idnits 2.17.1 draft-baba-iot-problems-03.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- ** The document seems to lack a Security Considerations section. ** The document seems to lack an IANA Considerations section. (See Section 2.2 of https://www.ietf.org/id-info/checklist for how to handle the case when there are no actions for IANA.) Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the IETF Trust and authors Copyright Line does not match the current year == Line 78 has weird spacing: '...related thr...' == Line 85 has weird spacing: '... data man...' == Line 93 has weird spacing: '...uipment upd...' -- The document date (April 26, 2017) is 2557 days in the past. Is this intentional? Checking references for intended status: Informational ---------------------------------------------------------------------------- No issues found here. Summary: 2 errors (**), 0 flaws (~~), 4 warnings (==), 1 comment (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 Internet Research Task Force H. Baba 3 Internet-Draft The University of Tokyo 4 Intended status: Informational Y. Ishida 5 Expires: October 28, 2017 Japan Network Enabler Corporation 6 T. Amatsu 7 Tokyo Electric Power Company, Inc. 8 K. Kunitake 9 BroadBand Tower, Inc. 10 K. Maeda 11 Individual Contributor 12 April 26, 2017 14 Problems in and among industries for the prompt realization of IoT and 15 safety considerations 16 draft-baba-iot-problems-03 18 Abstract 20 This document contains opinions gathered from enterprises engaging in 21 the IoT business as stated in the preceding version hereof, and also 22 examines the possibilities of new social problems in the IoT era. 23 Recognition of the importance of information security has grown in 24 step with the rising use of the Internet. Closer examination reveals 25 that the IoT era may see a new direct physical threat to users. For 26 instance, the situation at a smart house may lead it to judge that 27 the owner has only temporarily stepped out, causing it to unlock the 28 front door, which in turn makes it easier for thieves to enter. 29 These kinds of scenarios may occur without identity fraud, hacking, 30 and other means of compromising information security. Therefore, for 31 the purpose of this document, this issue shall be referred to as "IoT 32 Safety" to distinguish it from Information Security. 34 We believe that it is necessary to deepen our understanding of these 35 new IoT-related threats through discussion and ensure there are 36 measures to address these threats in the future. At the same time, 37 we must also coordinate these measures with the solutions to the 38 problems described in the previous version of this document. 40 Status of This Memo 42 This Internet-Draft is submitted in full conformance with the 43 provisions of BCP 78 and BCP 79. 45 Internet-Drafts are working documents of the Internet Engineering 46 Task Force (IETF). Note that other groups may also distribute 47 working documents as Internet-Drafts. The list of current Internet- 48 Drafts is at http://datatracker.ietf.org/drafts/current/. 50 Internet-Drafts are draft documents valid for a maximum of six months 51 and may be updated, replaced, or obsoleted by other documents at any 52 time. It is inappropriate to use Internet-Drafts as reference 53 material or to cite them other than as "work in progress." 55 This Internet-Draft will expire on October 28, 2017. 57 Copyright Notice 59 Copyright (c) 2017 IETF Trust and the persons identified as the 60 document authors. All rights reserved. 62 This document is subject to BCP 78 and the IETF Trust's Legal 63 Provisions Relating to IETF Documents 64 (http://trustee.ietf.org/license-info) in effect on the date of 65 publication of this document. Please review these documents 66 carefully, as they describe your rights and restrictions with respect 67 to this document. Code Components extracted from this document must 68 include Simplified BSD License text as described in Section 4.e of 69 the Trust Legal Provisions and are provided without warranty as 70 described in the Simplified BSD License. 72 Table of Contents 74 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3 75 2. Technical Challenges . . . . . . . . . . . . . . . . . . . . 4 76 2.1. Safety, Security and Privacy . . . . . . . . . . . . . . 4 77 2.1.1. Challenges in protecting lives and property from IoT- 78 related threats (IoT Safety) . . . . . . . . . . . 4 79 2.1.1.1. Safety of body/life . . . . . . . . . . . . . . . 5 80 2.1.1.2. Safety of equipment . . . . . . . . . . . . . . . 5 81 2.1.1.3. Proper performance of equipment . . . . . . . . . 5 82 2.1.2. Information Security . . . . . . . . . . . . . . . . 5 83 2.1.3. Privacy in acquiring data . . . . . . . . . . . . . . 6 84 2.2. Challenges posed by data acquisition, data distribution, 85 data management and data quantity . . . . . . . . . . 7 86 2.2.1. Traffic patterns . . . . . . . . . . . . . . . . . . 7 87 2.2.2. Acquired mass data . . . . . . . . . . . . . . . . . 7 88 2.2.3. Explosive increase and diversity of data . . . . . . 7 89 2.3. Mapping of the physical world and the virtual world . . . 8 90 2.3.1. Physically handling acquired data . . . . . . . . . . 8 91 2.3.2. Data calibration . . . . . . . . . . . . . . . . . . 8 92 2.4. Product lifetime, generation management, and the cost of 93 equipment updates . . . . . . . . . . . . . . . . . . 8 94 2.4.1. Product lifetime . . . . . . . . . . . . . . . . . . 8 95 2.4.2. Introducing IoT equipment into commodity equipment . 9 96 2.5. Too many related standards and the speed of 97 standardization . . . . . . . . . . . . . . . . . . . . . 9 99 2.5.1. Too many related standards . . . . . . . . . . . . . 9 100 2.5.2. Speed of standardization . . . . . . . . . . . . . . 10 101 2.6. Interoperability, fault isolation, and total quality 102 assurance . . . . . . . . . . . . . . . . . . . . . . . . 10 103 2.6.1. Interoperability . . . . . . . . . . . . . . . . . . 10 104 2.6.2. Fault isolation . . . . . . . . . . . . . . . . . . . 10 105 2.6.3. Quality assurance . . . . . . . . . . . . . . . . . . 11 106 2.7. Product design policy . . . . . . . . . . . . . . . . . . 11 107 2.7.1. Changes in design policy . . . . . . . . . . . . . . 11 108 2.8. Various technology restrictions within actual usage . . . 11 109 2.8.1. Using radio waves . . . . . . . . . . . . . . . . . . 11 110 2.8.2. Batteries . . . . . . . . . . . . . . . . . . . . . . 12 111 2.8.3. Wiring . . . . . . . . . . . . . . . . . . . . . . . 12 112 2.8.4. Being open . . . . . . . . . . . . . . . . . . . . . 12 113 3. Non-technical Challenges . . . . . . . . . . . . . . . . . . 13 114 3.1. Changing the product paradigm . . . . . . . . . . . . . . 13 115 3.1.1. Ecosystems . . . . . . . . . . . . . . . . . . . . . 13 116 3.1.2. Coordination and significant changes in strategy . . 13 117 3.1.3. Competition with existing industries . . . . . . . . 13 118 3.2. Benefits . . . . . . . . . . . . . . . . . . . . . . . . 13 119 3.2.1. Rising costs and monetization . . . . . . . . . . . . 13 120 3.3. Information security and privacy of social systems . . . 14 121 3.3.1. Classification of ownership, location, and the usage 122 of data . . . . . . . . . . . . . . . . . . . . . . . 14 123 3.4. Disclosure of data . . . . . . . . . . . . . . . . . . . 14 124 3.4.1. Side effects and malicious use potentially caused by 125 the disclosure of data . . . . . . . . . . . . . . . 14 126 3.5. Preparing social support . . . . . . . . . . . . . . . . 14 127 3.5.1. Regulations . . . . . . . . . . . . . . . . . . . . . 14 128 3.5.2. Corporate social responsibility . . . . . . . . . . . 14 129 3.5.3. Customization for individual customers . . . . . . . 15 130 3.5.4. IoT literacy of the users . . . . . . . . . . . . . . 15 131 3.5.5. Individual vs. family . . . . . . . . . . . . . . . . 15 132 4. Information Security Considerations . . . . . . . . . . . . . 15 133 5. Privacy Considerations . . . . . . . . . . . . . . . . . . . 15 134 6. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 16 135 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 16 137 1. Introduction 139 Many activities are progressing in various fields, such as the 140 proposal of standards for creating an IoT world. There are also many 141 reports that analyze and predict the benefits that IoT can bring to 142 the economy and society. These developments remind us of the end of 143 the 20th century, when the effect and impact of the Internet was 144 actively debated. 146 The authors tried using the following approach to clarify the issues 147 for the prompt realization of IoT. First, the players were 148 conveniently divided into two groups: ICT industry players and Things 149 industry players. Next, we met major players in the ICT industry and 150 Things industry and asked about the challenges they faced and the 151 challenges the other side faced in creating IoT. 153 The ICT industry players mentioned here include communication 154 carriers, ICT equipment vendors, the Internet service providers, 155 application vendors, and software houses. The Things industry 156 players include home and housing equipment manufacturers, 157 infrastructure providers such as railways companies and power 158 companies, and manufacturers of home appliances such as air 159 conditioners and refrigerators, which are also the ICT users. 161 This paper is principally a summary of the meetings results, and a 162 presentation of the micro case studies about the challenges for 163 realizing IoT services. It is not an overview of the IoT world or a 164 macro-proposal intended to promote the benefits of IoT. 166 In addition, the revised version includes an examination of the 167 possibilities of new direct physical threats in the IoT era that have 168 not yet been seen. These threats should affect the safety of our 169 bodies, lives, and "things," which includes property. For this 170 reason, this issue shall be referred to as "IoT Safety" to 171 distinguish it from Information Security for the purpose of this 172 document. 174 2. Technical Challenges 176 2.1. Safety, Security and Privacy 178 2.1.1. Challenges in protecting lives and property from IoT-related 179 threats (IoT Safety) 181 The introduction of IoT may generate threats to "Safety" through the 182 actual operation of mechanical devices, in addition to the 183 Information Security problems discussed in Section 2.1.2 below. For 184 example, the spread of applications for visualizing electric power 185 consumption allows for mischief in device operation without the use 186 of identity fraud or hacking. In addition, there is the potential 187 for problems to arise in the normal operation of individual devices 188 that are not caused by abnormal current or voltage, another troubling 189 aspect of the introduction of IoT. These issues cannot be resolved 190 with ordinary information security measures for Network Layer 4 or 191 lower. In another case, a command to an IoT device is proper by 192 itself, but it may conflict with the other commands or its 193 environmental status. Therefore, the authors consider it necessary 194 to have a system for interpreting the details of operations of many 195 appliances and preventing operations according to the necessity in 196 Layer 7 (what the authors tentatively call "Sekisyo".) 198 These threats are categorized into three types: threat to physical 199 safety; the threat of the failure or destruction of equipment and 200 property; and the threat of impeding the proper performance of 201 equipment. The following section introduces examples of the 202 different threats. 204 2.1.1.1. Safety of body/life 206 Information on things such as the use of faucets and housing 207 equipment, the locking of the front doors and windows, and the state 208 of electric power consumption based on the smart meter is used by 209 smart houses to regulate homes. This information is used to 210 determine whether anyone is at home, and the electronic lock of the 211 front door and windows is unlocked and a notice of absence is issued 212 to a thief. 214 2.1.1.2. Safety of equipment 216 Air conditioners and other equipment that normally are not expected 217 to be frequently started or stopped each a day can be caused to break 218 down by repeatedly turning them on and off as many as hundreds of 219 times a day. 221 2.1.1.3. Proper performance of equipment 223 Water heaters containing a hot well can be caused to operate 224 erratically. This is done by frequently transmitting signals from 225 the mischief application instead of operation panel to tell the water 226 heater that only 10% of the normal amount of hot water is needed, 227 leaving the water heater perpetually low on water. 229 2.1.2. Information Security 231 We have confirmed two viewpoints regarding the information security 232 of services using IoT equipment and devices. The first is tangible 233 information security involving the critical infrastructure. The 234 second concerns the information security of individuals and homes. 236 In regards to information security involving the critical 237 infrastructure, the basic policy in the past was to stay physically 238 disconnected from an external network, such as the Internet, to 239 ensure information security. However, because of the advance in the 240 systems from proprietary communication protocols to open IP protocols 241 to detect symptoms of problems and to remotely maintain a large 242 number of facilities spread over a wide area, connecting to an 243 external network will become unavoidable to achieve various goals. 244 In addition, it is clear that isolated networks are also subject to 245 the same kind of risks, even though it is not directly connected to 246 the outside. There is no major difference in the information 247 security risks because isolated networks are already the target of 248 international cyber terrorism, with internal crimes and targeted 249 attacks occurring more frequently. Based on these reasons, the ICT 250 security of the social infrastructure requires an extremely high 251 level of information security. 253 Looking at the information security of micro units, such as 254 individuals and homes, the improved convenience provided by the 255 introduction of IoT will lead to greater risks. For example, there 256 is a product available for connecting the entrance door to the 257 network. In ICT security technology, increasing the key length of 258 the encryption makes it much harder to break. But even if the latest 259 information security technology is used when it is installed, the 260 information security technology will become obsolete and even pose a 261 risk about halfway through the twenty- to thirty-year lifetime of the 262 entrance door. As has been explained in other items, the ICT sense 263 of time is completely different from that of Things. 265 2.1.3. Privacy in acquiring data 267 The problem of privacy in handling acquired data is a huge challenge 268 for companies promoting IoT. In addition, the ownership of this data 269 poses yet another challenge. 271 For example, railway companies have installed many cameras for 272 station security and for marketing beverage vending machines. This 273 creates problems for personal identification and privacy. At the 274 present time, the companies are processing the images in real time 275 and do not store the images to avoid the problems. 277 Another huge challenge is the ownership of data. Up until now, there 278 has been a divided debate on whether data belonged to the company or 279 to the users. Likewise, the relationship inside a small user group 280 is also extremely diverse and complicated. One specific example is 281 of a company that had obtained permission from the head of the 282 household to use the data when it carried out an HEMS trial. Later 283 on, the spouse of the head of the household disagreed and as a result 284 permission to use the data was withdrawn. 286 2.2. Challenges posed by data acquisition, data distribution, data 287 management and data quantity 289 2.2.1. Traffic patterns 291 The manner in which data is acquired from and distributed to IoT 292 equipment/devices differs immensely from the traffic patterns of the 293 present Internet. The present form of the Internet focuses on 294 distributing information, and its systems focus on effectively 295 delivering contents to the users. On the other hand, routinely or 296 temporarily sending or receiving data through a huge number of 297 various sensors and devices presents a very different kind of 298 Internet traffic. However, questions such as how much traffic will 299 come from what kind of Things, and how will they superimpose each 300 other have not been sufficiently studied. There is no concrete 301 explanation about the backbone design and operation of traffic, and 302 there have been many cases in which the unclear specifications for 303 IoT traffic made the design difficult on the communication company 304 side. There are many challenges related to the set up and management 305 of IoT equipment. We have heard from the construction companies that 306 the configuration of IoT equipment with a large number of sensors 307 involves a lot of hard work. 309 2.2.2. Acquired mass data 311 It is necessary to develop a management method to reuse acquired data 312 safely and effectively. Even now, there are occasional instances of 313 the theft and leakage of social data (such as IDs) that can be used 314 to identify individuals. In the IoT era, there will be mass data 315 that can lead to Things, and the Things in turn will lead to 316 individuals. There are IoT industry players who do not invest as 317 much in ICT systems as government agencies and large companies do, 318 and thus a management system to safely and effectively reuse the 319 acquired data needs to be developed. The laws and regulations 320 related to ID management differ vastly by country and region. These 321 issues related to society and individuals are largely affected by 322 differences in common sense, and therefore need to be localized. 324 2.2.3. Explosive increase and diversity of data 326 In the future IoT era, there are concerns about the explosive 327 increase in data quantity and the diversity of data sent from sensors 328 and IoT equipment. On the other hand, M2M communication does not 329 require mass data like images, and an extraordinary increase in 330 traffic will be unlikely despite the increase in the number of 331 sensors. 333 If data is sent from all Things, there will be an infinite number of 334 different kinds of data. In addition, with the present form of 335 Internet traffic, data is received by people, and most of it consists 336 of video or image downloads. The download traffic is several times 337 greater than that of the upload traffic. If there is a tremendous 338 increase in the use of IoT, such as M2M communication, the difference 339 between upload and download traffic will probably not be that much. 340 It might be necessary to fundamentally review the network and in 341 particular the last mile characteristics. The importance of this 342 issue is not yet widely recognized. 344 2.3. Mapping of the physical world and the virtual world 346 2.3.1. Physically handling acquired data 348 The acquired data simply represents certain kinds of digital value, 349 and it is important to uncover the meaning of this data. As 350 described previously, configuration of IoT equipment, such as the 351 large number of installed sensors, requires a lot of hard work. An 352 even greater amount of effort will be needed to determine the meaning 353 of the data and connect it to the physical world. 355 In energy management experiments, data is mapped manually. This is a 356 time consuming process, and one that is prone to human error. Cases 357 that rely on the use of human hands require the configuration of 358 automated setting systems to reduce labor, costs, and human errors to 359 introduce IoT 361 2.3.2. Data calibration 363 Another important thing is calibration. This involves properly 364 linking the data sent from Things to the Things concerned, and 365 correctly indicating the operating conditions. 367 It may be necessary to have a tool to treat this problem concerning 368 continuation of operation and the one pertaining to introduction of 369 IoT described previously as a package. 371 2.4. Product lifetime, generation management, and the cost of equipment 372 updates 374 2.4.1. Product lifetime 376 The life of most ICT equipment is about 5 years or less, while the 377 life of IoT equipment and devices is at least 10 years. There is a 378 clear gap between these two types of equipment. 380 In the example of the entrance door connected to the network 381 mentioned earlier, the door is often used for about twenty to thirty 382 years after installed. If is connected to a network, the 383 communication technology and communication service will most likely 384 have undergone numerous generation changes in that twenty- to thirty- 385 year time span. This presents a large gap between the ICT industry 386 and the Things industry. 388 A solution to this problem that was reached during the meeting with 389 the housing equipment manufacturers is that with the automatic 390 control of multiple shutters in a building, the portion between the 391 controller and the multiple shutters, the so-called mature 392 technology, can be placed under the control of the shutter 393 manufacturers, while the controller connected to the network will 394 deal with the generation changes of the communication service. 396 2.4.2. Introducing IoT equipment into commodity equipment 398 It costs a lot to make the many different types of commodity 399 equipment popular around the world usable as IoT equipment and 400 devices. There are two ways to change commodity equipment into IoT 401 equipment. One way is to convert it to IoT compatible equipment. 402 The other way involves adding devices to commodity equipment. There 403 are costs in both cases, and it will take a long time to introduce 404 IoT unless different incentives are offered to help to overcome the 405 burden of cost. 407 2.5. Too many related standards and the speed of standardization 409 2.5.1. Too many related standards 411 There are many standards related to IoT equipment and devices. There 412 are multiple standards, technologies and services for communication 413 technology, such as Bluetooth, Wi-Fi, NFC, and LTE, and it is 414 difficult to choose which to apply. 416 The Things industry players do not always have the communication 417 technology professionals needed for IoT. In the meeting, we learned 418 that many companies were uncertain and hesitant about fields outside 419 their own area of expertise. On the other hand, technological 420 competition will improve quality as well as the level of completion, 421 and thus will be beneficial for users. 423 In the future, a consulting business for clarifying ICT technology 424 for the Things industry players may emerge. If there is a system 425 that can interconnect multiple standards, it will accelerate the 426 Things industry to enter IoT 428 2.5.2. Speed of standardization 430 The concept of product life in ICT industry is completely different 431 from that of the Things industry, and as a result the concept of 432 standardization also varies greatly. Before standardization occurs 433 in the ICT industry, many different proposals are made, from which 434 the best are selected. The final decision often changes, and 435 products have to be updated in order to follow the changes in 436 standards. But in the Things industry, the standards have to remain 437 unchanged for as long as possible because of the long product 438 lifetimes. Therefore, it takes a long time to determine when a 439 particular standard has become mature. When the Things industry goes 440 to implement a standard from the ICT industry, it feels that the 441 standard is incredibly fluid and seemingly undecided. Furthermore, 442 the standardization process of the two industries is very different, 443 and making it difficult to work on the other side when trying to 444 determine a standard. 446 2.6. Interoperability, fault isolation, and total quality assurance 448 2.6.1. Interoperability 450 The verification of interoperability poses a major challenge because 451 of the configuration used by multi-vendors. In addition to 452 interoperability between equipment, the ability to ensure backward 453 compatibility is also important for bringing about the IoT world. 455 If these capabilities cannot be provided, it will be very difficult 456 to create an IoT world in which past products can function. 458 2.6.2. Fault isolation 460 The method for fault isolation that may occur presents another 461 challenge. 463 Many PC users have experienced various kinds of problems. When their 464 PC experiences a problem, they have to isolate the faults by 465 themselves, with no one available to lend a helping hand. 467 In the IoT world, these issues become more difficult and complicated. 468 For example, a smart home is equipped with air conditioners, kitchen 469 supplies, and doors connected to the Internet. A problem that occurs 470 in the smart home poses a much more serious problem to end users than 471 an e-mail failure or problem with a PC. 473 If users are left to isolate the fault on their own, they may not 474 know which manufacturer they contact for repairs if they are unable 475 to isolate the fault on their own, or the manufacturer may refuse to 476 perform repairs because they fall outside the scope of their 477 responsibility. As can be seen, the issue is an important challenge 478 that will determine whether the B2C specific IoT world can be 479 established. 481 2.6.3. Quality assurance 483 The quality assurance of individual pieces of IoT equipment does not 484 guarantee the total quality of IoT. Since IoT involves connecting 485 multiple Things and communication, it is natural to assume that the 486 total service quality will depend on the quality of the IoT equipment 487 and devices, which can sometimes become bottleneck. However, users 488 are not aware of this. 490 As was mentioned previously in Section 2.6 issues that are not 491 directly related to the quality of an individual component can be 492 important factors in determining the quality of the service. In this 493 way, the quality of IoT is not decided by each individual Thing, but 494 needs to be considered as a service spread across the network. 496 2.7. Product design policy 498 2.7.1. Changes in design policy 500 The design policy has to be changed from placing emphasis on the high 501 functionality of a single product to stressing the singular function 502 of individual products as well as how they work in coordination with 503 other products. For many years, the Things industry has focused on 504 producing high functionality products with added value. But in the 505 IoT era, the implicit assumption is to confine Things to their basic 506 function and enhance the level of coordination between Things, rather 507 than focusing on the added value. Simplified Things must be able to 508 be controlled with an external application that can also be used by 509 the Things of cross manufacturers. 511 Given this situation, the Things industry faces the challenge of 512 adopting a completely different policy. During the meeting with the 513 manufacturing industries, we could sense their difficulty in 514 understanding and recognizing the need to change the policy. 516 2.8. Various technology restrictions within actual usage 518 2.8.1. Using radio waves 520 There are many cases that have provided us with insight about issues 521 related to the use of radio waves in IoT (such as the wave traveling 522 range and whether or not it travels further than stated in 523 assumptions available). The suppliers or providers who configure IoT 524 are not always wave communication technology experts. People who are 525 unfamiliar with radio waves seem to think that waves travel from 526 antenna to antenna in a straight line, and that they can be blocked 527 by obstacles. As a result, they often ask questions about how many 528 meters radio waves can travel or whether radio waves can actually 529 travel. Few people understand the fact that the emitted radio waves 530 are reflected from various locations and are superimposed at the 531 reception point where they are received, or that depending on how 532 waves are reflected a change in the reception signal intensity, 533 called fading, may occur. The lack of engineers who can advise on 534 specialized matters such as these poses a major obstacle. 536 2.8.2. Batteries 538 The power capacity and lifetime of batteries represent another set of 539 challenges similar in nature to the issue of radio waves traveling 540 distance. There are questions such as the difference between the 541 real and catalog specifications, as well as factors that affect the 542 battery power capacity. The IoT providers, who are also users of 543 IoT, have to solve these issues, while these are difficult problems 544 even for experts. 546 2.8.3. Wiring 548 The incredible amount of wiring and its complexity (power lines and 549 communication lines) pose major challenges. The complexity of 550 wiring- such as the large number of sensors and equipment, the power 551 lines that drive them, and the communication lines that connect them 552 to the network for acquiring information-is to the point that people 553 doing IoT installation work will start wishing for a wire harness. 554 In addition, the installation of cables and electric work are often 555 done by different engineers. This make the issue even more 556 complicated. 558 2.8.4. Being open 560 A single company alone cannot make all the commodities for IoT. The 561 IoT world needs to be open, and this can only be achieved with the 562 cooperation of many different industries. Up until now, companies in 563 the Things industry have developed products in a closed loop process, 564 seeking to capture users with their company's own products. For this 565 reason, they lack an open design concept of interoperability. Today, 566 an entirely new design concept is needed to design products that can 567 interconnect with the products of other companies. 569 3. Non-technical Challenges 571 3.1. Changing the product paradigm 573 3.1.1. Ecosystems 575 While the goal of setting up IoT is to generate new value, it may 576 actually lead to the destruction of the ecosystems in which 577 industries operate. In the IoT era, the traditional vertically 578 integrated way of producing Things in manufacturing industries will 579 consume too much time and cost. This approach also makes it 580 difficult to incorporate the ideas of other cultures. The need for 581 paradigm shift is easy to understand, but difficult to implement. 582 Promoting this shift will pose a management challenge that requires a 583 considerable amount of skill and effort to overcome. 585 3.1.2. Coordination and significant changes in strategy 587 It will become necessary to run businesses jointly with new partners, 588 as well as cooperate and work in coordination with other industries 589 and competitors. This issue-even when it is fully understood-will be 590 very difficult to address and put into practice. 592 We have seen instances in which only a limited amount of information 593 was given when parties exchanged opinions. There have also been 594 instances in which communication was difficult because of differences 595 in terminology and culture. 597 3.1.3. Competition with existing industries 599 The issue of competition with existing industries often arises when 600 attempts are made to change or reform a business model change or 601 reform. This issue can also be viewed as the reorganization of 602 industries, rather than competition between existing industries. 603 However, this realignment of industries is difficult to move forward 604 in the absence of supervisors. 606 3.2. Benefits 608 3.2.1. Rising costs and monetization 610 Introducing IoT within products will cause costs to go up, and yet 611 the benefits it provides are unclear. There is no specific killer 612 application available, and the number of users will not rise 613 immediately. Therefore, finding a way to make the business 614 profitable will be very difficult. This issue is especially 615 difficult for businesses and products that rely on cost reductions to 616 deliver low prices that make them competitive. 618 3.3. Information security and privacy of social systems 620 3.3.1. Classification of ownership, location, and the usage of data 622 There are many questions regarding the wide variety of data gathered 623 from IoT equipment, including questions related to ownership, storage 624 location, and the authorization to grant a license to use data. 625 These need to be addressed so that the system and equipment can be 626 accepted by society. 628 For example, if a company installs a door in a house that gathers 629 data on the opening and closing of the door, questions about the data 630 will arise. Does it belong to the users or the company? Can another 631 company use this data? 633 3.4. Disclosure of data 635 3.4.1. Side effects and malicious use potentially caused by the 636 disclosure of data 638 For example, it has been shown that the electricity smart meter can 639 lead to burglary because it shows when electricity is used and not 640 used, providing an indication of the time when no one is home. This 641 particular example demonstrates the importance of ensuring 642 information security and privacy. 644 3.5. Preparing social support 646 3.5.1. Regulations 648 Systems of laws and regulations are important for ensuring the safety 649 of the conventional products, but they can also be a barrier for 650 innovation. 652 IoT can be affected by laws and regulations at home and abroad, and 653 can also be influenced by regulations that extend across multiple 654 countries. Regulatory authorities need to monitor IoT carefully and 655 adjust the regulations and laws they oversee in a way that does not 656 negatively impact the global competition environment. 658 3.5.2. Corporate social responsibility 660 In addition to pursuing profit, companies that promote IoT also need 661 to improve the benefits offered to users and society 663 3.5.3. Customization for individual customers 665 There is an ongoing shift in demand away from general products to 666 customized products for individual customers. This could also be 667 viewed as a shift away from manufacturing businesses to service 668 businesses. IoT will play an important role in this shift. 670 Instead of manufacturing Things through mass production, it will be 671 easier to customize a product by moving some of the functions to an 672 application. Likewise, the manufacturing business also needs to move 673 forward with the previously mentioned paradigm shift in order to 674 achieve customization 676 3.5.4. IoT literacy of the users 678 Because Things are connected to the network, apps will need to be 679 created. Some of these will serve as the interface with which people 680 interact with IoT. 682 In the IoT era of the future, users will need to possess a certain 683 amount of knowledge about IoT apps 685 3.5.5. Individual vs. family 687 The issue of whether the data of Things in the house belongs to the 688 family or the individual will largely affect data analysis and the 689 handling of privacy. 691 As was mentioned in Section 2.1.2, the spouse could later object to 692 the head of the household granting authorization to use data. 694 4. Information Security Considerations 696 Meetings with the players in various IoT fields provided insight into 697 information security issues. These issues are described in the 698 following sections. 700 o Section 2.1.2 Physical damper of devices 702 o Section 2.1.2 Product lifetime and encryption strength 704 For details, please see the corresponding text. 706 5. Privacy Considerations 708 Similarly, issues regarding privacy are described in the following 709 sections. 711 o Section 2.1.2, Section 3.3.1 Ownership of the data 713 o Section 3.4.1 Data disclosure and malicious use 715 o Section 3.5.5 Individual vs. family 717 For details, please see the corresponding text. 719 6. Acknowledgments 721 We would like to thank the foundation the promotion of industrial 722 science and its RC-88 member companies for their cooperation. 724 And we also appreciate Ministry of Internal Affairs and 725 Communications. 727 Authors' Addresses 729 Hiroyuki Baba 730 The University of Tokyo 731 Institute of Industrial Science 732 4-6-1 Komaba 733 Meguro-ku, Tokyo 153-8505 734 Japan 736 Email: hbaba@iis.u-tokyo.ac.jp 738 Yoshiki Ishida 739 Japan Network Enabler Corporation 740 21F KDDI Otemachi Bldg. 741 1-8-1 Otemachi 742 Chiyoda-ku, Tokyo 100-0004 743 Japan 745 Email: ishida@jpne.co.jp 747 Takayuki Amatsu 748 Tokyo Electric Power Company, Inc. 749 1-1-3 Uchisaiwai-cho 750 Chiyoda-ku, Tokyo 100-8560 751 Japan 753 Email: amatsu.t@tepco.co.jp 754 Koichi Kunitake 755 BroadBand Tower, Inc. 756 Uchisaiwaicho Tokyu Bldg. 757 1-3-2 Uchisaiwai-cho 758 Chiyoda-ku, Tokyo 100-0011 759 Japan 761 Email: kokunitake@bbtower.co.jp 763 Kaoru Maeda 764 Individual Contributor 766 Email: kaorumaeda.ml@gmail.com