2023年3月29日

安全周刊全麵網絡服務更名為True I/O，並籌集900萬美元用於加速產品部署。總部位於加州的區塊鏈公司True I/O獲得了由Deal Box Ventures領投的900萬美元a輪投資。為了更好地反映其產品的主要目的，它同時將原來的名稱“全麵網絡服務”(TNS)重新命名為“真實I/O”。這筆資金將用於加速該公司通用通信標識符(UCID)的部署。這使用了由Rypplzz開發的Interlife地理空間平台上的一個許可的區塊鏈。雖然加密貨幣為大眾提供了投資機會，為罪犯提供了資金流動，但它為企業提供了區塊鏈。企業需要一段時間才能理解如何使用這項技術，但真正安全的應用程序已經開始出現。UCID就是一個很好的例子。UCID的主要目的是為移動或嵌入式設備(即物聯網)提供供應鏈安全。該公司與電信行業協會(TIA)密切合作，並使用移動設備標識符(MEID)來唯一地識別每個移動設備——無論是為每個客戶提供的幾部手機還是數千台工業物聯網設備。 The MEID becomes the token in the blockchain, immutably connecting the physical device with its own electronic record, and allowing the system to build an individual, secure and complete history for each device. For a hardware supply chain, UCID can track an individual device from its manufacturer, through the company installing the device, to the end user. “You would get digital verification or signatures from each actor along that supply chain,” CEO Thomas Carter told SecurityWeek, “verifying that the person has interacted with that device in a permissioned manner. Each actor knows exactly what has happened to the device so far and can be assured that it hasn’t been tampered with; that is, it is not a spoof device.” The cryptographic linkage between each interaction along the chain means that the record is complete and accurate whether the device was manufactured locally or abroad. This supply chain verification can also be applied to the software included on a device, proving it has not been altered by a third party along the path. It can also be used to verify the continued health of the installed software. UCID can monitor the hash of the installed code on a continuous basis – either daily, hourly, or even every minute – depending on the customer’s risk assessment for the device. Any change to the hash will immediately indicate an attempted intrusion or other software failure that can be investigated and remediated by the customer before it becomes a serious issue. The range of customer requirements – where some customers have just a few hundred devices while others may have many thousands or millions of devices – could be a challenge. True I/O tackles this in two ways. Firstly, it works with each customer to provide an individually tailored solution (so it could include SBOM verification if required); and secondly, it bases the pricing on each individual contract. “We do an assessment of each potential customer’s use case. We build out a high-level architecture of how the system could be designed, and then we ensure it makes financial sense for both the customer and ourselves,” explained Carter. Smaller requirements could be based on a per unit cost, while more extensive requirements would be priced at the overall contract as agreed between True I/O and the customer. Central to True I/O’s approach for UCID has been the use of standardization. The firm approached the TIA with the idea to tokenize TIA’s globally adopted identification system, the MEID. TIA responded positively and True I/O subsequently joined the comity to help design their latest supply chain security standards. As a result, UCID now meets five out of the eleven standards laid out by TIA’s SCS-9001. A similar approach to cooperation and standards led to the Electronic Medical Mobile Application (EMMA), announced in June 2022. “We were able to secure the largest implementation of blockchain technology into the US government via Forward Edge AI, in large part because of our standards approach and working with groups like TIA and GSMA,” said Carter.