422, RS-485, etc. were common. Security was physical. If there was an issue, it was resolved with a steel conduit or a cabinet. Around the same time companies were creating network technologies and protocols. Xerox and Digital Equipment Corporation developed Ethernet and DECnet. IBM created Token-Ring and SNA: Apple created Apple-talk. There were numerous others, all with little or no security considerations.
Larger companies created private networks using these new network technologies and protocols over leased lines, ranging from analog phone lines through to digital T1 lines. The only real external security concerns were associated with “Plain Old Telephone System” (POTS) modems. At that time usernames and passwords were enough. With directories that were all paper, analog dialing and long negotiation times, any brute force attack would literally take forever. If someone did manage to get through, at speeds from 1200 to 9600 baud, there was plenty of time to trace the call. All the phones were POTS lines; a trace not only discovered who had placed the call, but exactly where the call was placed. Making the prospects for anonymity, and not getting caught, fairly remote.
In the mi d 1970’s The “Defense Advanced Research Projects Agency” (DARPA ) funded a project to create a next generation network protocol to connect diverse networks and systems. In 1982, the US Department of Defense (DoD) declared TCP/IP the standard for all military networking. When Microsoft released Windows 95 with native TCP/IP support, it became the dominant protocol. In the mid 1980’s, when the DoD, universities and defense contractors were busy interconnecting, “The Internet” was born, followed moments later by the first hacker.
Cellular data networks were created in the Internet era. Cellular devices, although they may have other services associated with the carrier’s network such as SMS or eGPS, for data purposes are IP devices. They can communicate using almost any IP protocol that any other IP node (such as a PC) can use. Cellular modems have at least one IP address that is provided by the cellular carrier when the modem initiates a connection to the carrier’s network. A common analog to this is the pre-broadband dial-up Internet connection where a computer using a modem would dial-up a service provider, authenticate and gain access to the Internet. This is essentially how cell phones, tablets and cellular modems work today, except without telephone wire and R2D2 sound effects.
The challenge is to integrate historic, current and future M2M/IoT products and applications with cellular wireless technologies without it becoming a road kill on the Internet highway. Technology is changing and moving quickly and there are a lot of solutions and/or products to either adapt or replace traditional M2M devices and control systems. Discussion of these products is outside the scope of this paper. However, the vast majority shares a common design feature. The cellular modem is designed to register to a cellular carrier, establish a data connection, get an IP address, and gain access to the Internet via the carrier’s network. They work this way because this is typically the only type of connection carriers offer the general public. However, there are a number of security and design issues associated with this type of connection.
Device Based Security
Present concepts of device security are of limited value for cellular data communications. Firewalls, usernames and passwords, and multi-factor authentication are designed to prevent un-authorized and/or malicious access into an IP node, system or device. While these techniques are effective at preventing intrusion into a cellular data device, they do not prevent the associated IP data traffic from reaching the device and consuming metered cellular data. Typical M2M data usage is less than 5MB per month. Brute force username/password attacks and repeated ports scans can consume 5MB and very quickly.
“Device Based Security” assumes that at least some level of device security is present. This is not always the case. Sometimes security is missing, unconfigured or misunderstood, leaving the device unprotected. When a legacy M2M device is connected to a cellular modem, it is not always clear what features or listeners are enabled in the TCP/IP protocol stack, for example FTP or Telnet. Once that modem connects to the carrier’s network and the device is on the Internet, the automated scanners will find and exploit any openings. They will find them. Not long ago, just as a cursory test, an unprotected system was given a public address and put on the Internet. Within 60 seconds it had been found. Within 120 seconds it was unusable from the keyboard.
The communications environment for the M2M/IoT industry has changed and is continuing to change rapidly. With the introduction of the Internet into the equation, the security environment has become very treacherous. Considering all of these very interesting things that are already being connected, let alone all the things that have yet to be imagined, the number of very intelligent and determined people that will attempt to gain un-authorized access to absolutely everything, for both malicious and benign reason, will multiply rapidly. As stated earlier, getting off the Internet is effective for mitigating numerous security threats, but it may not be possible for some deployments, especially for consumer products.
This report is only an introduction to the issues and mitigation practices to be considered. A lot of M2M applications have, historically, been designed for unmetered or wired lines. Some current designs are based on the assumption that data will continue to be cheaper. The reality is that for the number of cellular data devices that are projected in the next few years to work with
the available bandwidth and network resources, both devices and applications are going to have to make more efficient use of cellular networks. M2M/IoT service providers can help companies here.
DISCLAIMER: The views expressed are solely of the author and ETTelecom.com does not necessarily subscribe to it. ETTelecom.com shall not be responsible for any damage caused to any person/organisation directly or indirectly.