Software Engineering Institute

Despite its use of Internet of Things (IoT) devices in supervisory control and data acquisition (SCADA) systems and its interest in using such devices in tactical systems, the Department of Defense (DoD) has been slow to adopt IoT. In particular, the DoD is reluctant to use commodity IoT devices, especially in tactical systems, because of untrusted supply chains and a growing number of reported vulnerabilities in these devices. At the same time, the DoD recognizes the rapid pace at which the IoT commercial marketplace is evolving, and the department's urgency to embrace commodity technologies to match its adversaries.

The proposed solution moves part of security enforcement to the network to enable the integration of IoT devices into DoD systems, even if the IoT devices are not fully trusted or configurable, by creating an IoT security infrastructure that is provably resilient to a collection of prescribed threats. It uses

• software-defined networking (SDN) and network function virtualization (NFV) to create a highly dynamic IoT security framework
• überSpark (a framework for building secure software stacks) to incrementally develop and verify security properties of elements of the software-defined IoT security infrastructure