The IoT Trusted Zone
A breach in security can be devastating, but use of best practices in design, such as isolating security-related hardware into "Trusted Zones," can limit attempts to access content from outside the zone and continually monitor things such as variations in temperature and voltage.
A Trusted Zone is the Bedrock IoT Security is Built on
Among security best practices, system partitioning separates and isolates security-related hardware, software, and data in a “trusted zone” and tightly limits all attempts to access trusted content from outside the zone. Non-secure software cannot directly access secure resources. The Trusted Zone isolates security-related Microcontroller Unit (MCU) hardware, software, and external devices (Figure 1).
Figure 1: A generic secure embedded system architecture must isolate security-related MCU hardware, software, and external devices.
Inside the Trusted Zone
Secure Boot and Secure Download
If an attacker can fool an embedded system into accepting fake code as authentic, all is lost. All code must be verified as trusted. During manufacturing, the factory generates a public/private key pair. The public key is stored in a secure location in the MCU, often in one-time programming (OTP) memory. When the MCU boots up at power-on or receives a download, it verifies the code against its key and rejects non-conforming code.
Hardware Accelerator
Implementing an advanced encryption standard (AES), Rivest–Shamir–Adleman) public-key cryptosystem (RSA), or Elliptic-Curve Diffie-Hellman (ECDH) algorithm is computationally intensive, so microcontrollers in secure embedded systems usually contain hardware accelerators to speed up everyday cryptographic operations. Specialized instructions in the MCU then access the accelerators to perform functions such as AES encryption and decryption.
A Secure Real-Time Clock (RTC)
A secure Real-Time Clock (RTC) guards against an attacker tampering with the clock settings to disable system operation. The function is often combined into a supervisor device that continually checks the system voltage and switches to battery backup if primary power fails; if the battery backup voltage drops, the supervisor will signal a tamper event.
True Random-Number Generator (TRNG)
Random numbers are critical in secure systems to generate random cryptographic keys for secure data transmission. A software algorithm can produce a long pseudo-random sequence. However, it is deterministic and therefore vulnerable to attack, so a secure microcontroller should incorporate a hardware True Random-Number Generator (TRNG), which gives an unpredictable output. TRNGs have a colorful history—the numbers from one early online TRNG originated in the waxy blobs generated by a lava lamp—but modern implementations use thermal noise or the interaction between several free-running oscillators as sources of randomness.
Temperature and Voltage Monitoring
In side-channel attacks, measurements and analyses of physical hardware parameters are used to access a system's or chip's cryptographic operation and extract the secret key. Excessive temperatures and voltage variations, for instance, can then be used to mount hardware attacks. In the event that the system voltage is removed, the on-chip environmental monitor switches to backup battery power, and the private keys are zeroed out.
Implementing a Trusted Zone for IoT Applications
There are several ways to implement a trusted zone for an embedded Internet of Things (IoT) application. One approach is to use an external device to replace or augment an MCU’s security capabilities and provide the trusted security zone needed to build out other security-related features. The external device can also separate the most secure elements from the complicated MCU or Memory Protection Unit (MPU) hardware, making it easier to protect the trusted zone from security-related faults and attacks. The Microchip ATECC608A is an ideal security device to support and augment any MPU- or MCU-based IoT application.
The Microchip ATECC608A as a Trusted Zone for IoT
The Microchip ATECC608A implements the critical security requirements for an IoT application in a tiny form factor; at very low power and with an easy-to-connect interface, it only requires a single GPIO over a wide voltage range. Being device ‘agnostic,’ it can work alongside a wide range of MPU and MCU devices. The ATECC608A delivers all the security and cryptographic features required for even the most robust IoT applications—even in a tiny footprint. Some of the advanced features include:
- Secure Hardware Key Storage for up to 16Keys, certificates, or data
- Hardware support for an asymmetric sign, verify, and key agreement with ECDSA (FIPS186-3 Elliptic Curve Digital Signature)
- ECDH: FIPS SP800-56A Elliptic-Curve Diffie-Hellman
- NIST standard P256 elliptic curve support
- SHA-256 and AES-128 support
- Secure Boot support
- Ephemeral key generation
- Random Number Generation (RNG) per FIPS 800-90 A/B/C
- Two high-endurance monotonic counters
- Guaranteed unique 72-bit serial number
The ATEC608A has three different versions, each pre-programmed with essential functions to support common security applications more easily. These three versions are:
- The ATECC608A Trust&GO version, optimized for TLS-based network secure authentication. The device comes pre-configured and pre-provisioned with default thumbprint certificates and a key. The configuration and credentials are locked in the machine and cannot be changed. The cloud infrastructure would not require verification of the thumbprint certificate by a certificate authority, significantly simplifying the implementation and deployment. Other vital features integrated into the ATECC608A-TNGTLS are the AES128 hardware accelerator, hardware-based cryptographic key storage, and cryptographic countermeasures, eliminating potential security attacks linked to software weaknesses. The ATECC608A Trust&Go device is compatible with the AWS IoT Multi-account registration architecture.
- The ATECC608A TrustFLEX version, optimized for TLS-based network secure authentication. The device comes pre-configured as a secure device with more use cases than just the device-to-cloud secure authentication Trust&GO offers. The cloud infrastructure, either a public or private network, can implement token-based authentication or customer certificate authentication (the traditional PKI model). It provides a pre-architected implementation for additional authentication, firmware validation, secure boot assistance, key rotation, and more. The ATECC608A TrustFlex device is compatible with AWS IoT, Microsoft Azure, Google Cloud Platform, and, in general, any Transport Layer Security (TLS) networks with code examples for WolfSSL, mBedTLS, and CycloneSSL.
- The ATECC608A TrustCUSTOM version, a secure element that is fully customizable for applications with security requirements that go beyond the Trust&GO and TrustFLEX use cases.
Microchip DM320118 Development Kit for ATECC608A Applications
To speed the development of ATECC608A-based applications, Microchip has created the DM320118 Development Kit. The kit hosts all three versions of the ATECC608A and an onboard MCU (ATSAMD21) for application development (Figure 2). The kit uses a USB port to download and debug the application code. The three ATECC608A devices share an I2C bus to control the trusted security zone features MCU.
Figure 2: The ATECC608A and Block Diagram (Source: Microchip)
A variety of software tools assist the developer in creating applications projects targeting the kit:
- The Microchip Trust Platform for CryptoAuthentication™ includes a variety of examples for famous use cases, configurators, and training material.
- The CryptoAuthLib makes working with Microchip’s CryptoAuthentication devices a straightforward process. CryptoAuthLib has been designed with a Hardware Abstraction Layer (HAL) to make it easily extensible to other microcontrollers. Both C and Python versions of the library are available.
- MPLAB® X IDE is an Integrated Development Environment (IDE) that works on Windows®, macOS®, and Linux® environments. The tools can develop new embedded applications using the onboard SAM D21 microcontroller. The tool will automatically use the onboard nEDBG debugger to program the SAM D21 microcontroller. The debugger can also be used to provide debug information back from the host microcontroller to a terminal window through a COM port.
- You can find out more about the DM320118 from the Mouser product page here:
Conclusion
Robust security for IoT applications must be built on a solid foundation with a trusted zone of security capabilities protected from hacking and software failures. The Microchip ATCC608A devices and the associated development platform can dramatically speed the development of IoT's most robust security implementations.