Abstract
This paper propose an incentive mechanism to secure large numbers of devices through the use of insurance based on smart contracts. It consists of the automated security evaluation of enterprise IoT devices and the creation of a dynamic insurance premium. To automate the security evaluation of enterprise IoT devices, we collect and store IoT device status data with privacy preservation on blockchain. Then, we track and assess the risk associated with IoT devices with the use of a smart contract. By monitoring this risk over time, we present a means to incentivize the resolution of vulnerabilities by measuring the latent risk in an environment as well as the vigilance of the devices’ managers in resolving these vulnerabilities. In this way, we produce a dynamic cyber insurance premium that more accurately captures the risk profile associated with an environment than existing cyber insurance. Through the use blockchain and smart contracts, this framework also provides public verification for both insured and insurer and provides a level of risk management for the insurer. We also present regulatory considerations in order for this scheme to meet supervisory requirements.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Similar content being viewed by others
Notes
- 1.
U.S. direct premiums written for cyber risk coverage were approximately 2.03 billion dollars in 2018, a 10% increase over 2017’s 1.84 billion.
- 2.
It is not to say that insurance companies cannot adjust premiums based on security improvements that are observed in a client’s environment, but that there is usually no practical way to access this information in a reliable way that provides a faithful representation of the client’s efforts or accomplishments.
- 3.
A smart cyber insurance scheme could be more difficult to understand than a traditional one. From policyholder protection perspective, regulators might ask insurers to refrain from using complex pricing model especially when the products are sold to individuals.
- 4.
As an example, The EU-U.S. Insurance Dialogue Project began as an initiative by multiple organization including EIOPA, FIO and NAIC to enhance mutual understanding and cooperation between the European Union (EU) and the United States for the benefit of insurance consumers and business.
References
Information technology - security techniques - cybersecurity and ISO and IEC standards. Report ISO/IEC TR 27103:2018, ISO/IEC JTC1 (2018)
Baer, W.: Rewarding it security in the marketplace. Contemp. Secur. Policy 24(1), 190–208 (2003)
Bellare, M., Yilek, S.: Encryption schemes secure under selective opening attack. Cryptology ePrint Archive, Report 2009/101. https://eprint.iacr.org/2009/101 (2009)
Boneh, D., Di Crescenzo, G., Ostrovsky, R., Persiano, G.: Public key encryption with keyword search. In: Cachin, C., Camenisch, J.L. (eds.) EUROCRYPT 2004. LNCS, vol. 3027, pp. 506–522. Springer, Heidelberg (2004). https://doi.org/10.1007/978-3-540-24676-3_30
Boneh, D., Kushilevitz, E., Ostrovsky, R., Skeith, W.E.: Public key encryption that allows PIR queries. In: Menezes, A. (ed.) CRYPTO 2007. LNCS, vol. 4622, pp. 50–67. Springer, Heidelberg (2007). https://doi.org/10.1007/978-3-540-74143-5_4
Cao, N., O’Neill, A., Zaheri, M.: Toward RSA-OAEP without random oracles. In: Kiayias, A., Kohlweiss, M., Wallden, P., Zikas, V. (eds.) PKC 2020. LNCS, vol. 12110, pp. 279–308. Springer, Cham (2020). https://doi.org/10.1007/978-3-030-45374-9_10
Finck, M.: Blockchain Regulation and Governance in Europe. Cambridge University Press, Cambridge (2018)
Hoang, V.T., Katz, J., O’Neill, A., Zaheri, M.: Selective-Opening Security in the Presence of Randomness Failures. In: Cheon, J.H., Takagi, T. (eds.) ASIACRYPT 2016. LNCS, vol. 10032, pp. 278–306. Springer, Heidelberg (2016). https://doi.org/10.1007/978-3-662-53890-6_10
Hofheinz, D., Weinreb, E.: Searchable encryption with decryption in the standard model.IACR Cryptology ePrint Archive, 2008:423. (2008)
Corvus Insurance. Insurtech corvus launches smart cyber excess insurance with \$10mlimit. Insurance Journal (2019)
European Insurance and Occupational Pensions Authority. Understanding cyber insurance – a structured dialogue with insurance companies (2018). https://eiopa.europa.eu/Publications/Reports
Jevtic, P., Lanchier, N.: Smart contract insurance. https://blockchain.asu.edu/smart-contract-insurance/
Nakamoto, S.: Bitcoin: a peer-to-peer electronic cash system. Cryptography Mailing list (2009). https://metzdowd.com
National Association of Insurance Commissioners. Report on the cybersecurity insurance and identity theft coverage supplement (2019). https://content.naic.org
International Association of Insurance Supervisors. Application paper on supervision of insurer cybersecurity (2018). https://www.iaisweb.org/page/supervisory-material/application-papers
Ostrovsky, R., Skeith, W.E.: Private searching on streaming data. In: Shoup, V. (ed.) CRYPTO 2005. LNCS, vol. 3621, pp. 223–240. Springer, Heidelberg (2005). https://doi.org/10.1007/11535218_14
EU-U.S. Insurance Dialogue Project. The cyber insurance market (2018). https://eiopa.europa.eu/Publications
Romanosky, S., Ablon, L., Kuehn, A., Jones, T.: Content analysis of cyber insurance policies: How do carriers write policies and price cyber risk? SSRN Electron. J. (2017)
Woods, D., Agrafiotis, I., Nurse, J.R.C., Creese, S.: Mapping the coverage of security controls in cyber insurance proposal forms. J. Internet Serv. Appl. 8(1), 1–13 (2017). https://doi.org/10.1186/s13174-017-0059-y
Woods, D., Simpson, A.: Policy measures and cyber insurance: a framework. J. Cyber Policy 2(2), 209–226 (2017)
Yurcik, W., Doss, D.: Cyber insurance: a market solution to the internet security market failure. In Proceedings of The 1st Workshop on the Economics of Information Security (2002)
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2020 Springer Nature Switzerland AG
About this paper
Cite this paper
Su, J., Bartholic, M., Stange, A., Ushida, R., Matsuo, S. (2020). How to Dynamically Incentivize Sufficient Level of IoT Security. In: Bernhard, M., et al. Financial Cryptography and Data Security. FC 2020. Lecture Notes in Computer Science(), vol 12063. Springer, Cham. https://doi.org/10.1007/978-3-030-54455-3_32
Download citation
DOI: https://doi.org/10.1007/978-3-030-54455-3_32
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-030-54454-6
Online ISBN: 978-3-030-54455-3
eBook Packages: Computer ScienceComputer Science (R0)