Everybody has the same problems, and that's the distribution of trust. How do
you trust unmanned devices millions of amount in operation and how do you coordinate them?
How do you get them all working together? Welcome, everyone's the Industrial
Security Podcast. My name is Nate Nelson. I'm here with Andrew Ginter,
the vice president of Industrial Security at Waterfall Security Solutions, who's going to introduce
the subject and guest of our show today. Andrew, how are you.
I'm very well, Thank you, Nate. Our guest today is doctor Christopher
Gorrog. He is the CEO at block Frame, Inc. And he himself
is the host of the new cyber Frontier podcast and he's talking to us today
about establishing trust distributing security credentials in large industrial arts operations. Then, without
further ado, here's your conversation with doctor Gorog. Hello Chris, and welcome
to the podcast. Before we get started, can I ask you maybe to
give a few words of introduction about yourself and about the good work that you're
doing at block Frame. Yeah, thanks a lot, Andrew. My name
is Christopher Gorrog. I am a PhD in cybersecurity, just recently finished my
degree where I worked on the distribution of trust by using all means of other
things blockchain, what we call distributed ledger. But my background has been in
cybersecurity. I host the new cyber Frontier podcast, which we have over four
hundred episodes, been running nine years, probably one of the largest followed out
there. I chaired Digital Privacy for I Trip we for a global initiative,
among many things, hold several patents and my work with the University of Colorado
and this State of Colorado to help support legislation in the area of privacy and
security. So a lot of things we'll get into as we unpack in today's
Today Show. You know, our topic today is trust distributing security credentials in
large industrial operations. Can you talk to me a bit about the problem.
What is a large industrial operation? What does it mean to distribute security credentials?
Why is this important? Yeah, Andrews, So, I mean,
that's that's the ultimate question. The problem set that I've been solving or working
on literally my entire career, because even in early stages of my careers working
with many different vendors that are implementing security. Everybody does it a little bit
different. Everybody has the same problems and that's the distribution of trust. How
do you trust unmanned devices millions of them out out in operation, and how
do you coordinate them, how do you get them all working together? And
then how do you secure Fear of them becomes a function of that trust once
you can distribute it. We have several methods that of distribution of trust using
certificates and PKI, which the parts that we have a problem with is the
human part. The people that own the trust authorities, the certificate authorities,
the people that we have to rely on, and they don't trust each other,
they don't work together. They're different governments, they're different companies, and
we have a disjointed So looking at solving the problem industrywide is what I've been
approaching literally for you know, some of my work started in two thousand and
six, two thousand and seven working with SGIP and the s martkeret in our
optability panel. You'll find me on the Cryptographic Key Management of the Nister seventy
six twenty eight IR as one of the initial authors where we put together you
know, what is needed for cryptographic key management. Back then, we didn't
have of the global recognition of the tools that we know in blockchain. So
my work in my dissertation has been in trying to solve the problem of trust
distribution by taking care of the human needed pieces using distributed ledger and making that
work. And that's what the focus has been. And I think we have
some great solutions where we can show now feasible, global, attainable, scalable
problem solutions in that area. And you know, to clarify, you've said
millions of devices. I mean I understand cell phones, I understand smart watches,
millions of these things in the industrial space. You know, to me
when we're talking millions of devices, what leaps into mind is the smart grid.
It is you know, smart meters, it is advanced metering infrastructure.
Whatever the buzzword of the day is. Is that what we're talking about here
or other other applications. Yeah. Absolutely, We're talking from the smallest sensors
to even PCs and servers, so all across the board. And that's one
thing. For years I worked with a semiconductor manufacturer in placing and putting cryptology
into many different vendors devices. And you know, in that realm there's literally
like one hundred you know, sixteen bit processors made for every thirty two bit
processor, and there's like one thousand and eight bit processors made for every every
sixteen bit processor. So the smaller the devices than actually the more of them
there are out there, and that's the problem. We have relatively efficient solutions
for the computers that humans sit behind, but the millions and billions of devices
that are unmanned on the grid that communicate as a mesh that we might just
read on off temperature power from one hundred times a day or even an hour,
that that's really where the problem is is in that mass amount of devices
out there. So Nate, you know, I'm thinking back. I remember
a few episodes ago there was a gentleman on talking about the can bus.
I'm not sure our remember his name, but that's the bus that's in automobiles.
I think this was Ken Tindall, Yes, And you know his observation
of truism in the space is that encryption is a tool for turning every problem
into a key management problem. And I think this is sort of another example
of that that principle that we're seeing here. You know, we're talking about
blockchain, we're talking about cryptography, we're talking about authentication, so that devices
can prove they are who they are, and all of that involves managing keys,
it involves more generally managing trust and the application that springs to mind.
The first place I saw this in the industrial space, you know, a
decade ago, was in the context of smart meters, power meters on every
every consumer's home or apartment, you know, billing appliances, and we're talking
big systems. We're talking you know, a distribution power distribution system in a
city with you know, three million smart meters, and you know, as
Christopher pointed out, there's other really big systems out there. So you know
what springs to mind is if you're monitoring, let's say, a water treatment
system and you want to know what's coming at you in the watershed, you
might have rain fall sensors. You might have you know, water level sensors
spread in thousands of locations throughout a massive, you know, three hundred five
hundred kilometer wide and long watershed. You might have weather sensors throughout you know,
a whole country, gathering data for weather prediction. You might have smart
cities, you might have traffic sensors everywhere. And you know his point that,
yes, there are sort of big computers, thirty two bit sixty four
bit processors. In these systems of you know, thousands, tens of thousands,
million, sometimes of devices, there's very few of those sort of big
conventional computers analyzing the data. Most of what we're talking about here are very
small. He's talked about eight bit and sixteen bit, talking about compute capability
in a lot of these circumstances out in the middle of nowhere, there is
no electric power. You're talking solar powered devices. You're talking not just limited
compute power, but limited electrical power. This is sort of the big picture
of the problem that Christopher's going to be talking about. And you know,
when you put it like you just did, it occurs to me. You
know, on this podcast we're usually not exclusively, but usually talking about you
know, manufacturing, plants, refineries, hospital These are sites where you sort
of have a boundary around them, for better or worse, and most of
it is indoors. Maybe not entirely. It's like a controlled space. But
as you just mentioned, you know, when you're talking about smart meters or
traffic sensors or what have you, these are really widespread outdoor, sort of
everywhere situations. I would wonder how this affects the security problem. And I'm
sure that you guys are going to get into that. The main problem I
heard you describe here was key management. And you know I've heard encryption described
as a tool that turns every problem into the world into a key management problem.
What is the key management problem when you're talking about I don't know,
traffic sensors or smart meters. What can you give me an example? What's
the problem? Why do we need a solution at all? I said cryptographic
key management. Some people might call it trust management. Root of trust management.
It's the piece this is in the center of your every device. And
if you have an energy meter, for example, and a company makes a
model and then they mass produce a million of them, the software is exactly
the same. The only thing different is the serial number in there that tells
it which one am I. But now in the age of virtualization, you
can have a virtual machine running a simulated software meter a real software meter,
and if they're all on the internet, you can't tell the difference. So
some people might say the root of trust is an identification problem, and each
device being able to identify itself, but to also uniquely say that I can
not only identify who I am, but I can prove that I made this
operation, I produce this data, I communicated with this other device, and
the two devices can prove each other and say I'm actually talking to the device
I'm supposed to be talking to, and not a virtual device that's mimicked of
it, or some other device or somebody is in between listening all those pieces
in security that make each device. And I know this gets kind of in
the conceptional level, but we move it down to an energy meter. Can
all my energy meters on my grid verify that I'm talking to them from my
reading station, verify that when they're talking to they're talking to each other when
we're collecting the data, and that the data is accurate and naturally came from
them, so that we can then have valid information for billing, or valid
information for our control structure or for our demand response. But all of the
information that comes to and from any embedded system that people might not touch for
ten years becomes questionable, whether it's authentic, or whether it's valid, or
whether we're even talking to the advice we are with the interconnected age? What
is the risk here? Let's say that I have you know, found on
the internet, and someone has stolen a copy of the firmware for the smart
meter that you know is in my home. I put it up in a
virtual machine and now I'm impersonating a smart meter. I you know, in
principle, can find the serial number on my device because it's they're attached to
my home, and I, you know, can can you know embed it
in the virtual machine? And now I can you know, disable somehow put
you I don't know, tinfoil around the meter. U disabled communications between the
meter and the grid, and now I can impersonate the meter and say,
Andrew's not using any power? Is that what we're talking about? Is that
the attack scenario or you know, is there something else you're thinking about?
So when you're looking at a meter, the attack scenario is the company protecting
itself from the customer. And I think that's kind of what you were alluding
to. When we get into the day and age that everybody's a producer and
a consumer and micro grids and powers coming onto and off the grid by different
people at different times of the day, different different providers, the meter becomes
your proof of whether you took power or provided power. To the grid.
And if you, as a utility company, have a whole bunch of customers
out there that are telling you they're providing power to your grid, and you
now are expected to pay them, how do you prove that they're accurate?
Is the question we're answering here In that case. In the it's not as
important if all the meters are owned by the company other than to get an
overall we're not getting falsified. But when we get into that now renewable peer
to peer energy ecosystem of micro grids, we can't trust the people. If
we can't trust the peaceeople providing the information from a microgrid to make monetary transactions
based off of we end up with anybody being able to scam the system.
And definitely because you can't prove that they put power on other than their communication,
which of their communication is not provable mathematically, cryptographically. And that's what
this root of trust in the distributed devices gives you. You know, to
me, clearly, there's there's a need. You know, you've convinced me
there's a need to identify these meters, especially if they're putting power onto the
grid. I mean partly billing, Yes, but partly, if you've got
enough of these things, there's grid stability that might be at risk. But
is the solution not that when you know, the technician shows up at my
home to attach a meter to my house. Is the solution not that the
technician writes down the serial number and you know, presumably has a there's a
database somewhere associating serial numbers with private keys that are built into the into the
device. Is that not the solution? Why do we need something more complex?
So the solution, you know, if you think about what you just
said, where the private key of the device, right, And you're the
solution set isn't the private key in the device. It's getting the private key
to the device. And if that's somebody doing it every time a vendor puts
one on the grid, there's fifty different vendors that makes products for it.
Everybody does it differently, and everybody has a different certificate authority if they're using
certificates, and the certificates can be changed, they can be stolen, they
can be spoofed. In a virtual machine, you can imitate another machine entirely.
So if we scale back and step back and say, yeah, the
meter set is one problem in the consumer base, and we're moving towards that
distributed consumer producer environment. The bigger problem, at least the now problem,
is in the control structure, the demand response and the infrastructure of control,
and that they have equipment made by many different vendors that go into this and
they have to have microsecond responses from trusted equipment, and the only way to
do that is to keep it on a private grid, private network. And
each utility company now wants to start interconnecting and working across utility companies. They
have hundreds of thousands of devices that a human might not touch for five or
ten years and keep keeping and maintaining these those keys that you just talked about,
the private keys in every device is a human centric problem, and that's
where we're falling short. What we're talking talking about here is modularizing and making
that human solution done uniformly to have their cryptographic keys managed so you can see
them not just for a grid, not just for a utility company, but
for the industry many different companies, many different vendors that all come in and
put products in this kind of Frankenstein mesh, and all of them are different,
and all of them are done by different people who we might not know,
might not trust, different levels of software, different levels of responsible people.
Even maybe something made in a supply chain where it was in another country
and there's purposeful, harmful information or malware injected into it. So that mish
mess of unpredictableness is the problem that really is plaguing that whole industry. We
are all working in our own space without the to know that who we're talking
to and what we're putting on our networks and into our systems is actually authentic.
Okay, So you know that kind of frames the problem for me.
We're talking millions of devices on the grid. Some of them are measuring power
consumption, some of them are measuring power productions, some of them are measuring
other things. There's a lot to measure when we're when we're talking about that
level of granularity. And yet you know, while I take your point that
you know there can be manual intervention in the course of deploying the equipment.
It could be from lots of different vendors, and if it's going to sit
there for five or ten or fifteen years, the way this stuff often does,
I mean, you know, when was the last time you updated the
firmware, and you're a refrigerator if it's going to sit there for a long
time. These keys age best practices that, especially on the Internet, you
don't leave the key in there forever. There's got to be a way to
update these and you know, coordinate the updates across producers and consumers of the
information. It all makes sense that this is a problem. You've got a
technology. Can you talk about the technology? What kind of technology are you
proposing as the solution to this problem. Yeah, So from an industry level,
working with many different vendors and literally fifteen years, twenty years of my
career has been working to solve this problem is identifying what are all the things
that they have been doing. And the first part was to create a modular
piece that could go into any device that would handle all the things that everybody
is using for security and simplifying it. The interesting thing is we overcomplicate what
the is being done and we make a thousand different applications. But security is
kind of like an art form as much of it as it is a technology.
Where in artwork we only have nine components that make up paintings and pictures
and sculptures and artists learn these in college and once you can master each one
of the nine components like line, form, volume, shape, parallax.
Uh, there's there's nine of them. Cybersecurity similarly, there's only seven things
we do, and people might challenge this, but we identify data, we
authenticate users and systems, we establish connections, we hide data or encrypt it,
We blog and operations and verify that the the data and the operations,
and we distribute trust. I think that was seven. So if we make
a way to unify the ability to do all those, we can put that
modular approach into every system, every vendor, every to every product, and
then we the second thing is to make a way to change that out because
we know that we can't keep the same security forever. So the second part
of what we do is a method using distributed ledger known as blockchain, to
be able to change out those credentials, the human piece that we usually do
with a guy running in the truck to it, and be able to do
that and prove that it was done globally so everybody sees it, so we
can prove who it basically is responsible for that provisioning. It's called of those
cryptographic components, and it doesn't have to be somebody that you don't trust.
It's open. And this is where we kind of borrowed that distribution of trust
using blockchain what we know from like cryptocurrency, but using it in a totally
different way to actually distribute the root of trust the cryptographic keys, which are
all standard cryptography. Just doing the human aspect, but proving that, improving
the providence of it, the attestation of how that happened over your whole grid,
over every product, or over your supply chain throughout the life cycle of
the product, and maintaining that over time an over distributed area and over geographic
and over logistics of networks, and even the people aspect of it, connecting
your workforce and maintenance. Andrew, we've done somewhere north of one hundred episodes
of this podcast at this point. Are there really only seven steps to industrial
security? Here? I should have asked, I was. I was kind
of wondering that myself. I did it quild Google afterwards. I haven't seen
where the seven steps come from. But you know, if you ask me,
those are seven steps that are integral to communications security, and you know,
yeah, we've been doing one hundred episodes. We're talking about the big
picture is more than communications. It has to do with physical security, It
has to do with you know, people, process and technology, has to
do with with you know, host based a lot host based stuff, you
know as well, you know, concrete example, if the you know,
I've got a host, I've got you know, it's a it's a I
don't know, a Windows box, a Linux box, a server sixty four
bits, big, big operating system. And it turns out that my crypto
library has a vulnerability in it, and that vulnerability can be exploited simply by
sending a message across the Internet into the machine, into the host, into
the server, and that compromises the library. It makes it you know,
I don't know, buffer overflow, it makes it do bad things. You
know. No amount of key management is going to solve that vulnerability problem.
That's a patch problem. So if we're talking about pushing data across the wire,
if the receiver the server is asking the question can I trust the data?
Well, then the seven things that Christopher's talking about here, these are
all steps that we do have to have in place. But the bigger picture
is there's a little bit more to it. So that makes sense. I
mean, we need to change these keys from time to time. We've got
lots of different vendors and you know, power utilities and others involved. When
we make a change to the key somewhere, we have to publish that.
That publication mechanism has to be standards so that everybody can consume the knowledge that
we've just changed the key. Everyone who has to communicate with this device.
We have to make sure that that process is authentic, that it can't be
spoofed by someone trying to you know, steal power or you know, do
other malicious things. And the solution that you're proposing is blockchain. So can
we talk about the solution in a bit more detail. I mean bitcoin is
power hungry. Bitcoin, you know, there's farms of servers involved. It's
not going to work with an eight bit CPU. What what does your solution
really look like? There's a lot behind that simple question, and it comes
you know, in two parts. One, the part that we're provisioning is
very tiny and literally the cryptographic keys and the continued operation only takes up sixty
four K of memory in a small sensor device. So now we look at
that's what goes out, and that's the key distribution. That's what goes on
your device. It doesn't take much size. Now, the distribution of blockchain
was a whole other problem set. This actually spent the last six years my
PhD dissertation in solving the problem of scaling blockchain, and we actually throughout traditional
blockchain. That's why I always try to say we have a distributed ledger.
We now are going to the third generation. Of the first generation was cryptocurrency,
the second generation was smart contracts and your ethereum, your hyperledger fabric.
And now we have a third generation that doesn't use the mining, a different
algorithm that turns around the word to be your time spent participating storing data over
time is how you gain your incentive versus a wasted energy up front. And
we're actually running peer ledger distributed ledger nodes on a Raspberry Pie that's how small
they can run on. And then there's a it's designed modularly so it can
expand indefinitely, where we have a consortium that's similar to your dns on the
Internet, that manages who's out there and the governance of it. And then
each individual peer that can scale horizontally like your routers on the Internet, and
we're turning into this new animal of no mining and indefinite scalability. I think
it's you know, I'm excited about it, but it's been my six seven
years of work, and you know, I love to help anybody understand more
about it. Bring in ask questions as much question as if you want.
My dissertation is out publication. You can find it under a sustainable framework for
a distributed ledger. There is the title of it on ProQuest and it's open
for anybody to view. Let me dig just little detail deeper. You know,
you talked about the memory footprint in the device. You talked about the
you know, the Raspberry pie is managing the ledger. Something you didn't mention
is the size of the ledger. I mean, in my understanding, the
Bitcoin ledger is now I don't know, I don't know, like a dozen
terabytes or something like that. It's and and that's you know, that's money
changing hands. If we have you know, millions of devices coming out of
each of dozens of vendors going into you know, hundreds of power utilities all
over the world, most of which are connected to at least one other power
utility. There's there's very few power utilities that operate in complete isolation. It
seems to me that, you know, is it the case Let me ask
you, is it the case that you have to be able to share all
of this key information for every device on the planet with every possible consumer on
the planet. And if so, is that going to scale sort of storage
wise? And that was actually the problem we set out to solve because whenever
we came up with the modular approach to distributing cryptographic keys, we actually tried
it on some second generation blockchains and used hyper ledger, fabric, sawtooth Lake
and ethereum, and it brought it to its knees. There's no way either
any of them could scale. So the whole design of a scalable blockchain was
based on being able to hit the mark of the needs for cryptographic key management
and how big that would get. And basically it's we came up with a
loosely coupled chain of chains, so side chains that operate independently. And that's
what I said, like a router, Like a set of routers you plug
in and they all work together, but not everybody has to have everybody's day
data. There's sub segments and it makes it scalable, but yet it's the
same forensic mapping to prove everybody's transactions and timestamp them globally. And it's a
unique consensus approach called a synchronous trust consensus model, where it adds a couple
of major things. One that we no longer have to keep data all the
way back to the genesis block. The data is kept as long as it
has value to the operator and until you get your incentive, which is set
for the longest time in about fourteen years, but only in subsets of data
as well, so not everybody has everybody's data, and the consortium service keep
the validation data of all the individual groups of ledgers that can now scale indefinitely
across the globe. My testing and you can read it in my dissertation where
we scaled this up to fifty two million ledgers, which is currently the size
of the number of routers on the Internet, to see if it would if
it would still be feasible and operational, and the scalability models predicted that we
could do this and that the growth in size and even the data we're going
to persist over time is manageable because we can phase it out over time and
basically have a window moving forward. And that management of data and the ability
to meet this mark is and has been that primary focus. So kind of
excited, like once again, open and talk more about this, and you'll
hear me speaking all over the place on it. But it is really a
very involved topic. We've had over four hundred people in the state of Colorado
involved, over eighty five people turn code on community source projects to and this
has been funded by the State of Colorado under legislation we wrote in twenty eighteen
through the University of Colorado, colors University, a couple others. And that's
why it's so big and exciting, because we've had so many people work on
it and getting excited about it that this is actually something that we can see
scaling to that next generation for solving those problems you brought up in your question,
so real quick, just a clarifying question. You know, you suggested
fifty two million routers, you said fifty two million ledgers. Does that mean
that each ledger could in turn manage thousands or I don't know, a million
devices, And so that's the you know, the fifty two million times one
thousand or a million that we're talking about, or is each leg does is
there a ledger per device? When I'm talking fifty two million ledgers, I'm
talking to the number of ledgers that can store an indefinite amount of blocks as
many as they can handle on the blockchain, So the amount of data transactions
is astronomically larger than that. Admittedly, Andrew, whenever this kind of subject
comes up, I become a little bit suspicious. If I had a nickel
for every time somebody sold me on a scalable blockchain, I probably wouldn't have
to do podcasts anymore. So. The question that I suppose I would ask
of doctor Gorrogh, which may well be answered in his dissertation or later in
your interview here, is whether this kind of blockchain solution that he is describing,
while scalable and fast and whatever usable as you need, offers the same
kinds of security protections or doesn't compromise too much on them compared with the other
blockchains that we're using as comparisons, you know, Bitcoin ethereum, the ones
that are slow and unscalable for reasons that aren't trivial good question. I did
not ask that question. I do know that, you know, one difference
between the system that doctor gorrog is talking about and the traditional sort of bitcoin
blockchain is power usage. I mean, the bitcoin blockchain already uses a measurable
fraction of all of the world's power, and we're talking about you know,
a tiny, tiny fraction of all the world's computers involved in that blockchain,
whereas you know, here we're talking about eight and sixteen bit devices, millions
of them in every city involved in this ledger. The second sort of thing
is I don't even know if this is the right question to be asking.
You know, the bitcoin blockchain models the movement of money, whereas here this
blockchain models trusted models. You know, the degree to which we can trust
different devices within an organization, across organizations. I don't even know if these
are the same questions. I mean, when we're talking about trusting things,
the thing that springs to mind, the system that springs to mind is active
directory. It's the classic system that's used for managing users, not even devices.
Actric directory doesn't manage devices, to my knowledge, to manages users,
and we're talking about, you know, a system that could in principle scale
to all of the devices on the planet being interconnected to some degree, and
I don't know how big active direct real scale, but I'll be deeply surprised
if it scales to all the users on the planet, much less the one
hundred devices per user that we're expecting to see deployed in the next century.
So firnt answer is, I don't know. The longer answer is, I
think it has to do with power usage, with scalability to you know,
sort of ridiculous scales. Is my understanding. You folks that you've personally been
involved in this for a long time. Block Frame as a company has been
involved in it for a long time. Can you talk about block Frame a
little bit more? What have you got in this space? You know,
if people want if a vendor called up and said, hey, you know,
I want to do this, you've convinced me. Do you have technology?
What are you offering in the space? Yeah, so we write block
frame has been around for seven years. The technology from my dissertation is wrapped
into Blockframe. We have literally patented the consensus model where we'll be the only
ones globally able to implement this as well as opened up a community project where
a lot of this work was done for the State of Colorado, funded under
many different sources, and a big piece of it is open source interfaces that
anybody can develop on top of to make your community your project, for your
application, write your own smart contract, do your own embedded application that implements
on top of the distributed ledgers for the blockchain side, or we also Blockframe
offers the modular ability and whether a hardware insert a physical device that goes on
your your IoT device that holds your cryptographic keys, or a modular We even
have a software approach. The hardware is always going to be more secure that
we can implement. Work with vendors right now to implement this and get into
your design for your next release, or work on getting it into patches that
could go out in legacy systems, so we can. We're offering for one
cost through the release or your product to get you on board, gets you
all your your tokenization on the blockchain, all your embedded designs, set up
support with making getting your product to markets, and we offer that all to
any vendor who wants to be an early adopter on this. If you're looking
at hey, I want to be on the next generation of security that's not
only modular, but peer to peer based. Now every device can go unique
one to each other, which opens up that thing that we've been looking for
and why people got into blockchain so heavily, because it opens up that peer
to peer, it takes out the middleman. It makes it so now every
one of our devices are individualized and can have a verification of each other.
Zero trust between any two devices because they can identify each other on the blockchain
before they communicate or commit to any operations and then do trusted proof of origins
signed data between the two of them. So this the the level of security
is something we haven't seen in our day and age where we're looking at you
know, to date we've collectivized data, all data is held by a company
an organization. We're looking at this migration to end, node to the edge,
to peer to peer, and it's just a new paradigm and how we
will look at security in the future. One other thing that struck me in
your description of the solution. You know, there's technology involved, there's you
know, sort of a community caations infrastructure, the distributed ledger involved. You
mentioned that there's patents involved. How how interoperable is this If you know,
a group of vendors on the other side of the planet wanted to do this
stuff, I don't know on their own, could they is you know,
is there or you know, is there a sort of a standard of standards
where these many different kinds of ledgers can interoperate. How I guess how universal?
You know? How how university available is the data here? Yeah?
And so we actually, like I said, we designed this for standardization,
for modern modularization. So every single cryptographic root of trust in all the devices
is a modular block Now what is in those is entirely different for each one
and your vendor, your product owner, for all their decides on certain pieces
of it. The industry utility registrar, which is a kind of like a
DNS server that programs that provisions a set of products out there, is able
to then uniquely identify each one. And we are licensing those registrars for different
companies to use, for different industries to use. So not only is the
individual pieces of it modular, the blockchain for the wayback machine, you can
revert back to a earlier stage that you did trust the device if it becomes
compromised and reprovisioned from that. But now we have the ability for multiple different
people, multiple different product owners, to take charge of their segment of the
market. And we have a we actually did a decentralized autonomous organization that owns
the rights to run and manage the public distributed Ledger, and that's the State
of Colorado, through the University of Colorado, is a part owner in that
because many people provided that effort. So the whole thing is designed around these
modular pieces that are developed for anybody to build on top. And then even
the smart contracts then become ownership of the person that wrote them, and they
can sublet or sell their smart contract for other people to use for whatever price
they want. And you have all these modular constructs within the overall system of
systems that makes everybody in the marketplace be able to run their own business and
be individual. The control structures that we put together is just to make sure
that we don't have competing standardization pieces, and that's why we decided to go
with the patent route, so we didn't have somebody competing against releasing the same
thing on the other side of the world. That we can then say from
the first couple phases, we get it very standard before we start that kind
of push and release structure. All right, Andrew, we are really getting
in the weeds of blockchain stuff. And I'm only faintly remembering that we are
talking about smart meters here. Can you help me with the connection? Yeah,
so sure, you know, it's not it's more than smart meters.
It's devices all over the place that need to talk to sort of control systems,
skata systems, sort of you know, high end analytical systems all over
the place. The example in the in the power grid is yes, smart
smart meters is one piece of it. It's information really, but we're talking
about about gathering information from many, many devices, and we're talking about sharing
information and sometimes even sharing devices between organizations. So it's not just the meters.
It's also the devices that are connected to you know, millions of rooftop
solar that are sometimes producing power and sending it into the grid, and you
know, the household is sometimes consuming power from the grid, and you know
these organs who wants to talk to these devices Whilst yeah, the grid wants
to talk to the devices the local utility, but sometimes there's other aggregators like,
you know, I think Google has a system now where they can talk
to your rooftop solar and aggregate your rooftop solar so that they can you know,
interact sort of more aggressively, more personally, you know, with human
oversight into power pricing to maximize the price that householders get for the power they
give back into the grid to to and of course Google takes a cut of
all that money. But you know, there we've got an example of a
couple of organizations talking to the same rooftop solder. You've got synchrophasers all over
the grid which are talking about, you know, measuring the in a sense,
the health of the grid. It's you know, I won't go into
phase measurement, but it's it's a technical thing that's done, and these synchrophaser
measurements make sense to share across the many utilities that are cooperating in the grid.
There's load shedding devices that have the ability to shed load that need you
know, instruction from outfits like Google that are maximizing what you get paid for
shedding the load that need to be you know, connected and report to the
local utility and possibly other utilities. You know, you've got high voltage charging
stations coming online everywhere that are pulling a lot of power from the grid that
need to interact with the local utility and possibly bigger utilities. You know.
In traffic, you've got different cities that are you know, coming up against
each other, different jurisdictions. They might not want to know what's coming their
way the simplest way and doing that might just be you know, connect to
some of the other cities traffic sensors. But now you've got multiple organizations,
multiple cities talking to the same sensor. You know, it's all about devices
that need to talk to each other, that need to talk to a central
analytical station, and where you've got multiple jurisdictions that need to trust, you
know, that might need to interact most profitably with individual devices. So it's
you know, it's all about sort of the big picture and interoperability. A
lot of our episodes on the on the podcast here are focused on you know,
program or logic controllers deep into heavily protected networks that nobody on the Internet
has any hope of having a look at. If we're out on the internet,
if we're reporting power usage, you know, the when we're out on
the Internet, privacy is often a much bigger factor than it is deep into
a heavily protected power plant network, you know. And so I've been asking
you sort of questions from the perspective of the industrial security aspect. But you
know, if my power or usages on the Internet, I do care about
the you know, who can see that? Have you got privacy stuff built
into this as well? And that's that's a great question because one of the
first things I started out looking at security and cryptographic key management is all about
security, is what I thought. Uh. And then when we started working
with the State of Colorado and looking at several different programs, they had over
seventy one programs last I heard a list of them that were candidates for this
type of these type of technologies. Each one had different requirements, and I
started asking, well, who makes a decision on them? And nobody raised
their hand. There's nobody making a decision. When we started analyzing those their
privacy questions there where is it held versus where's the store? What parts of
it are private, what parts are public? Who has opt in is it
opt out? Who who's allowed to have access, who's allowed to audit versus
who is allowed to see it? Are you allowed to audit without seeing it,
or they have to you get to know that they audit it. And
there's so many legal and privacy questions, and that actually drove me to start
asking these questions. We ran a campaign called Privacy for the People literally like
four or five years ago. We got some international kind of attention and now
I chair the Digital Privacy Initiative for I TRIPLEE, where we're looking at an
international level to set up a lot of the boundaries to answer those questions.
But things that we had to develop in the technology from the ground up is
like every operation, every transaction has a public and a private categorization, and
you tag the data whether it goes on the chain or whether it has to
be held privately offline, and then what to do with it becomes the question
after that or as different parts of that and what is required. We went
through the pandemic learning that certain things are socially we overpower and override, and
you have to have these things public so that we can all find out who
has a disease and the numbers and everything, But what are your rights in
that balance? And those are kind of the privacy questions and led to a
whole government. It's architecture with forty two dimensions of governance that you can find
in my dissertation if you pull that up. But this will be applied many
places because it really mimics the real world how we manage our governments as addressed
into technology applications and putting it into operation. So also a very exciting piece
of what I've done, and I think more of what I will give to
the world is along that lines than even the technology piece, because that's where
really I think we're making a difference in giving people those rights in the digital
era. This has been great. Thank you for these insights. It's a
more complicated space than I realized before we let you go. Can you sum
up for us what should we take away from here? What should we be
thinking about? So it's time to get involved. Right now we are in
the process of tokenization. Do an initial token offering for the distributed ledger.
Look for it, come in. It's not an investment, it's a a
a utility token. Sorry forget, but it is a way to get in
early and more. Offering some discount rates as well. On the cryptographic key
management talk to reach out to block frame tech dot com and we're bringing in
vendors right now to integrate it into their product to design this next generation security
today and have it in your next product release and when it comes down the
road. It's like I keep saying, I'm excited about it, and I
think we're changing the world. But I'll let you make that decision. But
come talk to us. Andrew. That concludes your interview with doctor Gorrog.
Do you have any final summary about what we talked about here to leave us
off? Yeah, I mean, you know, to me, it's all
about device networks, you know, backing away just a moment. The biggest
denial of service attack in history, if you recall what a year ago or
so two years ago was because internet connected household cameras had defects that were exploited
and all of them attacked, you know, one one or two sites on
the Internet at the same time. Not an example of trust. That's an
example of just scale. The scale we're talking about is, you know,
the number of these devices out in the world are just getting more and more,
and a lot of them are Internet connected, you know, and when
we connect an incredible number of devices across the Internet there's privacy issues, there's
you know, there's verification issues. Are these power readings that I'm getting from
rooftop solda producers in my geography? Are these are these you know readings real?
Should I really pay these people? Are these traffic sensors from the neighboring
city that say, I've got a problem coming my way, there's a traffic
jam coming my way, you know, take corrective action? Are these real?
You know, we're talking about about trust, We're talking about scale,
you know, the unprecedented scale. We're talking about interoperability between vendors, between
vendors and utilities, between utilities and other utilities, you know, probably even
other applications that I just don't get yet. So yeah, it's uh,
it looks like a kind of technology that we're going to see more and more
of on the Internet and you know, with industrial and other kinds of applications
going forward. So it's a space that I've tried to ignore, and I
don't know that I can anymore. Okay, Well, thank you to doctor
for doctor Okay, well, thank you to doctor Christopher Gorgh for speaking with
you. Andrew, and Andrew, as always, thank you for speaking with
me. It's always a pleasure. Thank you Nate. This has been the
Industrial Security podcast from Waterfall. Thanks to everyone out there listening