User Authentication for the Internet of Things

The Internet of Things is coming to fruition, but current commercial offerings are dramatically insecure. The problem is not that many individual devices are vulnerable, but that there are billions of such devices and yet no concerted plan to make them secure. Since the IoT is here to stay, and will pervade the fabric of our society in a way that will make it impossible for any individual to opt out without retiring to a cave as a hermit, we must address the problem structurally, rather than with local band-aid fixes. This short position paper presents the basic requirements for a scalable user authentication solution for the Internet of Things. We hope it will stimulate a discussion leading to a coherent user authentication architecture for IoT. Our vision is that even the lowliest and most inexpensive of IoT devices ought to offer such basic security properties, but this will only happen if they are agreed upon and designed in from the start.

1. 1.

   The Mirai botnet, which attacks IoT Linux-based IP cameras and home routers, is the one that most people remember, at the time of writing, but it is by no means an isolated incident.

2. 2.

   https://www.gov.uk/government/publications/secure-by-design.

3. 3.

   Confidentiality is the property of a system in which certain information may only be read by authorized users. Integrity is the property of a system in which certain information may only be altered by authorized users, and in compliance with designated constraints. Availability is the property of a system to which authorized users have access, with designated guarantees, regardless of attempts by unauthorized users to deny such access.

4. 4.

   Don’t believe in airgaps.

5. 5.

   SPW 2011, LNCS 7114.

Frank Stajano is grateful to the European Research Council for funding the past five years of his research on user authentication through grant StG 307224 (Pico).

Authors and Affiliations

1. University of Cambridge, Cambridge, UK

   Frank Stajano

2. Capgemini, London, UK

   Mark Lomas

Corresponding author

Correspondence to Mark Lomas .

Editors and Affiliations

1. Masaryk University, Brno, Czech Republic

   Vashek Matyáš

2. Masaryk University, Brno, Czech Republic

   Petr Švenda

3. University of Cambridge, Cambridge, UK

   Frank Stajano

4. University of Hertfordshire, Hatfield, UK

   Bruce Christianson

5. Memorial University of Newfoundland, St. John's, NL, Canada

   Jonathan Anderson

Reprints and permissions

© 2018 Springer Nature Switzerland AG

Policies and ethics