В статье предложена количественная методика оценки реализуемости требований международных стандартов безопасности IoT (IEC 62443-3-3, IEC 62443-4-2, ETSI EN 303 645, Matter 1.4, NIST IR 8259 A/B) применительно к ресурсно-ограниченным системам «умный дом». Методика опирается на две метрики – относительный прирост себестоимости устройства и долю потребляемой памяти – с пороговыми значениями 5/20% и 30/80% соответственно. Сформирована матрица из 60 технических контролей и трех классов устройств (датчик L0, камера L1, шлюз L2); исходно 35% требований оказались невыполнимы для L0. На основе анализа пробелов разработан набор легких мер (DTLS 1.3 IoT-профиль, Flash-Encryption, кольцевой буфер логов, хэш-цепочка OTA и др.), не требующих аппаратного апгрейда. Перерасчет показал снижение доли невыполнимых требований до 5% для L0 и до 0% для L1 при сохранении функциональной эквивалентности базовым контролям.
The article proposes a quantitative methodology for assessing the feasibility of the requirements of international IoT security standards (IEC 62443-3-3, IEC 62443-4-2, ETSI EN 303 645, Matter 1.4, NIST IR 8259 A/B) in relation to resource-limited smart home systems. The methodology is based on two metrics – the relative increase in the cost of the device and the share of memory consumed – with thresholds of 5/20% and 30/80%, respectively. A matrix of 60 technical controls and three classes of devices (sensor L0, camera L1, gateway L2) was formed; initially, 35% of the requirements proved to be impossible for L0. Based on gap analysis, a set of light measures has been developed (DTLS 1.3 IoT profile, Flash Encryption, ring buffer logs, OTA hash chain, etc.) that do not require a hardware upgrade. The recalculation showed a reduction in the proportion of impossible requirements to 5% for L0 and 0% for L1, while maintaining functional equivalence to basic controls.
The article proposes a quantitative methodology for assessing the feasibility of the requirements of international IoT security standards (IEC 62443-3-3, IEC 62443-4-2, ETSI EN 303 645, Matter 1.4, NIST IR 8259 A/B) in relation to resource-limited smart home systems. The methodology is based on two metrics – the relative increase in the cost of the device and the share of memory consumed – with thresholds of 5/20% and 30/80%, respectively. A matrix of 60 technical controls and three classes of devices (sensor L0, camera L1, gateway L2) was formed; initially, 35% of the requirements proved to be impossible for L0. Based on gap analysis, a set of light measures has been developed (DTLS 1.3 IoT profile, Flash Encryption, ring buffer logs, OTA hash chain, etc.) that do not require a hardware upgrade. The recalculation showed a reduction in the proportion of impossible requirements to 5% for L0 and 0% for L1, while maintaining functional equivalence to basic controls.