Introduction: The Need for Security
In today’s wireless computerized world, security is one of the most important considerations for product developers. Speaking candidly, hackers and cyber criminals are always looking for ways to break into our networks and products. These products can add convenience and safety to our everyday lives, but they can also make us vulnerable if they are not secure. Luckily there are standards bodies, like CSA (Connectivity Standards Alliance), that are looking out for our security by adding increased protection in their standard releases.
|
|
As time progresses, advancements in technologies and devices will make our smart homes smarter but also open new doorways for cyber criminals to enter, making system security a primary concern.
The Matter standard is a result of CSA and its members (Amazon, Google, Smart things, Apple, Comcast and many others) putting their heads together to address the issue of a fragmented smart home eco system. They created a solution that is interoperable from the wireless radio all the way up to the cloud interface and smartphone apps that interact with IoT devices.
Matter is the unified IP-based connectivity protocol built on proven technologies. It is helping connect, build reliable and secure IoT ecosystems. At launch, Matter will support communication over Wi-Fi, Ethernet and Thread. Bluetooth Low Energy (LE) will be used solely for onboarding purposes. Matter also assures that any object built on this standard is reliable by nature, secure by design, and compatible at scale. Overall, Matter is a game changer.
With Matter, consumers will be able to buy any Matter smart home device, and have it work with whichever platform they choose. So, consumers will no longer be constrained to a single platform like Apple HomeKit, Google Home, Amazon Alexa or Samsung SmartThings. Matter also eliminates the need to install dozens of apps to onboard devices – instead you will only need one.
Key Drivers for Matter
Interoperability: The Matter standard provides interoperability across all smart device players. Interoperability is critical to success in the IoT marketplace. Matter brings the connectivity cohesiveness the IoT requires – addressing both interoperability and connectivity. It also aids in freeing developers time so they can focus more on innovation at the application, product and hardware level.
Simplicity: For the consumer, the promise of Matter is a simpler buying experience. Consumers buying a product with the Matter logo will be assured the new product will be interoperable with their network, their smartphone and all other Matter IoT devices on their home network. Consumers will have more choices of products without the worry of it not working with other smart home devices.
On the other hand, it is a win for the retailers as they can offer a more simplified purchase experience, with less returns due to consumer network compatibility issues.
From a product developer’s standpoint, there is less worry about network ecosystem alignments when developing the product. They also no longer need to worry about creating firmware for their individual product stock keeping unit (SKU). It’s one product for all markets. Product development is made simple as all Matter code is available to any product developer. Having product developer’s base products on a common code base is not only simple for the developer, but also further strengthens interoperability. It means ease of integration. It also limits development overhead as only a single hardware (HW) and software (SW) SKU is needed to cover all customers, independent of them being an Apple HomeKit or Google Home user, or something else. This allows developers to focus their time on innovating their application use case and maximizing revenue instead of solving a connectivity puzzle.
Overall Matter is a win-win situation for consumers, retailers and developers.
Reliability: Besides interoperability and simplicity, the Matter standard is designed for reliability. How is this achieved? Matter takes a simple approach of using proven technology to achieve the goal of reliability. Instead of defining new protocols it combines existing technologies that are already matured and proven in the field – technologies such as IP communications are reused.
Adding to the reliability aspect of Matter is the use of a large community base made up of companies, major silicon vendors, standards bodies, developers and more – all involved in the discovery of SW and HW bugs, fixing those bugs and general transfer of knowledge. This makes overall development easier for all.
Open-Source: Matter software is open-source and is available to everyone. This helps with interoperability as all products are built using the same software and standard. Developers now have access to drop in code, development tools and CSA certification programs, which ensures interoperability across all vendors.
For a product developer it adds simplicity as they can easily swap component vendors without having to be confronted with a new API for each vendor. This also means product developers do not need to write or re-write code for their target application. This lowers cost and time to market. This also eliminates the burden of SW development (writing new or updating code) if a developer needs to move to another chip vendor.
Security: Matter takes security very seriously. Matter’s security architecture is based on best practices such as “security by design” and “zero trust”. Every device has a unique identity and every device joining the network is authenticated to ensure it is a legitimate Matter certified device. It’s important to note that every message sent by a Matter device is encrypted and authenticated. Each Matter device is certified and must provide a unique product code and ID before joining the users’ network. Additionally, that device can only work on that network once verified and enabled. Matter also institutes security to allow applications and network administrators to block non-authorized or non-certified devices.
Matter raises the bar on IoT security
Comprehensive: The built-in security in Matter ensures that every device is authenticated, every message is protected and over the air firmware updates are secure.
Strong device identity: A certificate is installed on the Matter device as a part of the commission process. No device can join the Matter network until it has been fully authenticated. This ensures full network security throughout all the devices simultaneously. Matter includes well tested algorithms and security techniques like public key cryptography. Users never need to transmit or reveal their private keys to anyone. The chances of cyber criminals discovering an individual’s secret key is much lower.
Easy to use for developer and user: Matter security makes the IoT product developers’ job easier when creating their devices. The Matter core provides open-source code, such as examples and test vectors for all security functionalities. All the tools needed are located in a GitHub repository with modularly defined software implementation of Matter security. Therefore, users and developers do not need to worry about security – it is just there!
Resilient by design: Matter tries to foresee and mitigate as many possible attack vectors as possible. Matter starts from the zero-trust idea and builds in security on each network layer. A malicious device with the Wi-Fi passphrase cannot eavesdrop on the application layer information because that is encrypted independently from the network layer encryption. It is resilient due to usage of message counters that make each encrypted message unique so it can’t be replayed. When a new communication is started, the Matter protocol establishes trust between the two nodes. This is based on the secure exchange of certificate credentials each node has and establishes trust between the two parties (Certificate Authenticated Session Establishment (CASE) session). This certificate is generated by the commissioning node during the commissioning process. Additionally, Matter is resilient against eavesdropping because of all the encryption and is resilient against possible security bugs because of the over-the-air update system.
Agile: Matter is agile and secure across all devices within the Matter network. Using crypto-flexibility, Matter can address new developments and threats. Its core specification abstracts all cryptographic primitives to give room for future specification versions. Matter’s modular design of the protocols also gives room to replace those with new protocols if future security risks arise.
Secure Commissioning in Matter
Since the onset of early IoT devices the customer commissioning process (adding a new device to your network) has been challenging. Every new device required its own app download and a learning of how to use it. But with Matter the struggles will improve substantially – let’s review using the image below.
How to integrate a Matter-based IoT device natively into an operating system.
Step 1: The consumer brings a Matter enabled device home. He or she opens or downloads a Matter or Matter enabled app onto their smartphone or tablet. The device is then powered on. This device power up is essential for Bluetooth communication from the phone application to the device.
Step 2: Each device comes with a unique QR code containing all the information required for discovery and identification of the device. Using a smartphone, the QR code can be scanned which will triggers the commissioning process and also act as an ownership check. Scanning the QR code triggers the commissioning process and a proximity check. The QR code is unique to every device. The QR code contains:
- The Vendor ID and product ID
Step 3: Once the device is discovered by the smartphone a secure channel (Password Authenticated Session Establishment (PASE) session) is created over Bluetooth LE using the 8-digit password also obtained from the QR code. Over this PASE session, the device identity can be validated by the smartphone.
Step 4: The Device Identity is validated by the smartphone by checking the validity of the Device Attestation Certificate (DAC) and the certification status of the device with the CSA.
Step 5: When the device is genuine, the commissioner provides it with a Node Operational Certificate (NOC) and the Matter network credentials. This NOC will identify the device on the Thread Network and will be the root of its communication security.
Step 6: Using the obtained NOC, the device will make itself discoverable on the Matter Network. The commissioner will once again discover the device and using the NOC will establish a highly secure CASE session. This makes sure that the network credentials and NOC were all correctly transferred.
Step 7: At his point, the device is onboarded on the Matter network and can be communicated with. Now your smartphone, tablet or voice command device can start controlling the end-node.
In closing, Matter has taken IoT security to another level not yet seen in the IoT ecosystem. It not only addresses security for the developer of the IoT device, but also provides the same level for the consumer using their product. Additionally, it addresses the users’ network security issues, while adding on simplicity and interoperability across the IoT ecosystem all the way up to the cloud.