Periodic Reporting for period 2 - ELIoT Pro (KEEPING YOUR CONNECTED SMART DEVICES PROTECTED AGAINST HACKERS AND CYBER ATTACKS)
Periodo di rendicontazione: 2019-06-01 al 2020-05-31
Hijacking of the connected car by cybersecurity experts within one research project with use of stolen credentials clearly showed connected cars’ vulnerabilities. It demonstrated how such an event could be a danger to the car, the driver himself and also to city traffic and other people, if potentially used for a terrorist attack. Smart cars are also vulnerable to cloning and relay attacks that allow thieves to steal a car with the use of a laptop and a hardware that can be easily and legally purchased online.
Hackers can gain access to a smart building network through unsecured IoT devices such as light-bulb. It is again a problem of using credentials: users’ but also devices’.
Also, cities are introducing “smart systems” to better manage various operations that include surveillance, security and rescue services, traffic and public transportation management, lighting, energy and utility services. As the vast majority of the simple end-point devices are unable to run encryption algorithms or cybersecurity tools, they are left unsecured and may already be presenting a serious risk to IoT systems and consequently to entire cities and their populations.
ELIoT Pro is designed to provide a solution to above described threats as a complete, end-to-end solution addressing Cybercrime issues and satisfying Cybersecurity Compliance requirements for IoT networks.
ELIoT Pro’s Human-to-Machine authentication component eliminates the problem of stolen passwords or any other static credentials. Addressing Machine-to-Machine secure authentication and encrypted communication problem, ELIoT Pro’s Lightweight Encryption provides a solution removing the use of password or any type of static credentials also in Machine-to-Machine communication.
ELIoT Pro provides an equally high level of security to all types of IoT devices regardless of their memory/computational power limits.
ELIoT Pro also provides device and network performance monitoring and anomaly detection with use of a Rules Engine. This component is a data analytics element which is responsible for monitoring the performance of single devices as well as of the entire network, predictive maintenance, servicing scheduling, malfunction detection and alerts.
The objectives are:
• to create a universal cybersecurity system providing strong user authentication,
• protection of devices and an entire IoT network in the form of a password-free and credential-free authentication between connected devices,
• to provide Lightweight Encryption that can encrypt communication between all types of IoT devices regardless of their computational capabilities, size of memory or energy consumption,
• to provide security to users of the IoT devices and networks by a behavior and performance monitoring system that is able to detect devices’ and systems’ malfunctions and anomalies.
a) Cyberus Key – based Human-to-Machine password-less, multifactor user authentication and operation confirmation,
b) Machine-to-Machine secure communications and device-device authentication supported with the Lightweight Encryption,
c) Rues Engine and Flight Envelope to manage and monitor the behaviour of the IoT devices
d) Marketplace – a self-healing and predictive maintenance tool.
One of the main achievements of the project was a development, implementation of the Lightweight Encryption. Lightweight Encryption has been tested to successfully encrypt and decrypt video signal from the IP based smart cameras and successfully integrated and tested with use of the BLE and LoRa communication protocols.
ELIoT Pro mobile apps for iOS and Android had been developed and released to provide Human to Machine authentication. It had been integrated with the IoT voice-controlled environments on the example of Amazon’s Alexa Dot smart-speaker IoT hub. ELIoT Pro mobile app had been extended to provide secure, password-less user authentication and access for the smart cars environments and to enable login to the smart car’s internal VPNs. One of the examples included Tesla open API.
Mobile app had been also extended to provide one-device user login, deployment and provisioning of the IoT devices in the field.
ELIoT Pro had also been tested and demonstrated its resilience to the most critical attacks at the IoT systems: Denial of Service, cloning, Man in the Middle attacks. In automotive sector had proven to mitigate or be resilient to Cloning, Keyless Jamming, Signal Relay, Signal Amplification Relay attacks.
The capabilities of the ELIoT Pro mobile app make the system to be a perfect solution for many Shared Economy applications.
ELIoT Pro is providing an as yet unseen level of security in IoT networks, regardless of their type and industry. It is a solution for smart homes, cars, factories and cities – preventing not only regular cyber-crimes targeted at data or identity theft but also against potential acts of terror made possible by the proliferation of IoT.
ELIoT Pro provides technology features that are exactly in line with the most recent and projected legislative initiatives designed to implement cybersecurity requirements for IoT systems, both in Europe and in the US. Among them are: EU Cybersecurity Act – ENISA(EU); S.B.327 - Security of Connected Devices (US); Content of Premarket Submissions for Management of Cybersecurity in Medical Devices (US); Code of Practice for Consumer IoT Security (UK).