As we return to the office, there is a growing reliance on devices to tell us how safe and secure the environment is for our return. And in specific application areas, such as Healthcare and Manufacturing, IoT data is critical for decision-making. In some sectors such as Health and Wellness, IoT devices collect personally identifiable information (PII). IoT technology is so critical to our current infrastructures that the physical wellbeing of both individuals and organisations can be at risk.
Trust & Data
IoT are also vulnerable to breaches if not properly secured. And with a significant increase in cybersecurity events over the last year, the reliance on data from IoT is driving the need for better data integrity. Security features such as data integrity and device authentication can be accomplished through the use of digital certificates and these features need to be designed as part of the device prior to manufacturing. Because if you cannot trust either the IoT devices and their data, there is no point in collecting, running analytics, and executing decisions based on the information collected.
We discuss the role of embedding digital certificates into the IoT device at manufacture to enable better security and ongoing management of the device.
Securing IoT Data from the Edge
So much of what is happening on networks in terms of real-time data collection happens at the Edge. But because of the vast array of IoT devices connecting at the Edge, there has not been a way of baking trust into the manufacture of the devices. With a push to get the devices to market, many manufacturers historically have bypassed efforts on security. Devices have been added on the network at different times from different sources.
There is a need to verify the IoT devices and secure them, making sure to have an audit trail on what you are connecting to and communicating with.
So from a product design perspective, this leads us to several questions:
- How do we ensure the integrity of data from devices if we cannot authenticate them?
- How do we ensure that the operational systems being automated are controlled as intended?
- How do we authenticate the device on the network making the data request?
Using a Public Key Infrastructure (PKI) approach maintains assurance, integrity and confidentiality of data streams. PKI has become an important way to secure IoT device applications, and this needs to be built into the design of the device. Device authentication is also an important component, in addition to securing data streams. With good design and a PKI management that is up to the task you should be able to proceed with confidence in the data created at the Edge.
Johnson Controls/DigiCert have designed a new way of managing PKI certification for IoT devices through their partnership and integration of the DigiCert ONE™ PKI management platform and the Johnson Controls OpenBlue IoT device platform. Based on an advanced, container-based design, DigiCert ONE allows organisations to implement robust PKI deployment and management in any environment, roll out new services and manage users and devices across your organisation at any scale no matter the stage of their lifecycle. This creates an operational synergy within the Operational Technology (OT) and IoT spaces to ensure that hardware, software and communication remains trusted throughout the lifecycle.
Rationale on the Role of Certification in IoT Management
Digital certificates ensure the integrity of data and device communications through encryption and authentication, ensuring that transmitted data are genuine and have not been altered or tampered with. With government regulations worldwide mandating secure transit (and storage) of PII data, PKI can help ensure compliance with the regulations by securing the communication channel between the device and the gateway.
Connected IoT devices interact with each other through machine to machine (M2M) communication. Each of these billions of interactions will require authentication of device credentials for the endpoints to prove the device’s digital identity. In such scenarios, an identity management approach based on passwords or passcodes is not practical, and PKI digital certificates are by far the best option for IoT credential management today.
Creating lifecycle management for connected devices, including revocation of expired certificates, is another example where PKI can help to secure IoT devices. Having a robust management platform that enables device management, revocation and renewal of certificates is a critical component of a successful PKI. IoT devices will also need regular patches and upgrades to their firmware, with code signing being critical to ensure the integrity of the downloaded firmware – another example of the close linkage between the IoT world and the PKI world.
Summary
PKI certification benefits both people and processes. PKI enables identity assurance while digital certificates validate the identity of the connected device. Use of PKI for IoT is a necessary trend for sense of trust in the network and for quality control of device management.
Identifying the IoT device is critical in managing its lifespan and recognizing its legitimacy in the network. Building in the ability for PKI at the device’s manufacture is critical to enable the device for its lifetime. By recognizing a device, information on it can be maintained in an inventory and its lifecycle and replacement can be better managed. Once a certificate has been distributed and certified, having the control of PKI systems creates life-cycle management.
Hitachi announced their plans to acquire US based software development company GlobalLogic for an estimated USD 9.6 billion, including debt repayment. The transaction is expected to close by end of July, after which GlobalLogic will function under Hitachi’s Global Digital Holdings.
GlobalLogic was founded in 2000, and the Canada Pension Plan Investment Board and Swiss investment firm Partners Group have 45% of ownership; with the remainder owned by the company’s management.
Hitachi’s Business Portfolio Expansion
The acquisition of GlobalLogic is a part of Hitachi’s move to focus and extend the range of Hitachi’s digital services business. As Hitachi aims to expand from electronics hardware to concentrate on digital services, they are looking to benefit from GlobalLogic’s range of expertise – from chips to cloud services. Silicon Valley-based GlobalLogic has a presence in 14 countries with more than 20,000 employees and 400 active clients in industries including telecommunications, healthcare, technology, finance and automotive. This will also expand Hitachi’s network outside Japan by providing them access to a global customer base and will boost their software and solutions platforms, including Hitachi IoT portfolio and data analytics.
The GlobalLogic deal follows another big acquisition of ABB’s power grid business by Hitachi in July 2020 to focus on clean energy and distributed energy frontiers. This makes Hitachi one of the largest global grid equipment and service providers in all regions.
Hitachi is also planning to divest parts of their portfolio such as Hitachi Metals, their chemical unit and their medical equipment business.
Ecosystm Comments
“Hitachi’s move to acquire GlobalLogic is very interesting and is in line with the growing trend of global Operation Technology (OT) vendors riding the wave of Industry 4.0 and ‘Product as a Service’ models – essentially, to move up the margin ladder with more digital services added on to their already established equipment business. Siemens, Schneider Electric, Panasonic, ABB, Hitachi and Johnson Controls are some of the prominent vendors who have taken pole positions in their respective industry domains, in this race to digitally transform their businesses and business models. Last year, Panasonic made a very similar move, taking a 20% equity stake in Blue Yonder, a leading supply chain software provider.
With rapid advancements in computing and communications (5G), it is now possible to converge the IT (Information Technology supporting enterprise information flows), the OT (Operational Technology – machine level control of the physical equipment), and the ET (Engineering Technology in the Product Design and Development space such as CAD, CAM, PDM etc.) domains. Three worlds that were separate till now. The convergence of these three worlds enables high impact use cases in automation, product, process, and business model innovation in almost all sectors, such as autonomous vehicles, energy efficient buildings, asset tracking and monitoring, and predictive and prescriptive maintenance. For the OT vendors therefore, it becomes critical to acquire IT and ET capabilities to become successful in the new cyber physical world. Most OT vendors are choosing to acquire these capabilities through strategic partnerships (such as Siemens with Atos and SAP; Panasonic with Blue Yonder) or acquisitions (such as Hitachi and GlobalLogic) rather than develop such capabilities organically in completely new domains.“
