[From last episode: IoTThe Internet of Things. A broad term covering many different applications where "things"  are interconnected through the internet. devices will be built from both hardwareIn this context, "hardware" refers to functions in an IoT device that are built into a silicon chip or some other dedicated component. It's distinct from "software," which refers to instructions running on a processor. and softwareIn this context, "software" refers to functions in an IoT device that are implemented by running instructions through some kind of processor. It's distinct from "hardware," where functions are built into a silicon chip or some other component., and most of that software will be firmwareSoftware that is stored on a device itself. Regular computers have very little firmware, since software mostly comes from a hard drive or some other storage.  But on IoT devices, much of the software may be firmware..]

There’s a problem in IoT-land. IoT devices are supposed to be connected to the internet – that’s what makes them part of the IoT. But it turns out that many devices don’t get connected. I heard that in person from Ayla Network’s Sahir Sait (mentioned in one of the earlier privacyRefers to whether or not information gathered about your usage of IoT devices by authorized people can be made public, or shared with others, without your consent. Different from (although related to) security, which protects such data and devices from access by unauthorized people. Different from privacy, which is more concerned about use of data by authorized people. posts). But in surveys with consumers, we’ve also learned that, among the reasons people have been slow to jump on the bandwagon, difficulty connecting ranks pretty high.

So let’s wrestle with what’s going on here. And we need to start with a bit more on securityRefers to whether or not IoT devices or data are protected from unauthorized viewers..

Security and Keys

We talked before about security and how important it is. But we dealt with it at a very high level; we need to drill just a bit further down.

When we talk about protecting data in particular, we’re talking about encryptingEncryption refers to encoding and decoding (or encrypting and decrypting) data so that it can't be read unless you have the right key. It's critical for good security. the data – that is, scrambling it in a way that can be reversed only if you have the right key.

There are two kinds of key. We’re not going to get into the whys and wherefores yet, but the two types are private keysA key that should be known only by your device and, possibly, by someone or something else that your device is communicating with. It must be kept secret. and public keysA key that you (or your device) can publicly share with someone or something else. This key can be used only to encode (or encrypt) data; it can't be used to read that data. Each public key has a matching private key, and the private key is used for decoding (or decrypting) data. This lets you have a secure conversation with someone or something that you've never shared keys with before.. If you have, say, a conversation going between a device and the cloudA generic phrase referring to large numbers of computers located somewhere far away and accessed over the internet. For the IoT, computing may be local, done in the same system or building, or in the cloud, with data shipped up to the cloud and then the result shipped back down., then, with a private key, only the cloud and the device have the key. No one else is supposed to know that key. So it has to be well hidden and well protected. You can never just send the key to someone else, because if you did, someone might snoop that message and get the key – and then your secrecy is blown. Importantly, a private key will typically be pre-installed in a device that you purchase.

Public keysA number used to encrypt (or encode) information so that no one can read it. Keys are used when encoding and decoding. You shouldn't have to mess with keys yourself. are necessary so that your device can “talk” to someone it’s never talked to before. You can send someone a public key – one that anyone can see. Sounds crazy, right? Here’s the deal: each public key has an accompanying private key. If you give someone your public key, then they can encrypt a message using that key. They will not be able to read that message; in fact no one else will be able to read the message unless they have the matching private key.

So this way you can give away a key without letting other people see the messages encrypted by that key. It’s quite a clever system.

The IoT Device Life Cycle

In the beginning, a company designs a device. Maybe a thermostat. Maybe a “personal assistant” like the Amazon Echo. When the device design is verified to be complete, then it goes to manufacturing.

Manufacturing an IoT device is mostly like any other electronics manufacturing, with one exception: the key(s). The details here can vary, so I’m going to describe a typical situation. Each IoT device should have its own ID number, and that ID will be stored both in the device and in a databaseA structured way of storing data and relating different pieces of data to each other. (Like, which address belongs to which person.) There are “query” languages, the best-known of which is SQL, that let you enter data into the database, change data that’s already in the database, and retrieve data from the database.. (We’ll talk about why we need the database in a sec.) In addition, each device will have its own private key so that it can engage in secure communication from the outset. That key is also stored in the database.

Why do this? Well, I mentioned that, if you have a conversation, both ends need to know the key. If you have a private key, then both ends need that private key – without you sending it to them (which could be snooped). When you first plug in your device, you’re going to have a conversation with the cloud – more about that in a minute. The point is, the cloud needs that key so it can understand the conversation.

This manufacturing step is called provisioningThis is a manufacturing step where your IoT device gets its own private key. The key and your device's ID are likely stored in a database so that your device can be recognized when you connect for the first time., because it provides the unit with an identity and a key.

Then the device is shipped to sellers, and someone like you purchases it. The next step is to connect to the cloud to register your device (which we’ll describe in a mo). After that, you’re using your device, and you may have software updates that can improve how your device works or make it more secure.

Finally, when you’re done with your device, it’s best if it’s decommissioned – that is, taken out of service.

Make Sure You Have a Unique Key

Let’s be clear about one thing: you want your IoT device to have a unique key. Device-makers have been slow to roll out security (it’s getting better), and one short-cut way is simply to use the same key in every device. Then you don’t have to worry about which individual unit has which key – they’re all the same.

But what if someone cracks the key on one of the units? Then they have the key to every unit if all units have the same key. This is why it’s better for each unit to have its own individual key. If someone cracks the key to that device, they get into only that device. Depending on their intent, that might remove some (but not all) incentive to break in.

Of course, the complication then is that you need this database that keeps track of which unit has which key. That database then goes to the cloud for use in on-boardingThis is the process of connecting an IoT device for the first time. You connect to a network, and then the device connects "home" for registration and for confirming that the device is legitimate..

One critical final point before we talk about the next step, then: you should never have to mess with the keys yourself. This should all just happen automatically. It’s good for you to understand something of what’s going on – that’s why we’re having this conversation. But the keys should be completely transparent to you.