(NOTE: The Secret Life of Machines series was originally written for a different site in the 1st half of 2021. These are virtually unchanged)
This second installment in the Secret Life of Machines series expands upon the “ideal.” In a perfect world, how would device identity, classification, access, and monitoring technology perform? What features and properties would be most likely to best improve the security, systems resilience, and trust in both devices and users?
Like biometrics but for devices – and a whole lot more
Biometrics are body measurements and calculations related to human characteristics. Biometric identifiers are the distinctive, measurable characteristics that can label and characterize individuals and can be bifurcated into physiological and behavioral. Physiological include fingerprints, and retinal scans. Behavioral include voice analysis and even typing patterns. Biometrics are exceptionally effective in Machina-metrics
Our idealized analog to biometrics (pun intended) needs to be both a whole lot more reliable and a whole lot more feature rich. While the examples are many, the ideal portal into the secret lives of devices can be described in five dimensions.
Trusted, Accurate, and Resilient: a device’s “tag” must be persistent over time, replicable across measurement devices, impossible for one device to imitate or counterfeit another, and equally impossible for a device to tamper with or hide its own identity.
Classification: the information inside device tags or signatures should also be usable to classify and categorize device instances into like categories an sub-categories. When analyzed, a machina-metric should reveal the device category (smart phone or a wireless hub), the manufacturer (Cisco or Samsung), and the model (Galaxy S20+ or AIR-AP1852I). There would never be any confusion, even if a Dell Laptop, through software trickery, presented itself as a printer or communicated through a mobile device emulator).
Monitor and predict behavior: a device tag should by inherently dynamical, e.g. the underlying signals not change over time in such a way that they can be precisely measured and analyzed mathematically. This kind of analysis would lead to predicting maintenance requirements as well as identifying faulty or compromised systems in advance of existing approaches.
Multi-directional: to fully tap into the secret lives of devices, the same technology used to passively observe, classify, and monitor a device should also be capable of decryption-proof, un-breakable bi-directional communications. Knowing that a laptop is presenting itself as a printer is only half the problem. There now needs to be an absolutely trusted means of communicating that event, a device’s licensing terms, its provenance, as well as any critical tolerances that must always be available for inspection.
Compatible with “all-digital” technologies: our ideal device identity and access management solution would never replace classical (all-digital) identity and access management because the ability to connect users to devices, usage history, authorization, and access rights make digital identity powerfully valuable. White and black lists of devices have no materiality without context – without a connection to the organizations that use them and the policies that govern them.
Our portal into the secret lives of devices cannot be effective confined to the inside of its own all-mechana-metrics silo.
If there is no solution, then there’s no problem
The second post concludes with the same aphorism and in much the same way as the first. “If there is no solution, then there’s no problem – it’s just life – so deal with it.” If we had a means of hitting all the right notes outlined above, we would have both a game-changing solution AND a whole new set of problems. Problems? This kind of a solution would create an existential threat to any individual or organization that counted on the fact that systems simply cannot reliably and efficiently identify, classify, monitor, and annotate devices world-wide. Prove that assumption to be outdated, they will have some serious problems.
NEXT UP: Where does our lack of visibility into true device identity, classification, and wellness hurt us most: economy, safety, or national/global security?