Protect Automation Designs with Low-Cost Security Processors

The premise of home and building automation can transform how people manage their day-to-day lives by allowing them to manage home appliances; lighting; security systems; and heating, ventilation, and air conditioning (HVAC) remotely via smartphones, tablets, and online portals. But home and building automation are incomplete without secure designs.

While smart Internet connectivity allows automation features to connect to homes and buildings across the world, this proliferation in the connectivity of home devices comes at a cost: Critical vulnerabilities create a high level of risk after these devices are directly connected to the Internet. In other words, the absence of proper security mechanisms and boundaries is like releasing a "bull in a china shop," in this case, called a smart home, to wreak havoc.

Plenty of news stories about security breaches in a smart home environment exist—ranging from the hacking of baby monitors to the theft of door lock codes to the vulnerabilities of surveillance cameras. The unprotected smart home devices, or nodes, are an attractive target for hackers, as they break into home networks, steal and misuse sensitive personal data, and gain unauthorized access to smart homes (Figure 1).

Figure 1: When home automation meets the dangerous wonderland of the Internet, security becomes imperative. (Source: Microchip)

Take, for instance, a smart home gateway that connects and manages multiple devices such as remote thermostat programming, home surveillance, and connected lighting. Imagine a smart home node like a closed-circuit television (CCTV) camera talking to the home gateway via a Wi-Fi link: If a hacker enters the scene with a Wi-Fi transceiver, then he can connect to the smart home gateway because security credentials don’t exist inside the gateway design. In this case, there is a compromise in the smart home’s security.

However, if the smart home gateway possesses the proper security mechanism, the hacker doesn't have the capability—that is, the embedded credentials—to access the system, so this smart home gateway is able to detect the rogue elements and stop the attack.

Now, how do we protect a networked smart home control system from a hacker’s ploy to analyze, decode, and sabotage this system? Let's assess the major design options available to answer this question and stop people from trying to hack into smart homes and buildings.

Smart Home Security Options

A home automation application is only valuable if it's safe and reliable. On the one hand, recent attacks on devices like thermostats and surveillance cameras reveal the hackers’ ploys to take advantage of the software proximity with security keys. After such attacks, by the time software developers can create patches for a security threat, hackers are already able to find a new loophole.

Another issue is that software-based security solutions for embedded systems, like home automation, are becoming increasingly complex. Embedded systems, such as security cameras, are running for longer periods of time, and it's cumbersome to carry out periodic updates in systems like those found in surveillance cameras and connected lighting (Figure 2).

Figure 2: A smart home gateway with a security chip can safely manage such devices as home appliances and surveillance cameras. (Source: Microchip)

Because of this array of issues, not surprisingly, hardware security architectures are emerging and reshaping the Internet of Things (IoT) security paradigm. Reliability-conscious industries, including home and building automation, are increasingly adopting processor-centric hardware solutions. (It's worth mentioning that while it's imperative that security is built into a home automation system early in the design cycle, the choice of the hardware platform is critical.)

For example, Multicore processors exist that integrate cryptographic and secure memory in a system-on-chip (SoC) design. These cryptography-enabled microcontrollers provide a simple way to add fundamental security to such embedded products as a smart bulb or a thermostat.

Then there are security co-processors, also known as secure elements and crypto elements, which carry a design that begins from the ground up. These co-processors create a counter against multiple security threats through the integration of all three security building blocks that include encryption, authentication, and secure data storage (Figure 3).

Figure 3: This is a block diagram of a security co-processor showing the encryption, authentication, and data-storage building blocks. (Source: Microchip)

A security co-processor is a low-cost microcontroller that allows even small and economical IoT nodes to implement strong cryptographic methods for mutual authentication and session key derivation. It offloads cryptographic processing from the main microcontroller unit (MCU) or microprocessing unit (MPU), which in turn leads to lower power consumption and a faster authentication time.

Security Co-Processors for Home Automation

Smart home designs require sophisticated security solutions; however, developers are usually working with tight budgets, but using security co-processors clearly solves this dilemma. Another factor that favors these specialized security chips in home and building automation designs is the need for and heavy involvement of authentication tasks, which are mostly for the sake of confirming a device’s and network’s identity.

Furthermore, security co-processors contain security keys and certificates, a crucial requirement to maintain smart home device and network identities. Take, for instance, a magnetic sensor that turns lights on and off in the kitchen: Protecting such sensors is important, but more important is the protection of the data-gathering conduit within these smart home devices.

There is also a strong need for an authenticated data chain from protected nodes, like refrigerators, ovens, and washing machines, to a web server or a cloud service, like Amazon Web Services (AWS). In other words, the implementation of security is imperative at multiple levels throughout the design—from the sensor to the smart home node to the cloud service link.

That brings us to a critical aspect of security in home automation environments, device-to-cloud authentication. One type of device-to-cloud authentication is Transport Layer Security (TLS). TLS communication provides authentication and encryption services for smart home nodes so that network hops between a client and a server merely see encrypted content.

However, if TLS occurs in software, an omission of a secure storage for keys and sensitive data allows hackers and spoofs to exploit software bugs and break into the memory of a MCU or MPU where sensitive data resides. On the other hand, security co-processors that store private keys, certificates, and sensitive data in secure hardware facilitate a hardening of the well-known TLS implementation stacks, such as a Secure Socket Layer (SSL) in the form of an OpenSSL and wolfSSL.

Hardening enables developers to eliminate software vulnerabilities by creating additional hardware security layers. A security co-processor offers the simplest way of implementing a secure TLS stack. Besides allowing TLS hardening, a security co-processor enables a smart home node to issue an authentication to a cloud service without a user-perceptible delay.

Consider, for example, how a washing machine talks to a cloud server via TLS communications or how an energy meter utilizes a TLS mechanism to secure a link to the cloud. The hardening of TLS communication via a specialized security chip speeds up an authentication during a connection between a smart-home device and a cloud service.

Conclusion

A security co-processor is an inexpensive chip (typically less than 50 cents) that covers threats from physical and remote intrusions. The lower cost of these co-processors brings the hardware security realm to cost-conscious markets such as home and building automation.

Security co-processors carry pre-loaded keys, further simplifying the security obligations for home automation designs. These specialized security chips can also facilitate certified cryptographic algorithms especially suitable for smart home environments.

Home and building automation consist of viable and cost-efficient hardware security solutions for safeguarding connected appliances, Wi-Fi routers, and Internet Protocol (IP) cameras. Thus, a broad array of new smart home applications can benefit from these embedded security solutions.

You can now evade security breaches in a smart home environment by employing security co-processors that offer an embedded "root-of-trust" for monitoring door locks, smoke sensors, wireless security cameras, and motion and contact sensors. Secure boot, the first line of defense against breaches in an embedded system’s firmware code and operating system, is also crucial in home automation systems where there is a lot of remote access activity.

The attacks on smart home environments are becoming more sophisticated, but so are hardware security solutions that provide mutual authentication, secure updates, and firmware monitoring of connected smart home devices, and it now doesn't take a fortune to design hardware security within home and building automation systems.