| Internet-Draft | Secure Access of IoT Smart Terminals | March 2021 |
| Wang, et al. | Expires 17 September 2021 | [Page] |
It is difficult to supervise the great deal of Internet of Things (IoT) smart terminals which are widely distributed. Furthermore, a large number of smart terminals (such as IP cameras, access control terminals, traffic cameras, etc.) running on the network have high security risks in access control. This draft introduces the technical requirements for access management and control of IoT smart terminals, which is used to solve the problem of personate and illegal connection in the access process, and enables users to strengthen the control of devices and discover devices that is offline in time, so as to ensure the safety and stability of smart terminals in the access process.¶
This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.¶
Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.¶
Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."¶
This Internet-Draft will expire on 17 September 2021.¶
Copyright (c) 2021 IETF Trust and the persons identified as the document authors. All rights reserved.¶
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.¶
With the rapid development of the IoT and the IP-based communication system, a large number of devices have been interconnected through the network. Due to the large number of branches of IoT network, the scattered geographical location of smart terminals access, the difficulty of human supervision, etc., how to ensure the full control and full time availability of IoT is a brand new problem which is faced by the industry. A large number of smart terminals (such as IP cameras, access controll terminals, traffic cameras and other dumb terminals) running in the network have a large security risk in terms of security access control. With the further development of the convergence of IoT systems and information network, if the IoT smart terminal is once used by hackers, it is very easy for hackers to penetrate the whole network through the IoT smart terminal, causing core business systems to stop and a large amount of confidential information to leak, which will bring significant losses. Therefore, the establishment of a perfect access control mechanism and application control mechanism of smart terminals is an important element of the IoT security system.¶
This draft outlines the technical requirements for secure access and management of smart terminals in the IoT to address the security threats and challenges that exist in the access process of terminals. We discuss the networking structure of common IoT smart terminals in Section 2; we discuss the security threats and challenges faced in the access process of IoT smart terminals in Section 3; in Section 4, we review the guidelines and regulations related to the access of IoT devices; Section 5 we present the requirements for secure access and management of IoT smart terminals and describes their details; in Section 6 we concludes the whole draft. This draft provides a reference for IoT security access and management.¶
IoT smart terminals are generally connected to the network through IoT gateway, and then the data information of the terminals is reported to the application center through the IoT gateway, thus completing the network building.¶
A diagram of an IoT system is shown in the figure below. In the perception layer, there are four different types of IoT smart terminals that form four different subsystems, which are video monitoring subsystem, access control subsystem, alarm subsystem and intercom subsystem. The smart terminals in each subsystem are different. In the video monitoring subsystem, the main terminals are IP cameras and intelligent cameras for collecting video and image data. In the access control subsystem, the main terminals are turnstiles and vehicle access control hosts for collecting vehicle information. In the alarm subsystem, the main terminals are alarm hosts, alarm keyboards and wireless alarm hosts, which are used to set alarm policies, issue alarm warnings and report alarm events, etc. In the intercom subsystem, its main terminals are intercom hosts and individual equipment, which are used to collect voice data. Through this figure, we can know that in the IoT system, smart terminals are heterogeneous and complex, and the data are aggregated into the application layer through the transport layer, which greatly increases the difficulty of the application layer to control the terminals in the sensing layer.¶
+----------------------------------------------------------------------+ | | | Application +------------+ | | Layer +--------+ | Video | | | +--------+ | Storage| +-------+ | integrated | | | | HOST | | system | | DVI +-----+ platform | | | +---+----+ +---+----+ +---+---+ +------+-----+ | | | | | | | | | | | | | +------------------+------------+--+----------+----------------+-------+ | | | | | | | Transport +-----+----+ | | Layer | router | | | +-----+----+ | | | | | +------------------+-+------------+----------------+ | | | | | | | | +-+-------+ +----+----+ +----+----+ +-----+---+ | | | gateway | | gateway | | gateway | | gateway | | | +-+-------+ +----+----+ +----+----+ +-----+---+ | | | | | | | | | | | | | +----------------------------------------------------------------------+ | | | | | | +-------------+--+ +-------------+--+ +--------+-----+ +--------+-----+ | Video | | Access | | Alarm | | Intercom | | surveillance | | control | | subsystem | | subsystem | | subsystem | | subsystem | | +----------+ | | | | +------------+ | | +------------+ | | |Alarm host| | | +----------+ | | | IP camera | | | | Turnstile | | | +----------+ | | |Intercom | | | +------------+ | | +------------+ | | | Alarm | | | | host | | | | Ip Camera | | | | Vehicle | | | | keyboard | | | +----------+ | | +------------+ | | | access | | | +----------+ | | |Individual| | | |Smart Camera| | | |control host| | | | Wireless | | | |equipment | | | +------------+ | | +------------+ | | |alarm host| | | | | | +----------------+ +----------------+ | +----------+ | | +----------+ | | +--------------+ +--------------+ | Perception | | Layer | | | +----------------------------------------------------------------------+
The main security threats and challenges in the process of accessing IoT smart terminals are as follows:¶
Illegal connection of devices. On the side of IoT smart terminals, there exist illegal devices and illegal hosts to access to the network for probing attacks.There exists the situation that the application layer network is invaded through the network of smart terminals and the sensitive data of the application layer network is illegally stolen, thus causing great damage to the security of IoT.¶
Counterfeit connection of devices. With wide distribution of IoT smart terminals and the public deployment environment, it is easy for malicious devices to illegally impersonate and replace legitimate devices and upload fake data, which leads to abnormal function of the devices and causes great damage to the security of IoT.¶
Devices offline. The number of IoT smart terminals is huge and they are very vulnerable to physical attacks, network anomalies, power supply anomalies, and the aging of the device itself, which leads to go offline. And offline devices are difficult to discover, making some of the normal functions of the IoT lost.¶
Devices management. There are many kinds of IoT smart terminals, and it is often not clear how many IoT smart terminals are owned in the whole IoT network and how many IoT smart terminals have security problems, which leads to problems such as inability to control IoT smart terminals and inability to sort out device assets.¶
On the access control of IoT, there already exist many control protocols applied to IoT smart terminals, such as Zigbee [ZB], DALI [DALI], BACNET [BACNET], which do not contribute to the secure access of IoT devices. the UPnP [ISOIEC23941] access protocol defines the access to IoT smart terminals, but does not consider the issue of secure access.¶
There are many specialized and generic security protocols being used in current IP-based deployments of IoT smart device applications. For example, IPsec [RFC7296], TLS [RFC8446], DTLS [RFC6347], HIP [RFC7401], Kerberos [RFC4120], SASL [RFC4422], and EAP [RFC3748], etc. These also do not protect against illegal connection of devices,counterfeit connection of devices, and device offline encountered during device access.¶
There are also a number of groups that are also currently focusing on IoT device security . For example, the Cloud Security Alliance (CSA) is recommending that enterprises building the IoT consider strengthening IoT smart device authentication/authorization [CSA];the Global System for Mobile communications Association (GSMA) has published a security guide for IoT systems [GSMA] to bring a set of security guidelines to the research of IoT security product; and the United States Department of Homeland Security(DHS) has proposed six IoT security strategic principles [DHS] to guide IoT developers, manufacturers, service providers, and consumers in considering security issues. These teams give good advice on building security for the IoT, but there is no introduction or description of secure access to the IoT.¶
In the existing security standards on IoT, such as [RFC8576], the security issues and solutions existing in IoT are introduced, but there is no mention of the problems and solutions existing in the access process of smart terminals.¶
In other related device access standards, there are 802.1x [ISO88021X] based device access and portal-based authentication, but because IoT smart terminals exist mainly in the form of dumb terminals, they are not suitable for authentication access through 802.1x or portal, and the two authentication methods cannot be used to solve the illegal connection of devices and counterfeit connection of devices .¶
Comparing to three-layer framework of IoT,a layer of access and management is added for the framework of secure access management, which is between transport layer and application layer. The framework of secure access management for IoT smart terminals is shown in the following figure. In this framework, the access process of IoT is divided into four parts, which are sensing&control domain, access&management domain, application&service domain and user domain. Among them, access&management domain is the specific implementation of the secure access and management technical requirements to ensure secure access of smart terminals in terms of smart terminals management, access control, strategy management and access log audit.¶
+-------------------------------------------------------User Domain----+
| Application & Service Domain |
| +------------------+ +------------------+ +-------------------+ |
| |Bussiness System 1| |Bussiness System 2| |Bussiness System...| |
| +------------------+ +------------------+ +-------------------+ |
+----------------------------------------------------------------------+
^ ^ ^
| | |
+----------+----------------+----------------+----------User Domain----+
| Access & Management Domain |
| +-----------------+-----------------+----------------+-------------+ |
| | Device | Device Access | Access Policy | Log Audit | |
| | Management | +-------------+ | Management | | |
| | | | Unique id | | | | |
| | | | information | | | | |
| | +-----+-------+ | +-------------+ | +------------+ | | |
| | | IP | Port& | | | Trusted | | | IP&MAC | | +---------+ | |
| | | |Service| | |communication| | +------------+ | |Exception| | |
| | +-------------+ | | protocol | | |IP&MAC&Brand| | +---------+ | |
| | |Type | Brand | | +-------------+ | +------------+ | |Behavior | | |
| | +-------------+ | | Certificate | | |IP&MAC&Brand| | +---------+ | |
| | |Model| MAC | | | access | | | &Model | | |Operation| | |
| | +-------------+ | +-------------+ | +------------+ | +---------+ | |
| +------------------------------------------------------------------+ |
+----------------------------------------------------------------------+
Indirect ^ ^ ^ Direct
connection| | | connection
+----------------------------------------------------------------------+
| Sensing & +-----------+ | | |
| Controlling |IoT Gateway| | | |
| Domain +------^----+ | | |
| | | | |
| +------------------------------------------------------------------+ |
| | +---------+ +---------+ +--------+ | +------+ | +------+ | |
| | |RS-485 | |Zigbee | |IP/WIFI/| | |Video | | |Smart | | |
| | |RS232 | |Lora and | |5G/4G | | |and | | |IP | | |
| | |and other| |other | |smart +--+ |Audio +-+ |Camera| | |
| | |wired | |wireless | |device | |device| +------+ | |
| | |terminals| |terminals| +--------+ |RFID | | |
| | +---------+ +---------+ +------+ | |
| +------------------------------------------------------------------+ |
+----------------------------------------------------------------------+
Smart Terminals: including smart terminals through RS-485, RS-232 and other wired devices, zigberr, Lora and other wireless terminal equipment, smart terminal equipment through IP, WiFi, 5g, 4G access network, audio and video equipment, RFID equipment and intelligent camera equipment, etc.¶
IOT Gateway: an entity used to connect smart terminals and terminals of upper layer.¶
Among them, smart terminals can be directly connected with the access&management domain, or indirectly connected with the access and management domain through the Internet of things gateway.¶
Access and management domain is the core, which is used to manage and control the access of smart terminals, including four parts: device management, device access, access policy management and log audit.¶
The contents of each part clarified as follows:¶
Device Management: It mainly manages equipment asset information, including IP address, MAC address, type of device, brand, model, open port and service of smart terminal equipment.¶
Device Access: Refers to the device access mode supported by smart terminals, including access based on unique identification information of smart terminal (the composition of unique identification information of device can be one or more sets of device asset information managed by device), access based on trusted communication protocol of smart terminal and access based on certificate authentication.¶
Access Policy Management: Refers to the access policy management based on the unique identification information of smart terminals, including: IP, MAC access policy; IP, MAC, manufacturer access policy; IP, MAC, manufacturer, model access policy.¶
Log Audit: Used to record, store and audit the log information generated in the access process of smart terminals, including exception log audit, behavior log audit and operation log audit.¶
Application & service domain is the core business system, which provides informational application services for information collecting, exchanging and processing. The information provided by the smart terminals that verified by the access & management domain to ensure security and stability of the system.¶
User domain is the users of smart terminals, they can directly access the core business system in the application & service domain, and access & management domain to view the access condition of smart terminals and manage them.¶
The identity information of devices access authentication should include one or more of the following characteristics:¶
There should be at least four types of access status:¶
Online: The device that has passed authentication and the device is working well.¶
Offline: The device that has passed authentication and the device is not working.¶
Counterfeit: A device that fails authentication and its authentication identity information is the same as that of the authenticated device before.¶
Illegal connection: The authentication identity information of the device that fails to pass the authentication is completely different from the identity information of the device that has passed the authentication¶
The device access policy can be at least five combinations:¶
Quickly discover the access of counterfeit and illegal connection, and prevent illegal control of devices.¶
The configuration of access policy can be done manually and automatically¶
Device access policy can be customized as any combination of recommendation of access policy shown in requirement 3.¶
Device management requires the ability to monitor device status in real time, to profile devices, to identify and manage applications running on terminals, to identify and manage device asset information of terminals, and to manage IP addresses of terminals.¶
Requirements for equipment condition monitoring and management¶
It should be ability to monitor the offline and online status of smart terminals in real time¶
It should be ability to discover whether there is weak password information of the smart terminal¶
It should be ability to discover the risky ports of smart terminals¶
It should be ability to alert offline devices, devices with weak passwords and risky ports¶
Requirements for the management of terminal profiling¶
Requirements for the management of identifying applications¶
It should be ability to automatically identify and manage the device's open services and service ports¶
It should be ability to automatically discover and identify the application system of B/S architecture or CS architecture running in the network where the IoT smart terminal is located, including: service IP, service port, application name¶
Requirements for the management of identifying asset information of the device¶
It should be ability to manage IP address, MAC address, device manufacturer, device model, device type, device firmware version number, device open port, and device online time for smart terminals¶
It should be ability to manage the communication protocol information of smart terminals and geographic location information of devices¶
Access log audit requires the ability to audit all types of operations as well as abnormal and malicious behavior of access devices.¶
It should be ability to record abnormal behavior log information of access devices in real time and to provide analysis and audit functions.¶
It should be ability to record malicious behavior log information of access devices in real time and to provide analysis and audit functions.¶
It should be ability to record the management, access and blocking of access devices and other types of operations in real time , and can provide analysis and audit functions¶
This entire memo deals with security issues.¶
This documents has no IANA actions.¶