As every player with a stake in IoT is aware, security is paramount for the safe and reliable operation of IoT connected devices. It is, in fact, the foundational enabler of IoT. Where there is less consensus is how best to implement security in IoT at the device, network, and system levels.
Network firewalls, Intrusion Prevention Systems, and protocols can manage the internet traffic coursing through the network, but how do we secure deeply embedded endpoint devices that usually have a very specific, defined mission with limited resources available to accomplish it?
These are critical concern that must be addressed to enable several current and future applications. Existing solutions are often not integrated into the entire system, and sometimes they violate the criteria that designers have taken into consideration from the beginning.
Get the WhitePaper on security implications that affect Internet of Things
BUILDING SECURITY IN FROM THE FOUNDATION BLOCKS
Knowing no one single control is going to adequately protect a device, how do we apply what we have learned to implement security in this scenario? We do so through a layered approach to security which starts at the inception when power is applied, establishes a handshake of trusted computing baseline, and anchors that trust in something immutable that cannot be tampered with.
Embedded security refers to building security in from the start i.e. security features built into a device. Some of the major building blocks for embedded security for IoT are:
- Cryptographic Algorithms
This is the essential foundation of a strong security solution within IoT. The design constraints placed on IoT sensors require lightweight, highly optimized, easily deployable cryptography scheme that provides high levels of security while at the same time minimizing memory usage and power requirements. - Secure Storage
Cryptographic algorithms involve keys as their root for operation. Since the algorithms are published and known to all, which also includes potential attackers. Thus, defending the secrecy of the key is a significant issue for security. Secure Storage fundamentally deals with shielding access to keys and other pieces of data. - Secure Boot
The idea of Secure Boot is to transport the system to a recognized and trusted state. The Secure Boot routine is a ROM-based routine. Therefore, an attacker cannot interrupt the process. Extra features are essential to provide a complete Secure Boot solution. - Secure JTAG
Most of the embedded devices have a JTAG interface for debugging. However, if this is not properly secured, this interface is open to the risk of becoming an attack vector within the solution. Some solutions allow the regulation of JTAG access using One Time Programmable eFuses:
- Disabled JTAG: This mode provides the highest level of security. All critical JTAG features are permanently blocked. This mode is not always recommended as sometimes there is a requirement of boundary scan which could affect the RMA procedure.
- Disabled debugging: This mode prevents debugging but allows for the boundary scan functionality to be enabled. This solution is the recommended mode for ensuring the maximum level of security.
- Enabled: This solution provides the lowest level of security and is the default setting of devices.
- Secure: This mode provides high security. JTAG use is regulated by a 56-bit secret key-based challenge/response authentication mechanism.
- Secure Execution Environment (SEE)
It refers to a processing unit which is capable of executing applications in a protected manner.
Secure Execution Environment refers to a plurality of distinct virtual machines that are created and operate simultaneously and distinctly from one another. This includes at least one virtual machine to implement trusted guest software in a secured memory area and another virtual machine to deploy a non-trusted guest operating system (OS) parallelly in an unsecured memory area.
END-TO-END SECURITY SOLUTION: The Way Ahead….
Security at both the device and network levels is critical to the operation of IoT. The same intelligence that enables devices to perform their tasks must also enable them to recognize and counteract threats. Fortunately, this does not require a revolutionary approach, but rather an evolution of measures that have proven successful in IT networks, adapted to the challenges of IoT and to the constraints of connected devices.
Get the WhitePaper on security implications that affect Internet of Things