xxx
To that end, the House this week finally passed the Internet of Things Cybersecurity Improvement Act, which should finally bring some meaningful privacy and security standards to the internet of things (IOT). Cory Gardner, Mark Warner, and other lawmakers note the bill creates some baseline standards for security and privacy that must be consistently updated (what a novel idea), while prohibiting government agencies from using gear that doesn’t pass muster. It also includes some transparency requirements mandating that any vulnerabilities in IOT hardware are disseminated among agencies and the public quickly:
From House Passes Bill To Address The Internet Of Broken Things | Techdirt:
xxx
xxx
To prevent problems like these from occurring, each IoT device needs to be able, as it were, to show an identity document—”authentication,” in professional terms. Normally, speaking, this is done with a kind of password, which is sent in encrypted form to the person who is communicating with the device. The security key needed for that has to be stored in the IoT device one way or another, Lieneke Kusters explains. “But these are often small and cheap devices that aren’t supposed to use much energy. To safely store a key in these devices, you need extra hardware with constant power supply. That’s not very practical.”
Digital fingerprint
There is a different way: namely by deducing the security key from a unique physical characteristic of the memory chip (Static Random-Access Memory, or SRAM) that can be found in practically every IoT device. Depending on the random circumstances during the chip’s manufacturing process, the memory locations have a random default value of 0 or 1.
From A fingerprint for the Internet of Things:
xxx
xxx
n contrast, the magnetic PUF is resistant to attack and insensitive to environmental variations.
“In all previously proposed MRAM PUFs, a procedure to set random magnetization orientations is necessary for their practical application,” said Zhe Guo, a post doctor in You’s team. “In our IAE-PUF, the random distribution of magnetization orientations is formed during the MgO layer thinning process, so no initialization is required.” The avoidance of setting random states with an external magnetic field or writing current makes it easier to integrate and scale down with low power consumption.
From Highly secure physically unclonable cryptographic primitives based on interfacial magnetic anisotropy:
xxx