You are now visiting the Signify website. A localized version is available for you.
Signify logo
Suggestions

    Light Your World Blog

    For smart street lighting security, think authentication

    October 10, 2019
    night-smart-city

    According to leading industry analysts, cybersecurity and data security remain a key focus for cities who are deploying connected street lighting systems as part of a new or ongoing public Internet of Things (IoT) initiative. In their Global Smart Street Lighting & Smart Cities: Market Forecast (2019 – 2028), to give just one example, analysts Northeast Group identify cybersecurity as an issue for all smart infrastructure projects. This is true in many cities, including those where ownership and management of smart street lighting is migrating from the utilities—who can often draw on several years of experience protecting data, deploying firewalls, and developing effective defenses—to the municipalities, who may possess less expertise.

     

    As connected street lighting systems proliferate and become more deeply embedded in smart city initiatives, security implementations, processes, and responsibilities become more crucial and therefore more valuable. And because connected street lighting can transform the public lighting infrastructure into a pathway for collecting data and delivering smart services that can make cities more efficient, livable, resilient, and prosperous, the need for protecting confidential data and city assets increases. Cities must ensure that their connected systems are designed with proper security measures in place, and that they are properly deployed by installers and operated by end-users.

    checking-phone

    The importance of authentication in connected street lighting systems

    The security discussion around smart street lighting often focuses on encryption methods to ensure secure communications—with good reason, especially where cities are uploading collected data from different smart city vertical applications to the cloud for analysis, learning, and systems integration. But secure communications is only one piece of a much larger puzzle, which includes governance for security and data privacy, compliance with international standards and best practices, and perhaps most importantly of all for smart public infrastructure implementations, robust authentication methods that restrict access only to authorized users. Such methods can be further strengthened by tracking which users have accessed the system, when, and for how long—information that can aid forensics in case a security breach occurs.
     
    As Rafal Han and Simon Rzadkosz of wireless lighting controls manufacturer Silvair explain, in an article published in LEDs Magazine, authentication prevents unauthorized access to the lighting control infrastructure: “A smart fixture needs to be sure that a command it receives originates from an authorized entity . . . the integrity of the exchanged data must be ensured—so that no one can alter the message before it reaches its recipient.” Han and Rzadkosz also identify authentication as a crucial aspect of the onboarding process, “preventing potential intruders or Trojan horses from sneaking into the system when a new device joins the network.”
     
    According to security experts at organizations such as the U.S. Department of Energy and OWASP, improperly secured connected lighting systems may be at risk for attacks such as sniffing, denial of service, command injection, and vectoring. Vectoring is especially troubling, as an intruder who enters by way of one unsecured system may be able to gain access to other networked systems—including those that store sensitive and private data.

    A smart fixture needs to be sure that a command it receives originates from an authorized entity... the integrity of the exchanged data must be ensured - so that no one can alter the message before it reaches its recipient"

     

    Rafal Han and Simon Rzadkosz
    Silvair, wireless controls manufacturer

    Cities must collaborate with vendors who know system security—like Signify

    As Northeast Group points out in their smart street lighting forecast, cities must work together with vendors who understand cybersecurity and who embed appropriate security measures in their systems and solutions.

    At Signify, we take cybersecurity seriously. We have years of experience with deploying connected street lighting systems in hundreds of municipalities around the world, with both our Interact City and CityTouch connected LED lighting systems and management software.
     

    Signify takes a comprehensive, organization-wide view of security, employing state-of-the-art approaches in governance, design and development, deployment, and operations. Among the dozens of individual measures in place, the following touch specifically on authentication and preventing unauthorized access or system control:
     

    • Unique device identity and certificates
      System users are assigned different levels of access depending on authorization. Customer-specific data cannot be accessed by unauthorized users. Mobile and cloud services employ certificate pinning for encrypted communications using transport layer security (TLS).
    • Multi-factor authentication 
      When two-factor authentication is enabled, access requires a user’s password plus a verification code. Users are informed of all unsuccessful login attempts and the last successful login. After several unsuccessful login attempts, a user account will be blocked for a short period of time to protect against brute force attacks. If a user forgets to log out, the session automatically expires after a period of inactivity.
    • Authentication using pre-shared keys and passwords
      Before data exchange can take place, devices exchange authentication keys that are securely delivered and stored in tamper-resistant locations.
    • Unique default password
      Default passwords are unique per device but are intended for initial testing, installation, and configuration operations only. Users are forced to change the default password upon first login or during installation.
    • Role-based access control
      Every user is granted exactly the access rights needed via a customized set of user roles. Users can only see data specific to their needs, and can only execute authorized operations, following the principle of least privilege (PoLP). Individual customer data is strictly segregated.
    • Authentication to protect debugging and firmware updates
      Debug interface communicate only with authenticated devices, and authentication is required prior to any firmware updates. Robust communications, either via cellular or RF mesh communications infrastructures, minimize the risk of partial updates that could leave the system vulnerable.
       
    Learn more about the many measures that Signify takes to ensure the security and privacy of connected systems and devices.

    Blogger

    Jonathan Weinert
    Jonathan Weinert

    Post tags

    security, data privacy, smart street lighting, smart city, cybersecurity, connected street lighting systems, Internet-of-Things, IoT, public lighting infrastructure, encryption, secure communications, smart public infrastructure, lighting controls, system security, Interact City, CityTouch connected LED lighting systems, authentication
    More tags
    Smart City
    October
    2019
    Jonathan Weinert

    Related posts

    Latest posts

    We'd love to hear from you

    Contact us