Toward a Blockchain-based Platform to Manage Cybersecurity Certification of IoT devices

Abstract

The goal of this paper is to propose a blockchainbased platform to enhance transparency and traceability of cybersecurity certification information motivated by the recently adopted EU Cybersecurity Act. The proposed platform is generic and intended to support the trusted exchange of cybersecurity certification information for any electronic product, service, or process. However, for the purposes of this paper, we focus on the case study of the cybersecurity certification of IoT devices, which are explicitly referenced in the recently adopted Cybersecurity Act as one of the main domains where it is highlighted the need for an increased level of trust.

Internet of Things (IoT) Cybersecurity: Literature Review and IoT Cyber Risk Management

“…Some of the promising application areas of blockchain for the IoT include supply chains, smarter energy, and healthcare [34]. Blockchain can also be used to generate IoT security certificates for IoT devices to be deployed securely and automatically [35].…”

An Interledger Blockchain Platform for Cross-Border Management of Cybersecurity Information

“…The information to be considered could include data about recently detected attacks or vulnerabilities found on specific ICT artifacts. Based on this, our proposed platform acts as a cross-border information sharing tool where smart contracts 11 are used to support and regulate the sharing process in a harmonized and transparent way among the stakeholders.…”

“…The management of the consortium identities is intended to be performed using a smart contract, where the EU and national authority identities are registered following our previous work. 11 At EU level, the European Cybersecurity Certification Group (defined by the Cybersecurity Act) groups representatives of national authorities, and it is responsible for the identity management procedures and for validating transactions. It should be noted that the EU Cybersecurity Chain represents a trust anchor in our platform, in order to reach a tradeoff between the benefits provided by such as decentralized approach, and the need to consider main EU institutions to coordinate/manage the sharing ecosystem for cybersecurity information.…”

“…10 Furthermore, as described in the Section "Increasing Cybersecurity Awareness," the Cybersecurity Act mentions the need to provide additional information about an ICT artifact, including security guidelines and recommendations to help end users with configuration, installation, deployment, operation, and maintenance. For example, in the case of specific-purpose artifacts (i.e., IoT devices), the recent Manufacturer Usage Description (MUD) standard 14 could be used to foster a secure and automated deployment of a certain IoT device, as proposed by Neisse et al 11 An additional aspect is related to the software libraries that are part of the artifact. This information could help us to identify specific components that are affected by a cybersecurity issue or vulnerability.…”

“…While a network of national servers could be implemented to provide the same services (which in practice could be similar to a blockchain platform), the following section describes additional advantages of our proposed platform. It should be noted that this article is an extension of our previous publication, 11 which proposed a preliminary design for managing certification information without considering interledger concepts.…”