Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form
IoT - or ‘Internet of Things’ - is changing the way we live and connect to the world around us. While enriching products and interactions, its rise carries far-reaching security concerns for all web technologies and services. On June 20, the foremost experts on IoT will field your questions live on-air!
Hello everyone, and welcome to Catchpoint's fifth live AMA, or "Ask Me Anything" on the Internet of Things: Security, innovation, and the future. My name is Robert Castley and I'm going to be your moderator today.
I am a senior performance engineer at Catchpoint for EMEA, and I've been with Catchpoint for over three years now. Little fun fact about me is that I've actually served three British Prime Ministers within my time. Not in the IT world, but back in my catering days. We have a few housekeeping notes before we kickoff on the AMA.
Let's start off by introducing today's AMA panelists. First, we have Vint Cerf. Vint is the Chief Internet Evangelist at Google, and Vint is recognized as one of the ‘Fathers of the Internet’. He shares this title with TCP/IP co-inventor Bob Kahn, and holds several honorary degrees. Those awards include the National Medal of Technology, the Turing Award, the Presidential Medal of Freedom, the Marconi Prize, and the membership in the National Academy of Engineering. Deep breath, that was a lot. A fun fact about Vint: in 1994, he got a one-page spread in People magazine, but in 1998, his wife, Sigrid, got six pages. I've always said, it's about quantity quality, not quantity. Great to see you hear today, Vint. Thank you.
Thanks so much for having me on the panel. I'm looking forward to this discussion.
Excellent. Next, I'm actually joined by a fellow British citizen, which means there are now going to be two British accents on this AMA this time. We have Andy Stanford-Clark, IBM Distinguished Engineer for the Internet of Things. Andy's also one of IBM's Master Inventors, which means, among other things, he invents lots of cool things and gets lots of patents. Andy's current role is Distinguished Engineer for IBM Watson Internet of Things platform, which means he works with clients to help them use IoT and understand where IoT comes into their business. A fun fact about Andy: he lives on a small island called the Isle of Wight off the south coast of England and keeps four llamas as pets. I've just got a dog, Andy, so I don't know how you look after all those llamas, but great to have you here. Thank you.
Thanks, Robert. It's great to be here.
Last but certainly not least, we have Dr. Sarah Cooper, General Manager of IoT solutions at Amazon Web Services, as well as Vice Chairwoman of the Internet of Things community, whose flagship conference, IoT Slam Live, kicks off in North Carolina tomorrow. We're very lucky for her to spare time with us today. Sarah was named an IS 50 Most Empowering Woman in Business, recognized Top 100 Wireless Technology Expert by Wireless World, a National Academy of Engineer Frontiers of Engineering awardee, multi-disciplinary entrepreneur, inventor of an IoT medical battery that runs on body temperature, and a PhD in Physics from the University of Sydney. That was another load of big words I had to deal with there. A fun fact about Sarah is that she started her first business at age nine, and then went on to charge interest on monies borrowed by those that provided a roof over her head. Great to have you here today, Sarah. Thank you.
Thanks, Robert. There's nothing better than interest from parents on pony money. I earned it.
Great! We have some fantastic questions submitted by the users that have submitted them over the last few weeks, so we'll dive right in. Vint, I hope you're ready. The first question is for you.
What are the security risks of IoT that you are most concerned about?
If I were a poet I'd start out: "How many security risks are there? Let me count the ways," but since I'm not a poet, let me just observe that probably the most significant risk is the lack of resistance in most of these devices to being accessed inappropriately or in an unauthorized way. We need strong authentication mechanisms to allow a device essentially to defend itself, either from inappropriate control or from exposing information to a party that shouldn't have access to it.
Just to show how tricky this can be, even something as simple as temperature information coming from every room in the house, accumulated over a period of five or six months, could give an observer some sense for how many people are in the house, what their diurnal patterns are, maybe whether they're home or not, and if you're planning to break into the house that could be useful information.
Access control, from my point of view, both to control and access the data, is the biggest security risk that I've been able to identify, but I'm very, very curious to hear what the other panelists have to say about that issue, so maybe we could go on to see what their thoughts are, as well? Sarah, especially.
Oh, boy! Security is certainly one of the biggest challenges to adoption. It also means everything to everybody. We could talk to device people; they want to talk about roots of trust all the way from Silicon all the way up. If you talk to application folks, they want to understand how behavior of devices in an ecosystem are changing.
I think one of the things that we need to be very clear about with security concerns is, what are we actually securing? Are we securing the value that IoT is providing, or are we really concerned about securing the action that those devices can take? There are plenty of IoT devices which are really sensing paradigms and not necessarily actuators. I think we need to separate out those different forms of security and think differently about how we build that into our infrastructure. Making sure rote devices aren't participating in decision analytics, for instance.
If I could add one thought to your comment about sensors, even if the device isn't actually taking control of anything, the webcams that were taken over and used to launch Denial of Service attacks against the Dyn Corporation are a good example of how a sensor can become quite abusive if you can aim a megabit stream. Half a million of those devices were used to target a five hundred and fifty gigabit per second attack against Dyn Corporation, which essentially knocked its servers over, so, even there, a sensor can be potentially damaging, even if you can't reprogram it to do something else.
Oh, I agree. I guess I meant more just that the technologies underpinning the security are different for those that are actuating physical processes. You're looking much more, for me, at the hardware at that point, and it's more important to consider what's happening on that specific device, versus the overall behavior of the system. For me, on a sensor network basis, the overall behavior of the system is a better indicator of whether something has been compromised, rather than any particular hardware fix. It's sort of bottoms-up versus tops-down approaches to security, and the segmentation of how that gets done in an ecosystem.
Yeah, and if I could just dive in there. At the other end of the chain, if you're designing IoT devices, then they've got to be designed from the ground up with security in mind. It's not an afterthought or a version two ... I've seen security added to a version two line item list in some to-be-unmentioned product. It really has got to be secure by design, and then you can start integrating all these technology you're talking about and actually have a fighting chance of building a secure device. That doesn't make it easier. It's still a really hard problem.
I know Andy wants to get on to other questions, but I can't help to make the observation that there will be bugs in the software, no matter what we do, and so another thing we have to account for is how a device can load new software to fix bugs. How does that device know that the software came from the right place and has integrity? Once again, another area of security is the ability to update the device safely.
It's Vint again. One observation I would make is that some of these devices, if they're in a residential setting, might actually not directly connect to the internet, but through, perhaps, a router or gateway or some sort of device to which you could add more filtering and control. Maybe a whitelist of IP addresses that that device is allowed to interact with, for example. That's part of it.
I think also we have to put the developers of these devices on notice that they really should meet certain criteria with regard to access control and a user should be warned about that. Maybe we're looking for cyber underwriter's laboratory seals of approval, or something, that investigates the device's ability to provide that kind of functionality.
Adding to that, since that it is in part developers who need to work on this, I think there's an expediency challenge, in that we don't make things easy, and it's not just about easy, but it's about what's most convenient. If it's most convenient to name your child's bedroom lightbulb, you know, "Jane's Bedroom Lightbulb," and somebody sniffing traffic can know when Jane's in her bedroom because the light's on, that's probably not a straightforward thing.
That also extends, by the way, into the industrial space. There's a UK smart meter incident where just before a bunch of smart meters went out, somebody realized it was in the design docs to use the same cert for all eighty-five million of them, just because that was an easy to manage process.
Whereas, experimentation is a formal method to generate new knowledge. You have a hypothesis and you try doing something, and you see what comes out of it. If your hypothesis is not supported by the data, then it's kicking off this form of exploration. The difference there is that, in generating new knowledge, we're looking at things that are much more complicated than you can reasonably expect an engineer to test. Because when you're testing something, you have to know what to test. Right? That's a given. You have to make an assertion on a known property.
That is expedient; it is not secure. Making sure that those things don't pass muster is another challenge.
There's an effort underway in the UK at the moment we've called the IoT Mark, to try and get together a set of guidelines where people can self-certify and comply with these things, and then would be allowed to carry a tick mark to say, "As far as we can tell, we've tried our hardest to comply with the best practices in the industry." Obviously, you shouldn't necessarily take that as a position of being able to trust it, but any that you don't have that mark, shouldn't trust it.
Then we get into this question about self-certification and do we trust the parties who post that mark?
Are they a third party, like underwriter's lab or something, that would evaluate what? The software, maybe? Maybe even the hardware and the software? This is a very tricky area, and the fact that we can get into a lot of trouble, or our customers can get into trouble, inadvertently. Puts quite a bit of pressure ... It should put a lot of pressure ... On the manufacturers of these devices.
Do you think that there's a need for ...? I'm going to ask my own question here. Do you think there's a need for a standard testing ...? I think of some of the most impressive testing software out there are things like Metasploit. Should we be figuring out how to crowdsource a security testing, so that things like back doors, which might be part of a legitimate dev process are found out before they go to production, and, if not before they go to production, at least there is a standard set of things that you could run your decision set across to see whether you end up with an open port or back door or ...
Yeah. Whether it's crowdsourced or not, I think a set of criteria that these devices should meet would be very helpful, and showing that to the manufacturers and then something to the users to say, "These criteria have been met." We're far from having that agreed and it clearly has to be global in scope, because these devices are going to come from everywhere.
Yeah, that's a really good question, and I've been working in IoT for maybe twenty years now, and started off where, basically, you say, "Internet of Things standards are like toothbrushes. Everyone knows you need one, but no one wants to use anybody else's." Everyone went off and invented their own one, which was a good thing and a bad thing, because it meant there are ... Good thing is you've got lots to choose from; bad news is you've got lots to choose from.
I think it depends where you are in the stack, how you can address interoperability. Obviously, if you plug your Ethernet in, then you know it's going to tour Ethernet, and then a level above that, thanks to Vint, et al., we know it's going to talk TCP/IP, so that you can ensure and end-to-end session level connection, and then we move up that stack another level, and start to merge HTTP and MQTT and our favorite messaging protocols for the Internet of Things. Fortunately, there seems to be some convergence there. With things like the standardization of MQTT and XMPP and CoApp and name your favorite poison, then at least you've got some to choose from, rather than people insisting on inventing their own wire protocols which, really, today you shouldn't be doing.
Then, above that, we start to look at all the semantic interoperability of devices, and I've been involved in the UK in an effort called HyperCat, which is looking at storing metadata about Internet of Things devices in a very easy to consume, machine readable way, so that at least to ... Particularly in smart cities, where you've got lots of different organizations coming together to make a "whole is greater than the sum of the parts" smart city out of a whole bunch of components, you at least have a fighting chance of finding what sensors people have got, what capability they've got, what units they broadcast in, what topic they're on, what their HTTP endpoint is, etc. Even if you don't then agree on what's being sent and other things, at least you can find out the where the phone directory part of it.
There are efforts underway, and I don't think it's down to one particular organization for them to do it. There are a lot of efforts by particular groups of industries where RosettaNet people have actually come together to create catalogs of schemas for messages so that they can inter-operate at a messaging level. I think it's a combination of best practices from the community, from the industry, standardizations ... I think it's very important to actually use a standards-based approach, rather than one you just happened to find in some document somewhere, so at least it's had the due diligence and attention of a standards organization, and build your stack from the bottom to the top using appropriate standards as you see fit, because there certainly isn’t "one size fits all" for this.
I wonder if I could jump in. First of all, we do see many different explorations of protocol stacks in the devices that are already available on the market and they do not confer interoperability. A lot of the makers of the devices are settling on IPV6 as a sort of a low-level agreement because there is a large address space there. As you get further up the stack, you get quite a bit of variation still.
There is one interesting institution called Schema.org, which is a place where a lot of the semantic standards can be represented, and I think Amazon, for example, has this notion of "skills," which are ways of referring to functionality of the devices. At Google, we call it "actions" on Google. I'm not sure ... IBM probably has a language for this, as well. It may be that all of those could be represented in the Schema.org structure, and that would allow us to achieve some inter-working at the command and function level.
We still need to come to some agreement about the other stack elements, which are generally invisible to the users, so I don't think the users will care very much about the specifics, but they certainly will care about being able to create an ensemble of devices from multiple brands that will inter-work with each other in an ecosystem, to borrow Sarah's word. I hope that there'll be pressure on all of us to achieve that commonality. Right now a lot of people are making devices hoping that their particular stack will be the international standard, which is an unlikely outcome.
Very unlikely outcome, yes.
I see a tension between interoperability and where we are in the maturity of IoT at the moment. This kind of follows from what happened with a lot of network functional virtualization too, which is, if you are a device manufacturer today, how do you make sure that your device doesn't become just a complete commodity? If you're a flow meter, a flow meter's a flow meter. What are you adding? What many folks have been adding is, a), a lock-in system on proprietary protocols and, b), some kind of an analytics platform off of just what they own in the ecosystem, which, if you're a flow meter company, is really just flow within the pipe, a very important, but generally a small bit of any larger process. As the refinery or the chemical plant goes to buy an IoT platform, they end up ripping off this analytics piece and ...
We've seen this in a lot of manufacturing customers where they are just trying to remove all embedded software and write their own across all the hardware vendors they bought, in order to deliver their own interoperability. I think, to me, the inflection point becomes when, as an ecosystem, we have the business contracts, when we have the data exchange and the digital rights management around insight and the value that's derived at the interfaces of IoT devices, that we will really start to see IoT interoperability. Because then the dollars that you can charge for something are no longer directly related to locking in a certain customer into your platform. At that point, those who deliver more value will actually be able to generate more income. Until that point, I think interoperability for a lot of vendors is a head-nod. They know they're going to have to do it. They probably know that if they don't figure out how to do it right, they won't be around much past the next ten years, but there's still some significant technology barriers, as well as business barriers, to making that happen.
God, I hope not. What a mongrel DNA collection this would be. Now, I have to give credit to my colleague at Google, Ray Kurzweil, whose book "The Singularity is Near" draws this question to our attention. Ray sees this proliferation of computing capability, Moore's Law and the sort of exponential growth of computing capacity, number of transistors per square centimeter, as evidence that we may get to the point where there will be human-level intellectual capability. Perhaps not necessarily arising out of a large number of devices, but rather out of highly concentrated and high-density kinds of computing systems.
I hope that that doesn't happen. I think my preference would be for all of these devices to simply become tools that we use in order to make our lives easier, to gather data that helps us and others properly function in the world we're in. To give you a good example, when you think about Google Maps and you're navigating, one of the interesting things is, if there's enough people navigating, then the feedback about how they're doing ... We have to track where they are, anyway, to give them directions. If we notice that there's a slow-down, we can relay that to everybody else, and warn them, because the sensing system has detected that. There's this utility in numbers. Those sorts of things, I think, are quite powerful, but I don't think I would imbue them with the level of singularity that the question implies.
Funny, Ray was on a board of one of the startups I did a couple years ago. This is the conversation ... That was the nanotechnology startup. This is the conversation that comes into play time and time again, each time we get one of these really interesting, emergent behavior type of industry that really touches almost across the board. In nanotech, we heard a lot about it and then it disappeared. It turns out, it's in everything now.
We just don't have a nanotechnology industry, per se. It's in the table; it's in my computer; it's probably in the coffee I just drank ... Nano caffeine. I think IoT very much is going to head the same direction. There was "pray!" and this whole sense that nanotech was going to have all of these nano machines running around. I think, for IoT, we're still pretty far off from truly a consciousness. There is ... It's not just about can there be an autonomous orchestration? It's really the reasoning over these complex systems. We don't do it terribly well, but I think there's a whole system of technologies and enabling foundation pieces that I don't believe are in place yet, but that might be the practical, industry side of me speaking. Unless Andy's already- [crosstalk]
All of the above. What I was going to say was that IoT used to be known as the basic computing or ubiquitous computing, and those two words very nicely describe the situation when IoT is kind of "made it," when you don't know it's there anymore. It's disappeared into the fabric of our lives. Everything from your lightbulb to your toaster to everything, it's obviously network connected. Why wouldn't it be? In fact, the whole Internet of Things will become quite anachronistic quite soon. It will either be "the internet" or "things." The idea of, why do you have to describe an Internet of Things? Of course all the things are connected to the internet, "Duh."
It's all around us and, of course, as you say, it may even be in your coffee, Sarah. That's not going away. The question is whether we, as a buying public, are prepared to accept and embrace the benefits that are being offered in return for what we have to give up in terms of privacy, security, giving up data. Having things around us to press buttons on, replace batteries in and all those kinds of things, literally. The overhead of having these things, what benefit do they bring? That's what we as a world, a population of the world, all have to decide.
I don't think intelligence is a zero-sum game. I don't believe that, as technology gets smarter, we get dumber.
That said, I do see where there is ... Our brains and our biological systems have developed over ... I think the most recent thing I saw was three hundred and fifty thousand years. They found a potential homosapien about three hundred and fifty thousand years ago. If we look at the amount and the pace of change in interaction technologies, just the things that we have to interact with; cell phones are the most obvious example. I don't know that our biology has caught up to our ability to game the system.
For instance, we need to multi-task in order to stay with modern productivity. Great. My phone multitasks super well; I, less so. If I'm checking email and then responding to something and then checking email again and then trying to ... At Amazon we write a lot of "working backwards" documents, working backwards from what the customer needs. It's very hard to write even a six-page document these days without checking my phone fifteen thousand times to see what I've got to respond to instantly.
I think that IoT will definitely ... In some respects, I think it'll exacerbate that sense of, "Hey! Attention!" Particularly before all of the devices are networked together. There isn't a lot of value to having a home security camera; you don't notice it's there, so that means it's got to send you a bunch of alerts. "Hey, your cat just jumped!" Wonderful! I don't need to know on my phone about it. What I would like to know is, is my house safe, but the psychology of the system means that I won't pay a subscription unless it's doing something that I can then recognize value from.
Once we've got a more networked and orchestrated environment through which we're walking through, I actually expect that we'll be over an inflection point and we'll see more interactions that aren't a screen, which is a hugely unnatural concept. There aren't a lot of 2D representations in nature that we interact with. I think we'll see more gesture control, more voice, certainly ... We're betting big on that at Amazon. I think those actually help our brains work more naturally, the way that they do.
Yeah, I think the whole screen thing was just a passing phase. I'm very fond of single pixel displays, the little ambient devices, [justrose] et al., to indicate something with glanceable display, rather than having to give all those pixels. That whole proliferation, the race to the top and race to the bottom of "how many pixels can you get?" Everything is, as you say, demanding our attention in ways which we were never designed for is quite unnatural. I'm much more fond of natural interactions along the lines you just said. Yes.
I think it's interesting the way Robert posed the question. I'm going to twist this around a little bit and suggest to you that, even if we suffer from the kinds of problems that Sarah outlines, at least in the initial stages of IoT deployment, if we ever get to ecosystem-like behavior, where your house is actually fairly intelligent ... I'll use that word kind of lightly, but it's aware of the various sensing information that it's getting, it can formulate a model of how the house is doing, whether it's heating, ventilation, security, or other things. The environment will become smarter, even if we're not, and it may be able to manage the environment that we're in more effectively.
In that case, once we believe we can rely on it ... That's a very important question ... We may relax a bit, just as Mark Weiser predicted this "ubiquitous computing" would just blend into the background: we wouldn't think about it.
I do have to say that I am a skeptic with regard to voice interaction, even though it works quite well in the case of Google Assistant and Siri and Alexa, for example. I find myself imagining that I'll have this debate about which lightbulb I'm trying to turn on, and I'll have to give them names, like George and Frank and Edward, and then I have to train my guests to know what the names of these various devices are so they can flush the toilet. Somehow this doesn't sound right to me, and precision may be the antithesis of the voice interaction if we want this to generalize for people who don't live in that particular house or are not in that particular building all the time. I'm still struggling with the utility of some of these modalities.
I would actually ... I think a lot of the voice will be much more useful when we have that semantic modeling that we were talking about a little bit earlier and that kind of functional equivalent. I don't have to say, "Turn on Lightbulb 7 on Row 3 in the kitchen."
I can just say, "Hey, I can't see," or the ambient light level is just matched, regardless of whether there's a bright window or floor lights. I think, to me, where we get to the point of intent ... Which is when gesture becomes useful, too, because gestures can mean lots of culturally different things ... I learned the hard way that [inaudible] ... Figuring out what the actual intent is, and then understanding the ambient background of that, I think is key to being interesting for anything that's outside of a screen, which is why we [inaudible] screens.
I have to ask, Sarah. Have you ever been in a room with an automatic light sensor and you've been quietly reading and the lights go out, and you have to go like that in order to say, "I'm here! I'm here, you [inaudible ;) ]! Turn the lights back on."
My office every day at 5 o'clock switches over from lights full-on to "if-she's-in-the-office" mode, and I'm always sitting there and it always goes off every fifteen seconds.
That’s a subject that's very dear to my heart, as well, but I think one of the applications we're going to see from machine learning in the near future is what we've literally just been talking about, is the ability to build a cognitive model or a context model of the user and the environment they're in.
If you take an example like "Tell me when my dad gets home" ... You've got a whole bunch of things there. "Tell me," so there's a mechanism for alerting. There's "My dad." Who's that? "Gets home." All those things, if you asked the average speech recognition system today, it wouldn't have any idea what you're talking about, but if you've got a contextual model, a worldview that's set up for me to give me that background, that worldview, and it can interact with that ... As sensor inputs come in, and when the front door in my dad's house gets activated and walks through the door, the model now knows ... I can say, "Tell me when that happens." "Oh, he's already got home." That I think is really where we're going to see a huge leap forward, in slightly frustrating request-response type action with these devices, to a more natural conversation where they seem to know you, they know what you're doing, they know what you're intending to do. They know who Bob and Jim are when you say to “invite them to a party.”
I would love a system that knows which Bob to call. I agree. Andy, I think that some of the early ... Where we see a lot of customers leaning in to machine learning, deep learning, AI systems, is really on a feature level for their own products or solutions. It is, "What cool thing can I add that makes sure that my product is very leaning forward," and that actually is a lot of [phone ringing] added. I don't think [phone ringing] of where it needs to be. I think that there is a whole other layer of how [phone ringing] machine learning and deep learning in order to better design for [phone noise]. I think that to me is the real killer app.
When we're talking about using neural networks in order to design the logic across a fulfillment center or across a manufacturing plant, which we can then now dynamically reprogram much faster, I think that is where we see a lot of the most impactful use cases for customers. That context layer, and particularly for interactivity, that's low-hanging fruit and gets you the big check in the boxes. "Yeah, you get it. You're a 21st century company." Vint, do you have anything different?
Just an additional thought to what Sarah is saying. This notion of building a cognitive model that Andy poses, I resonate very strongly with. The idea that a building, a house, a residence, a manufacturing plant, has a model of itself, it has a model of what's normal, has a model of people who are in it, what's functional and what isn't, and conditions, situations.
An example: let's suppose that you have a house full of webcams, but the fire alarm has just gone off. At this point, that's a very special circumstance. It could be that you would want the fire department to have access to the webcams in order to see if there's someone unconscious in a particular room. That's not something that you would want them to have access to all the time or that the general public should have access to. There's some interesting things that we can do once you have a model of what's normal and what's abnormal and what could be done under those conditions. When we get to an ecosystem that has that level of modeling, self-modeling capability, I think we'll be quite far into the utility of IoT.
One of my favorite things about IoT and the intersection of IoT with machine learning and deep learning is some of the really neat problem sets that come up with the reduction of dimensionality, when you start talking about those ecosystems and how do you model those ecosystems. You think of an airport. You've got so many layers, whether just in baggage tracking or in ramp turnaround time for an airplane. You've got baggage systems, you've got catering, you've got pneumatic pumps, you've got to get the people through TSA. All of those systems, with an IoT background, have their own process to manage, and then also have interdependencies. There's an exponential explosion of context there that comes out of this. From a mathematics and from a ... If I were in school today, what would I want to look at? What would my PhD thesis be, instead of materials physics? For me, it would be looking at reduction in dimensionality and how do you marry what we can do today with compute with some of these highly complex, highly interrelated problem sets, to your point, Vint.
It's pretty clear here ... I will speak only for myself ... I am very unhappy with the number of apps I have to fuss around to find in order to do something, and the idea that there might be an app per device just drives me crazy. What we need, frankly, is what Andy was hinting at, and that's having a model of the ecosystem in which these devices have been embedded, so that we have a software model that we can interact with in a very straightforward and simple way ... Not app-by-app, which I think is an artifact of the smartphone. At some point, I think that's going to not scale at all. In fact, we may have gotten there already. I would prefer to have simple ways of interacting. As I say, I'm a little skeptical about some of the voice interaction.
Some of our listeners have already suggested, Moti Barkan, for example, says that there isn't any need for complicated interaction with lights: the system will know where you are, what you like and so on. I actually am not comfortable with that formulation. I want to be in control. I don't want the house to be in control. I don't want it to guess about what I want and don't want.
I have some devices that are trying hard to learn what's normal for me and they always learn the wrong thing. In particular, the device that thinks that I'm never home, because the sensors for heating and cooling are in places I never go, like the formal dining room and the upstairs guest rooms, and so the system thinks we're never home and it keeps the place hot in the summer and cold in the winter and we're unhappy about that. I think there's a lot more to be done here to make the system more responsive and more easily managed by the people who use it.
OOne other point: the last thing that any of us want is a house that stops working when the Internet isn't connected. To the extent that we're relying on cloud-based systems to do a lot of the intelligence, we had better have the ability to do something locally even if the Internet's not there. That makes sense. Otherwise, we'll have a lot of unhappy customers.
Yeah, and part of that interoperability thing that we had talked about last at the beginning currently assumes that you take the data up into the cloud and then you do the interoperability at the top, but, as you say, if the link's down or is a high-latency link or some other problem, that ability to actually do the messaging locally, to interact with these systems that your thermostat knows when the window's open, knows when the heat is on, at a local level, is just as important as would be the semantically rich, data-heavy approach you can get from getting the data out to the cloud.
I would agree with that, although part of the chat at the moment is about, "Can't we just use the home router as the point of security, or at least as the point that we as homeowners or we as owners can control and direct from?" I think one of the big challenges with edge as a local mechanism is that it is dynamically changing for any device that can get up and move, and so there's this flexibility that has to be in the intelligence layers, in the security layers, to know, "What is my ... What group am I controlling?" Because I've got that set or that viewpoint, that shadow of the world, what then do I have the right role to ... What decisions can I make? What enforcement can I do, and what do I need to percolate up to the next layer?
We haven't gotten to that point yet, which I think, once we do, we can get rid of a lot of the end "direct-to-user" connection points, whether those are apps or even physical buttons.
Sarah said something really profound here. She implies something about configuration, which is not an episodic thing anymore. When devices can be moved around, in and out of the house and so on, you're literally in continuous reconfiguration mode. The system has to be able to adapt to the presence of devices that arrive and leave. That's a very different environment than, "Now I'm in configuration mode." "Now I'm in user mode." I hadn't thought about it in those terms, so thank you for that, Sarah.
That's a really good point, yeah.
It's one of my favorite go-to topics for presentations at the moment, is the effect of IoT on products. If you have, once you connect your products ... That's where a lot of industries are today, "How do I connect that one device?"
For me, the bare minimum of what we get out of connecting devices is the ability to do as you said, Vint, that update. Once you can update and you can manage that process, you can basically move from what in IT is called the waterfall design method to a continuous delivery even on hardware, and so the ability to change what is happening on that device ... We have ... Serverless compute's a great mixture with biotiques. It gives you that quick-control mechanisms, but I think that the ability to experiment in-field, in-situ with devices, and to be able to change and to do A/B testing, to figure out what are the right features for you, Vint, or you, Andy, or me ...
I think that that constant change, and that comes down to both the individual device can be changing consistently ... What am I measuring and how am I percolating analysis from that device, as well as the group of devices is also in constant change. Change is exponential, as well as complexity of the ecosystem.
I think there's a whole paradigm shift needed there, because at the moment, updating your router or whatever normally involves a period of time when the thing's offline. It quite an overt, manual effort, or even if it's automated, it's still, "Updating now." Okay, you go offline, reboot, et cetera. What you're alluding to there implies a continuous change of small increments, which none of the update mechanisms I've seen commercially available in the standards has been anywhere near geared towards that. It's always been "download a new firmware image," then kick over to it. I think we're ... I know there's things like OSGi can dynamically load and unload bundles on the fly. I know the technology exists, but it's by no means widely used.
Yeah, I think it's just starting to come out. We have something called Green Grass, which is serverless. There are folks doing similar things with containers on the edge, so you can basically hat-swap containers. I think there are some really interesting business models that percolate out of those things. Can I rent you space on my home vacuum cleaner for an app that goes through and figures out the square footage of my house, for instance, as part of a, I don't know, a survey of usable space designed for Ikea furniture. I don't know. I'm making this up. You start thinking about how those space can be used, not just by the manufacturer, but potentially by others.
That's a great question. In many ways, we're still looking for the killer application for blockchain, but we're already seeing some key use cases, particularly where IoT's concerned, where it's a very natural fit, that idea of a distributed transaction without it being one single person who's got to be the ultimate person responsible.
One of them is in custody transfer between borders. If you're taking a container on a back of a truck through a number of countries and they're going through secure checking areas and you want to make sure they haven't been tampered with and you can't quite trust any individual party, and there has to be that end-to-end trust to get these containers securely through, making sure it's been checked in the right places. The ability to incrementally chain to a blockchain as those transactions happen through the journey, is one that we're seeing a lot of interest where it just happened ... It seemed to be quite a natural fit for the IoT devices on the container and the sensors in the secure loading areas, and the fact that that's all committing to a blockchain.
The other thing we're seeing is where it's worthwhile investing in the technology to track high-value items, so leather jackets in a store, or very high-value items like an airplane, say, as someone's selling it and transferring it through a number of middlemen and women to transfer it to an end destination. Whoever takes responsibility for it at a certain time in its journey, again, having that committed to a blockchain which is publicly visible so you can just see where it is and make sure that it hasn't gone off down some dodgy route, again, seems to be quite a natural application for it.
I think they're currently few and far between. It isn't as though there's a zillion applications for blockchain, but I think the ones we are seeing fundamentally transform the nature of those businesses. I think we're going to see a lot of interest there.
There certainly seems to be a lot of conversation about blockchain. For me, when I first looked at the technology, which, granted, was quite a while ago. Chris Ferris would probably kill me for this, speaking of IBM and working on blockchain. For me, there was an inherent challenge with blockchain in that the amount of compute it takes, particularly as your chain grows in order to get to coherence. That seems like something that is a fundamental piece of blockchain which makes it ... The more useful it is, the more expensive it gets, at least from a compute standpoint. I understand, sitting where I sit at AWS, we know that compute gets cheaper and cheaper.
But that along with some of the timing issues on how many transactions a second could be done, I do think there are some killer apps out there for blockchain. Hyper-ledger, looking at smart contracts, where really the dollar savings of the business really outweighs the cost of the technology costs, I think those are some of the really interesting, leading edge areas where we're more likely to see it.
There was a period about a year ago where the next person who said that blockchain was their answer to IoT security I was going to have to backhand them. That hasn't occurred in a while, though, so I think education has filtrated out, which was great.
I want to emphasize some of the things that Sarah just said, especially with regard to the parameters of blockchain operation. I have become less and less persuaded, certainly with regard to anonymous blockchain, which I don't find in any way persuasive ... I want to know who is running the blockchain, so permission blockchain is more attractive from my point of view, but, also, this scaling question is important.
For certain small-size applications, blockchain may turn out to be perfectly okay, but at that point, you may also say, "There are other ways to do this," as well. I'm sort of rejecting the Kool-Aid at the moment, maybe wrongly. Certainly, with regard to Bitcoin, I'm running the other way, because it's too much like a commodity whose value we have no way of really estimating forward into the future. I'm not too wedded to that. We're seeing some utility in some small applications for blockchain, some of them related to certificate transparency in the DNSSEC system. Apart from that I'm not seeing a whole lot of enthusiasm, outside of the hype that I think we're all detecting.
For me, there are two interrelated challenges that are slowing the growth of IoT. One is how to manage the digital rights management around IoT. There's a piece of it that's privacy, but really it is a combination of some of the contextual systems that Vint was talking about where, how do I share across my value chain? How do I share insights that I trust and that I know my downstream vendor can trust? How do I share those in a way where I retain my IP and I retain the ownership of my data, but where I can make sure that the action I need to have happen after that happens?
As an example, if you're a million dollar building chiller ... You build chiller systems at the basement of big buildings, how do you let the contract field service tech know the operations of that chiller? Today, I think we provide an awful lot of information, which means that there isn't a huge incentive to make those complex ecosystems scale. What you see is sort of a dimensionality. I think of them as one-dimensional systems. You've got a process and people can pretty much handle that, but when you start talking about multiple layers of processes, things break down pretty quickly. A lot of today's IoT customers are device manufacturers. In order to really have more of the impact of IoT we've got to get more into the ecosystem place, and that is in part that data exchange layer and the digital rights management around it. It is also in part the semantic and contextual technologies of how do we make sure that we don't have to script how each one of these systems talks to each other and we don't have to script what lighting means for the industry. We've got to be able to find these flexible systems.
We keep going back to semantic web technologies with a physical layer. I don't know how you make that happen, but being able to fix that also makes all of the analytics a little bit easier for the next generation of machine learning and deep learning applications.
Not quite sure how to follow that. I think if you had a semantic name space, so do DNS but it's at the application level. Rather than having to look up IP addresses you're saying, "What's the business end point of this thing?" You find it directly. Part of the promise of the services-oriented architecture, I guess. Then that would really make things rather interesting, because you'd just be looking for the service that you need and not have to worry about anything else below that.
It's Vint again. I'd like to emphasize an issue that I failed to take into account sufficiently in the case of Internet design. When we started, we were a bunch of geeks that were just trying to make this thing work, and it didn't occur to me, anyway, that somebody would want to wreck it. "Why would you do that?" We were just trying to figure out how to make it work. We didn't really defend early on against some of the malicious attacks that we now see plaguing the net.
There are some defenses against that, but in the IoT space, this conversation has caused me to conclude that the ability to sense a new device, to incorporate it into a model of an ecosystem, to detect that this device might be malicious, for example, and defend against that, is really a hairy problem, because things come and go. In buildings, especially, public buildings, people walk in with the devices, as Sarah implied, and they move around. The idea that you should treat every device with a certain degree of suspicion until you have figured out that it isn't is the inverse of the normal "innocent until proven guilty," right? Now we assume guilty until proven innocent. It may offend some people, but I think that's actually the right paranoid position to take if we want these systems not to be easily invaded by people with malicious intent.
Just depends what you're doing! I'm a great fan of both, as it happens. I'm a particular fan of ESP8266 at the moment, which is an Arduino with Wi-Fi on board, but I've got lots of things running on Raspberry Pis, and I'm very fond of the Node Red software because it just makes it really easy to wire up a new program, get it working really quickly, but if you want to do things ... Here's what I made earlier. Here's a little ambient device. I was going to show you the little ambient device we've got here in Munich showing CO2-level sensing. You can't beat an instant-on, Wi-Fi connected device for doing that. "Both" is the short answer.
Did you see that project recently for the Raspberry Pi that they created the weather station, whereby it actually created the mist, the rain, the lightning, the sunshine? I thought that was brilliant..
I was just reading it before this session in fact, yes. We're going to be building one of those here next week in Munich!
Oh, cool! Excellent. All of you doctors of IoT, I would like to thank you very much for today. I'd also like to thank everybody for joining the discussion today. We've had some amazing questions today, and I'm sorry we couldn't get to them all during this broadcast. We'd also like to thank IoT Central and the IoT community for helping sponsor this particular event, and of course, coming back to Vint, Andy and Sarah, for giving up their time and going through all these questions with us today, we really, really do appreciate it. It's been an absolute honor to sit and share this panel for IoT.
As I mentioned before, we will be sending out a recording and transcript shortly, as well as other resources from the panelists, so look for that email. I hope you all enjoyed this AMA. We look forward to seeing you on the next one, and have a great rest of your day. Thank you very much.