IoTopia Framework Aims to Bring Security to Device Manufacturers

IoTopia, a new framework for IoT security, aims to standardize the design, certification, deployment, and management of connected services and services, GlobalPlatform reports.

This initiative marks the latest effort to build on IoT security by the industry standards body, whose members work to ensure its specifications align with current and emerging market requirements. GlobalPlatform has 2,600 industry representatives from 90 member companies, and people around the world rely on its certified secure elements, which have been integrated in chip-enabled credit cards, smartphones, smart TVs, and control units built into vehicles.

As the Internet of Things continues to expand, so, too, do GlobalPlatform's efforts to better secure it, says executive director Kevin Gillick. "We're progressing farther into this world of interconnected devices everywhere," he explains. "The same component technology and the same security mindset is logically extensible into this new space."

The IoT is the "wild, wild west," Gillick continues. Device makers are entering the ecosystem and creating connected products without bringing security into the picture. Part of GlobalPlatform's effort involves sharing standardization to bring products to market faster, at a lower price. It makes more sense, he says, for manufacturers to invest R&D into a service they can build their brands around rather than in their own security architectures and certifications.

"There is a lack of a common IoT security framework," he adds. Device manufacturers don't have security at the core of their competence; many avoid it because of the bias that adding more protection will increase cost and time to market. The idea behind IoTopia is to help these makers implement a framework that helps them move forward wihout bring security experts.

"We're seeing a lot of industry associations crop up around IoT who talk a lot about requirements, talk about security and use cases, but don't tell you how to implement it into technology," Gillick says. "Moving from words and speech to something actionable and adoptable is [a gap] no one has been able to close."

IoTopia is based on four pillars. The first is security by design, which includes capabilities and features that define how secure components and APIs can be used with existing "secure by design" standards. The second pillar is device intent. IoTopia uses Internet Engineering Task Force's manufacturer usage descriptions and uniform resource identifier to manage device permissions and access on networks, GlobalPlatform explains.

"We want to make sure we have in place a simple way to answer important questions about the device," Gillick says. "What is this thing? Who is responsible for it? How do I protect it, and how do I protect my business? Is it doing what it should be doing? … There's no systematic way to go about doing that."

The third pillar addresses autonomous, scalable, secure device onboarding (SDO), as IoTopia will offer an open, standards-based secure onboarding process to streamline network administration. The fourth focuses on device life cycle management, including a range of capabilities to manage devices throughout their life cycles aligned with international regulations.

Related Content:

This free, all-day online conference offers a look at the latest tools, strategies, and best practices for protecting your organization’s most sensitive data. Click for more information and, to register, here.