We are a little tardy with this, but it is worth bookmarking in time for the upcoming RCR Wireless report and webinar on smart meters (October 19; sign-up here!), and memorialising for future IoT articles and reports. The GSMA’s new IoT SAFE standard, launched back in 2021, seeks to create some kind of order out of the chaos of IoT security. It enables device makers and service providers to use the cellular SIM as a standardised hardware-based ‘root-of-trust’ to authenticate and authorise IoT devices and protect IoT data.
A root-of-trust, in the context of digital security, implies a common technical component that can be relied upon to perform critical security functions. The National Institute of Standards and Technology (NIST) defines it as hardware, firmware, or software. The GSMA, representing mobile operators selling mobile comms, has placed this root-of-trust inside the trusty subscriber identity module (SIM), the integrated circuit that stores an international mobile subscriber identity (IMSI) number and related authentication keys, in cellular IoT devices.
The SAFE in IoT SAFE stands for SIM applet for secure end-to-end communication; developed as a JavaCard application, it works with all SIM form factors, including physical SIMs, embedded SIMs (eSIMs), and integrated SIMs (iSIMs). The point is to make the security mechanism in cellular IoT devices common and consistent, across the industry, in order to make the whole ecosystem more robust – “rather than using proprietary and potentially less trusted hardware secure elements implemented elsewhere within the device”, says the GSMA.
It explains: “The SIM is best suited to function as the hardware root-of-trust in an IoT device as it has advanced security and cryptographic features and is a fully standardised secure element, enabling interoperability across different vendors and consistent use by IoT device makers.” The technical jargon says the SIM integrates a “mini crypto-safe” to securely establish a (datagram) transport layer security (TLS/DTLS) session – designed to prevent eavesdropping, tampering, and forgery – with a corresponding application cloud/server.
DTLS is used for internet telephony, streaming, gaming, and VPNs, among other things. IoT SAFE provides services to enable IoT devices to “securely perform mutual DTLS authentication to a server using either asymmetric or symmetric security schemes”, says the GSMA; it means they can “compute shared secrets and keep long-term keys secret” and be provisioned and managed “from a remote IoT security service”. It means, also, that IoT applications do not need to worry about TLS security handshakes ‘under-the-hood’, says GSMA.
It writes: “Developers are free to focus on their IoT applications, knowing that the lower layers of the device OS Middleware are taking care of the secure connection establishment.” The IoT SAFE applet comes with #1 and #2 (official nomenclature) variants, where the first uses digital certificates for authentication of server and devices, and the second uses pre-shared keys for authentication in more constrained devices.
Luxembourg-based IoT connectivity provider (“with a security focus”) ZARIOT writes on LinkedIn: “Despite the emphasis [in IoT] on end-to-end security, there appears to be a lack of common standards for authentication of IoT devices. Piecemealing different facets of security from various solutions only increases IoT suite complexity. Leading to cost and time implications while hindering scalability and ease of management. This is where IoT SAFE comes in.”
US-based IoT MVNO KORE writes in a blog post: “Despite the importance of IoT security for enterprises, there is a shortage of universal standards for the authentication and authorization of IoT devices. IoT SAFEenables IoT device manufacturers and IoT service providers to use the SIM as a robust, scalable, and standardised hardware root-of-trust to protect IoT data communications.”
Elsewhere, UK-based Wireless Logic explains: “For organisations to protect both their devices and their users, there is a need to ensure data is transmitted securely to/from approved and authentic IoT devices only. This is where IoT SAFE comes in… [It] provides a means to uniquely identify devices for mutual authentication between devices and applications, and also governs the encryption of data to ensure that large-scale IoT and M2M deployments can be kept secure.”
For more on IoT SAFE and IoT security, in the context of smart metering, join the webinar on smart metering on October 19 with Telit Cinterion, Kigen, Transforma Insights, and Ubiik; sign up here, or by clicking on the image below.
