As the world is becoming more connected to the internet than ever before, the security and privacy concern of devices and wearables is rapidly growing amongst the end-consumer. There has been a rise in the amount of personal data that is becoming entrusted to an increasing number of connected services and devices; especially in cases where clothes and traditional offline devices are now becoming connected.

Consequently, Margot James, Minister of State for the department for Digital, Culture, Media, and Sport, has launched plans for a new labelling scheme that she is hoping will become mandatory after a consultation held by the government. The label is to increase the end-consumer’s awareness of how secure their products that are classified as the Internet of Things (IoT) or consist of sensors such as a radio frequency identification (RFID) label actually are.

RFID technology has already embedded itself into the textile and apparel supply chain and has aided in streamlining the supply chain and transforming inventory management as it does not require human line of sight and reduces the risk of human error significantly. However, aside the benefits, RFID technology has become renowned for its substantial amount of security issues, end-user privacy concerns and high susceptibility to attacks.

The key issue with an RFID attack is that, in any circumstance, the attacker will have established several credible methods to hack the operations of the RFID tag or reader due to its simplistic structure. Developing any Industry 4.0 technology opens up the risk of being attacked due to the smart, connected, or interactive nature of these products as hackers have access to similar kinds of technology to use for an attack.

Furthermore, there has also been a rising concern over end-consumers that may have purchased a garment or product that has an RFID label attached to it. At the moment, RFID labels have limited visible information to advise the customer that it is vital to tear the label off after purchasing or warnings of consequences if they don’t. For example, if a person is wearing an RFID label that is attached to their clothes, an attacker could hack the RFID label to track them back to their house.

Therefore, the new labelling scheme is proposed to inform end-consumers how secure products are. Thus, retailers will only be able to sell products with an IoT security label. The proposed information will improve security features and ensure end-consumers will have improved security information.

The open consultation is focused on delivering three key security requirements that is now published in the ‘Secure by Design’ code of practice which includes:

  • IoT device passwords must be globally unique and not in any way resettable to a factory setting
  • Manufacturers of IoT products will need to provide a public point of contact as part of a vulnerability disclosure policy
  • Manufacturers have to explicitly state the minimum length of time of how long the device is said to receive security updates until its end of life policy

The consultation is open for device manufacturers, IoT service providers, mobile application developers, retailers, academics and technical experts:

  • Device Manufacturers – responsible for manufacturing the interconnected final product that may or may not contain elements from other manufacturers
  • IoT Service Providers – providers of services such as cloud storage, data transfer, interconnected devices, or networks as part of IoT solutions
  • Mobile Application Developers – providers of applications that run on mobile devices and are offered as a means of interaction for the end-consumer
  • Retailers – sellers of interconnected products and services associated with end-consumers
  • Consumer groups, academics and technical experts that may have direct or indirect interest in consumer IoT security

The consultation for the proposals of new legislation regarding IoT end-consumer security is currently open for five weeks running from 1 May 2019 until 5 June 2019. The consultation has been published alongside a consumer survey report with results from 6,482 UK participating consumers, to test label designs, in order to put this forward as evidence for the new standards.

The security label will initially be launched as voluntary in order to help end-consumers identify products that have basic security features and those that do not.

Margot James, Digital Minister, has said: “Many consumer products that are connected to the internet are often found to be insecure, putting consumers privacy and security at risk. Our Code of Practice was the first step towards making sure that products have security features built in from the design stage and not bolted on as an afterthought.

"These new proposals will help to improve the safety of Internet connected devices and is another milestone in our bid to be a global leader in online safety.”

In support of this, technical director at the National Cyber Security Centre, Dr Ian Levy has said:

“This innovative labelling scheme is good news for consumers, empowering them to make informed decisions about the technology they are bringing into their homes.

“The consultation follows the government’s voluntary Secure by Design Code of Practice for consumer IoT security launched last year. The Code advocates for stronger cyber security measures to be built into smart products right from the design stage, and has already been backed by Centrica Hive, HP Inc Geo and more recently Panasonic.”

He continues: “The proposals come a day after Margot James held a roundtable on IoT security with global technology companies. As a result, Amazon, Philips, Panasonic, Samsung, Miele, Yale, and Legrand affirmed their commitment to taking steps to ensure that effective security solutions are being implemented across IoT products on the market.

“The Government is working with international partners to ensure that the guidelines drive a consistent approach to IoT security. The proposals set out in the consultation have the potential to impact security of devices made across the world to meet the UK’s future standards.”

However, according to David Orme, senior vice president at IDEX Biometrics, a provider of biometric identification and fingerprint sensor solutions, this is a short-term solution to what is becoming an increasingly urgent security problem.

“In today’s rapidly advancing digital landscape, where more and more devices are being connected through IoT, a higher level of authentication is required to protect connected devices vulnerable to hackers and current limited security measures, such as passwords which are no longer enough on their own.

Amazon, Philips, Panasonic, Samsung, Miele, Yale, and Legrand affirmed their commitment to ensure that effective security solutions are implemented across its IoT products on the market

“Manufacturers of IoT devices must look to incorporate biometric fingerprint authentication, so device owners can be safe in the knowledge that any orders have been authenticated only by them, mitigating malicious intent. One way of doing so is for banks and IoT manufacturers to work together, to integrate NFC PoS systems into IoT devices, so users can simply present their biometric smart payment card to authenticate orders with their fingerprint.”

He adds: “Biometric data stored in this smart card is virtually impossible for criminals to hack or intercept, and impossible for anybody that isn’t the card owner to replicate. The only person who can authenticate an action, permission or transaction, where biometrics are involved is the person whose fingerprint is held as a record on the device.”