Security and privacy are addressed at many layers.
The objective of the Internet of Things is connectivity and interoperability of many connected devices. There is a large amount of data that is being generated. This data is transmitted from end devices, the “things,” through a network of gateways, routers, smartphones, PCs and other devices up to the cloud into vast databases. Many sources of little data develop into Big Data. Information and actions are derived from this data. In turn data and commands are transmitted back down through this network to the Things in the IoT. At each point there is vulnerability to malicious attacks, and interception of vital information.
Security and privacy are addressed by many layers. The IT industry has been battling cyber threats for many years. Network firewalls and protocols manage the high-level traffic of the Internet. Security measures, both hardware and software, are being implemented at the system, network and device levels. As the IoT continues to grow, more end node devices become connected. The challenge is security for deeply embedded end devices that usually have very specific, defined functions with limited resources available. The semiconductor industry is delivering some of the basic technology.
The IoT looks to connect ecosystems that have developed independent of each other. These are often referred to as silos. Devices in segments such as industrial, building automation and vehicles were not expected to connect to the “outside world.” As these ecosystems become connected, the technology that has developed for securing networks and communications will be implemented.
A significant vulnerability is the communication connection. For IoT, wireless connectivity is key. The most widely used communication standards have security in their specifications, such as Wi-Fi and Bluetooth. Chip vendors are able to provide this security in their communication chipsets with specialized hardware. Even with a secure communications link, a huge hole in security is actual usage of passwords and logins. Many users have not made the effort to use these effectively. But there are also legacy communication standards with no security specifications, such as Controller Area Network (CAN) used in automotive and industrial applications. It is up to the applications using CAN to deploy security mechanisms.
Chip vendors offer powerful cryptographic engines embedded in their hardware. These perform a number of different algorithms, which meet stringent government standards. The cryptographic functions are used for generating and managing public and private keys for security and authentication of data. The hardware accelerators perform encryption and decryption and secure the data.
Hackers will look for any method to find and exploit vulnerabilities. Software and APIs (Application Programming Interfaces) are most prone to attack. Embedded security features in a chip are considered more difficult to crack. One type of attack is known as the “brute force” method. Essentially the attacker systematically checks all possible keys and passwords. This type of attack becomes difficult for long complex passwords. As key length increases it becomes exponentially more difficult to crack using a brute force method. This is a costly and time-consuming method. Thus, other types of attacks looking to exploit vulnerabilities are employed.
A side channel attack (SCA) is a surreptitious and sophisticated method to determine how a device is functioning. An attacker will use electronic equipment to monitor a chip’s physical characteristics to determine its cryptographic scheme. This includes monitoring a chip’s power profile, timing, and electromagnetic emissions. There are various techniques that are employed in hardware to counter this type of attack.
Hackers will try to reverse engineer a chip to understand how it works. This is physical tampering, which includes opening up a package to get to the die. Chip vendors have various methods to counter tampering including self-destruct mechanisms.
The security technologies developed for enterprise, industrial, financial, smart card and medical applications are being leveraged for IoT. This adds cost to a chip. MCUs for automotive applications are embedding these technologies in order to secure vehicles for the Connected Vehicle program. Consumer devices may not be able to afford many embedded security features in the controllers. Providing a secure boot, at the very least, would be helpful for many end use devices. The secure boot is also known as a verified boot or trusted boot. This feature allows only signed software to run on a device, usually from the device manufacturer. Without a secure boot a hacker could install malicious firmware during boot up.
Semico Spin
Throughout the IoT ecosystem, from the cloud, through routers and gateways, to end devices security encompasses:
The ecosystem needs the collaboration of software, firmware and hardware to deliver and disseminate security. As vulnerabilities and security breaches are reported in the general media, consumers and businesses are becoming more aware of the need for security, especially as connectivity continues to grow. The semiconductor industry has the hardware security solutions. Chip vendors and third party IP licensors are leveraging their expertise and technology to counter vulnerabilities into new markets. The challenge will be the tradeoff of security and cost.
If you’re interested in more information on this topic please contact Rick Vogelei and ask for report entitled “IoT Security: At What Cost?” MP104-14.
 |
 |
 |
 |
 |
 |
 |  |
Leave a Reply