Neuropil - Secure Interaction for Things
CC Attribution 2.0 Belgium:
You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal purpose as long as the work is attributed to the author in the manner specified by the author or licensor.
Schwichtenberg, Stephan
CHALLENGE The exchange of data between applications continually raises concerns as to the authorization and dynamic network of devices. In particular, within the realm of IoT, some messaging paradigms are used which from a security perspective offer little to no value. Closed systems arise, yet the future data value remains unclear. Additional project and integrations costs are a direct result of delays in connections. Data quality, data transparency, and data sovereignty of users, companies, and organizations suffer as a result of this. SOLUTION What is Neuropil? We all have it in us: The fibrous network of tissue which forms the gray matter in our brain. Neuropil facilitates the networking between individual cells. It is in this manner that the Neuropil layer, an open source solution, assures the stable communication between machines and applications. What makes it so unique is that the secure exchange of data between the IoT devices and applications is dynamic, decentralized, and fully automated. The Neuropil® layer, therefore, ensures data quality, data transparency, and data sovereignty all the while reducing IT costs, maximizing availability, and increasing reliability. A secure IoT is a crucial prerequisite for secure collaboration and competitive businesses. The Neuropil® layer provides: - Automatic discovery of data channels across enterprises - Attribute based access control to authorize data exchange - Asymmetric end-to-end encryption between the participating systems - Protection of IoT devices regarding excessive payloads - High scalability without central infrastructure - Centralized governance, but decentralized messaging The neuropil messaging layer combines several proven IT concepts, but rearranges them to accomplish a secure interaction of things. The combination is a mixture of MQTT, VPN and DNS, with a strong focus on privacy (meta-data obfuscation) and security (double encryption). Unlike other pure messaging systems we have designed our solution without additional components. Each system or application, which uses the neuropil messaging layer becomes part of an overlay network. Most encryption solutions are designed to protect two communicating parties using a direct connection. The neuropil messaging layer accounts for intermediate hops within the (overlay) network. It defines a routing and discovery protocol to automatically exchange required security credentials or other information. Due to this approach it is possible to address fingerprints of identities (belonging to a system, person or device), without prior exchange of IP addresses or certificates. This eases the setup and build-time to a minimum and reduces the time to market of IoT solutions. What makes it so unique is that the SECURE exchange of data between the IoT devices and applications is DYNAMIC, DECENTRALIZED, and FULLY AUTOMATED. Furthermore, it is highly SCALABLE without needing a central infrastructure. DYNAMIC: We have a strong focus on attribute-based authorization supported by digital identities for devices, applications and users alike. Compared to other systems this allows neuropil® messaging layer to establish highly secure connections that are dynamic and can, therefore, be changed at any time. DECENTRALIZED: Moreover, traditional messaging systems cover the horizontal value chain within a single enterprise and its internal connections. Neuropil® messaging layer on the other hand can work throughout different organisations and systems (vertical), greatly reducing legislative burdens. As an example it enforces technical SLAs (i.e. the number of messages a second party may send into your IT infrastructure) and follows a decentralized, distributed network setup (please see attachment for visualization), which eliminates single points of attack. Combining a dynamic and decentralized system allows neuropil® messaging layer to cut down project costs. This includes development and collaboration transaction costs, while new B2B connectivity can be setup within several days rather than several months.
 Hello everybody, welcome to my talk. I wanted to share a little story with you, which happened to me while I was hitchhiking with Marvin and Eliza a few weeks back. And you know what happened? So Eliza very soon during the hitchhike started to talk to the train computer, to other laptops, to everything that she could talk about. And Marvin all the time said, oh, it's not secure. We have to do something. And it's, he was really upset about the safety and security that we were running in. And then I finally asked Marvin, so what would you use to secure the communication channels? And he said, yeah, well, you have to use European. And I said, what is European? And he started and said, it's a very small library. It's a C library that you can install on any device and you can use it as a library in an application. And it's working in a decentralized scalable way. And it is, it's doing security and it follows a security and privacy first by design approach. If you would like to compare it, he gave me like four, four different protocols. And I don't know if you have heard of them. I'm not that technical. So who of you have heard of OpenSSL? That should be fine. MQTT. So virtual private networks. Okay. And last but not least, WeaveNet. Nobody. That's astonishing. And I said, why, why do I need this strange combination of protocols and stuff? And he said, okay, I will give you an example why you need it. If you take, for example, a factory and you have a robot arm, then you have to be aware that as soon as you add a connection, an external connection, the security context of the whole factory changes. So if you add a connection to an insurance company, you have to review your whole security concept. And he said, you could do it the other way around. You can follow directly a very high security approach and then you don't have any problems later. If the robot arm moves to a different factory, you would like to have very small setup times, but still have a high security. And we can focus more on the robot arm and take a look at its interactions with the robot company on the maintainer on the left side. And basically you have the robot arm and he needs obviously some information about the product it has to produce. For example, the cell phone, right? So to this cell phone product information, there is a data owner. Now the robot doesn't have a connection to a second robot, so he uses this cell phone to store some information, to push it to a separate robot arm. Nobody else should read this data, so he will encrypt the data for the second robot arm. Unfortunately, the second robot arm discovers there's something wrong in the production process. So he shares this data with the maintenance engineer and suddenly the context has changed and you need to do a group encryption actually with the robot arm one so that the maintenance engineer and the robot two can read this data. And if the maintenance engineer would like to repair something, he has to call out to the robot company to get the authorization. The robot company has to talk to the robot one and say the maintenance engineer is now allowed to alter some data and finally then the maintenance engineer can fix the production procedure of the robot one. So what's important on this picture is that there are three different data sets and each data set has a different data owner and for each data owner you have different authorization and authentication rules. Let me have a look at the note that Marvin gave me. So we just stretched the surface of possible interactions that we have. You could say you could place the robot arm, you could replace it with a medical device and the factory with a hospital and then you will see how critical the encryption and or at least signing of data is and how important data ownership is. If you ask what could go wrong, then you will see a lot of things will go wrong or can go wrong. Producing wrong products or operational interaction is very critical at least in the industry. So you should really care about security first for your production lines. So what's on top of what I already said what is Neuropeal. Neuropeal is a networking library which is giving you digital identities and we annotate these digital identities with attributes. So we are exploring attribute-based distributed security concepts and also attribute-based encryption which is new in the field. We cover, we do a lot of things to upfuscate our protocol metadata and we also focus on partly encrypting payload data to protect some parts. What you can do with it in the end is that you are able to set up very easily a virtual-private network per data object. So you have a very fine detail of sharing data with other persons but it just takes seconds to set this up. So at the end of our trip I said Marvin if this is all that secure and everybody should use it then it doesn't pay out to keep it in the secret. You have to make it A, open source and B you need a security peer review and that is basically also the reason why we are here. So our new release is now available on GitHub and we are looking for corporations or for your feedback so that we can improve the protocol and that we can take the next steps and grow hopefully an open source community around our protocol. That's already from my side. Thank you for your attention. Thank you. So we have plenty of time for questions. If anybody has a question please raise your hand. I'll bring you in the mic. No question? Well, thank you. If you have any questions I'm outside and you can see me on my shirt.
 Hello everybody, welcome to my talk. I wanted to share a little story with you, which happened  to me while I was hitchhiking with Marvin and Eliza a few weeks back. And you know what  happened? So Eliza very soon during the hitchhike started to talk to the train computer, to  other laptops, to everything that she could talk about. And Marvin all the time said,  oh, it's not secure. We have to do something. And it's, he was really upset about the safety  and security that we were running in. And then I finally asked Marvin, so what would  you use to secure the communication channels? And he said, yeah, well, you have to use European.  And I said, what is European? And he started and said, it's a very small library. It's  a C library that you can install on any device and you can use it as a library in an application.  And it's working in a decentralized scalable way. And it is, it's doing security and it  follows a security and privacy first by design approach. If you would like to compare it,  he gave me like four, four different protocols. And I don't know if you have heard of them.  I'm not that technical. So who of you have heard of OpenSSL? That should be fine. MQTT.  So virtual private networks. Okay. And last but not least, WeaveNet. Nobody. That's astonishing.  And I said, why, why do I need this strange combination of protocols and stuff? And he  said, okay, I will give you an example why you need it. If you take, for example, a factory  and you have a robot arm, then you have to be aware that as soon as you add a connection,  an external connection, the security context of the whole factory changes. So if you add  a connection to an insurance company, you have to review your whole security concept.  And he said, you could do it the other way around. You can follow directly a very high  security approach and then you don't have any problems later. If the robot arm moves  to a different factory, you would like to have very small setup times, but still have  a high security. And we can focus more on the robot arm and take a look at its interactions  with the robot company on the maintainer on the left side. And basically you have the  robot arm and he needs obviously some information about the product it has to produce. For example,  the cell phone, right? So to this cell phone product information, there is a data owner.  Now the robot doesn't have a connection to a second robot, so he uses this cell phone  to store some information, to push it to a separate robot arm. Nobody else should read  this data, so he will encrypt the data for the second robot arm. Unfortunately, the second  robot arm discovers there's something wrong in the production process. So he shares this  data with the maintenance engineer and suddenly the context has changed and you need to do  a group encryption actually with the robot arm one so that the maintenance engineer and  the robot two can read this data. And if the maintenance engineer would like to repair something,  he has to call out to the robot company to get the authorization. The robot company has  to talk to the robot one and say the maintenance engineer is now allowed to alter some data  and finally then the maintenance engineer can fix the production procedure of the robot  one. So what's important on this picture is that there are three different data sets  and each data set has a different data owner and for each data owner you have different  authorization and authentication rules. Let me have a look at the note that Marvin gave  me. So we just stretched the surface of possible interactions that we have. You could say you  could place the robot arm, you could replace it with a medical device and the factory with  a hospital and then you will see how critical the encryption and or at least signing of  data is and how important data ownership is. If you ask what could go wrong, then you will  see a lot of things will go wrong or can go wrong. Producing wrong products or operational  interaction is very critical at least in the industry. So you should really care about  security first for your production lines. So what's on top of what I already said what  is Neuropeal. Neuropeal is a networking library which is giving you digital identities and  we annotate these digital identities with attributes. So we are exploring attribute-based  distributed security concepts and also attribute-based encryption which is new in the field. We  cover, we do a lot of things to upfuscate our protocol metadata and we also focus on  partly encrypting payload data to protect some parts. What you can do with it in the  end is that you are able to set up very easily a virtual-private network per data object.  So you have a very fine detail of sharing data with other persons but it just takes seconds  to set this up. So at the end of our trip I said Marvin if this is all that secure and  everybody should use it then it doesn't pay out to keep it in the secret. You have to  make it A, open source and B you need a security peer review and that is basically also the  reason why we are here. So our new release is now available on GitHub and we are looking  for corporations or for your feedback so that we can improve the protocol and that we can  take the next steps and grow hopefully an open source community around our protocol.  That's already from my side. Thank you for your attention.  Thank you. So we have plenty of time for questions. If anybody has a question please raise your  hand. I'll bring you in the mic. No question? Well, thank you. If you have any questions  I'm outside and you can see me on my shirt.
Neuropil_-_Secure_Interaction_for_Things_Elevating_Security_for_IoT_with_the_First_Decentralized_Op__0_167.png Neuropil_-_Secure_Interaction_for_Things_Elevating_Security_for_IoT_with_the_First_Decentralized_Op__168_1211.png Neuropil_-_Secure_Interaction_for_Things_Elevating_Security_for_IoT_with_the_First_Decentralized_Op__1212_2963.png Neuropil_-_Secure_Interaction_for_Things_Elevating_Security_for_IoT_with_the_First_Decentralized_Op__2964_4175.png Neuropil_-_Secure_Interaction_for_Things_Elevating_Security_for_IoT_with_the_First_Decentralized_Op__4176_4259.png Neuropil_-_Secure_Interaction_for_Things_Elevating_Security_for_IoT_with_the_First_Decentralized_Op__4260_4607.png Neuropil_-_Secure_Interaction_for_Things_Elevating_Security_for_IoT_with_the_First_Decentralized_Op__4608_5663.png Neuropil_-_Secure_Interaction_for_Things_Elevating_Security_for_IoT_with_the_First_Decentralized_Op__5664_6731.png Neuropil_-_Secure_Interaction_for_Things_Elevating_Security_for_IoT_with_the_First_Decentralized_Op__6732_7403.png Neuropil_-_Secure_Interaction_for_Things_Elevating_Security_for_IoT_with_the_First_Decentralized_Op__7404_7943.png Neuropil_-_Secure_Interaction_for_Things_Elevating_Security_for_IoT_with_the_First_Decentralized_Op__7944_10115.png Neuropil_-_Secure_Interaction_for_Things_Elevating_Security_for_IoT_with_the_First_Decentralized_Op__10116_11759.png Neuropil_-_Secure_Interaction_for_Things_Elevating_Security_for_IoT_with_the_First_Decentralized_Op__11760_11878.png