We recently spoke with Allen Storey of Intercede, on the back of the company’s announcement that it had been included in the UK government’s G-Cloud scheme. Public contractors for the UK government are now able to use Intercede’s MyID service to manage identities and security for government workers. Intercede, a 20 year old company of around a hundred employees, has a similar project in the USA, working with federal agencies and offering card reader and ID management services to enterprises. During our call, Storey told us that the systems for managing people’s identities are very similar to those needed to manage ‘things,’ leading us on a very interesting conversation regarding the future of ID systems in the IoT.
Before we dive into a collation of our interview topics, it’s necessary to outline exactly the kind of ecosystem that will be problematic if not addressed swiftly. Imagine a connected home, where a user has subscribed to a home automation package from their pay TV provider. The system is controlled by a smartphone talking to a central home hub, to control a range of lights, locks and environmental controls.
Although available off-the-shelf today, this sort of system is still too expensive for most consumers. Miniaturization and economies of scale should rapidly bring the price down, allowing more and more consumers the chance to live in a smart home ‘increasing the need for excellent security. So what happens when this connected identity, which is fully authorized and validated to access these smart home features, leaves the house and travels to work?
Public transport is moving towards digital ticketing, with travel cards and apps to authorize passengers becoming increasingly common. In the future, autonomous cars used on a pay-as-you-go basis or privately owned would require another highly secure method of identification. Storey gave the example of trusting your children to an autonomous vehicle, and how parents wouldn’t use a system they didn’t trust.
So once the person has arrived at work, how do you reconcile the private identity with the BYOD business identity? Do you trust the same validation tools that let a person into their home or ride the bus access a highly sensitive corporate file store, much less the door to a canteen?
This is where the security of the corporate network becomes paramount. Adding more devices to a network is often akin to adding more possible access points for malicious hackers looking for vulnerabilities in the network security. The ongoing debate regarding the merits of BYOD is always underpinned by a concern about network security. When you increase the number of connections exponentially, you increase the number of ways in for an attacker, and you can begin to see why the system admins might be uncomfortable with IoT installations numbering hundreds or thousands of connections.
Consequently, you can see the need for a secure system that can be trusted by both the private home and the corporate environment to provide secure access to a managed subscriber. The hardware level trust of any device, be it a window latch or a laptop, needs to secured from attack before the device leaves the factory.
Passwords and centrally stored log in credentials are vulnerable to attack, and it seems that not a week goes by without another high profile attack on a supposedly secure database that requires users to reset their passwords. Storey told us that passwords are the weakest link in almost every security system due to the humans required to remember and not lose them or scribble them on post-it notes.
But there is a new shift towards using a device like a phone as a hardware store for secure credentials that would not transmit passwords to verify against a central database. Two-factor authentication on the phone would verify the user via encryption keys, which can’t be intercepted or stolen and cracked to use ‘ unlike passwords. This allows a system to be almost certain that the cryptographic keys on the device can be trusted, as the hardware on the phone should prevent both copying and tampering.
So is this the answer? Much like GreenPeak CEO Cees Links, Storey believes that standards are an absolute necessity for any technology to succeed in IoT. The Fast Identity Online (FIDO) Alliance is an initiative that aims to further the field of ID verification in the digital world, of which Intercede is a member.
It aims to develop technical specifications that ‘define an open, scalable, interoperable set of mechanisms that reduce the reliance on passwords to authenticate users; operating industry programs to ensure worldwide adoption of the specifications; and submitting mature technical specifications to recognized standards organizations.’
The FIDO Alliance has a large number of prominent board members, including ARM, BlackBerry, Google, Lenovo, MasterCard, Microsoft, PayPal, Visa and of course Intercede. There are around 100 members who collaborate on ‘the interoperable infrastructure that enables authentication choice to meet the distinct needs of users and organizations.’
By moving the security mechanisms used to authorize identity into the hardware of the device, instead of an entirely software-based approach, a more secure two-factor authentication system can be developed. FIDO members collaboratively have a much more extensive portfolio for ID management, including ‘Trusted Platform Modules (TPMs), USB security tokens, embedded Security Elements (eSE), Smart Cards and BLE and NFC communication protocols. This of course means that the FIDO approach requires new hardware and software for businesses looking to meet the specification ‘ and here is the vested interest of adopting new FIDO standards.
So the FIDO Alliance members represent the new wave of security for both businesses and consumers. This vigilant approach is required for the connected world, and Storey stressed the importance of making the process as seamless as possible. For the consumers, which Intercede is now moving towards, the security of the smart home or autonomous car will be paramount, but the benefits which these products bring would be offset by lax security or log in processes that detracted from the ease-of-life benefits that home automation products sell themselves on. What use is the ability to open your front door remotely if it takes longer than reaching for your keys?
So the phone or personal wearable, on the back of a secure system such as Intercede’s MyID, becomes the ideal device to interface with the home hub and the office network. Consequently, security for this ubiquitous system is imperative, but this is where Storey reassured us that such a system was entirely feasible.
More importantly, Storey countered our concerns of the potential for national disaster or Orwellian surveillance by saying that such a system has no need to become a global or national deployment. He went as far as to say that it would be foolish to try and link all of the homes to all of the businesses in a country, noting that the unique requirements for each instance would produce a vastly over-complex structure ‘ whose very size would undermine the security of the system.
To finish our conversation, we asked what potential obstacles are in the way of such deployments, and Storey emphasized the importance of standards such as FIDO. He noted that as nobody has complete control of the internet, it becomes an issue of whether you can encourage the right people to adopt the standards. Storey is confident that the backing of the major players in the FIDO Alliance will be enough to see this through.
Intercede also released its yearly figures this week, announcing that sales had reached a record high of £10 million. The number of identities managed under MyID stands at 10 million, contributing to yearly profits of £0.8m with a record year end cash balance of £7.2 million with no debt. Intercede said this provided a firm foundation for its aggressive investment strategy. Customers included 4 of the top 6 aerospace and defense companies, with a number of US federal contracts, and a flagship mobile identity contract with Canada’s Telus MNO involving M2M specialist Gemalto.