Vital end-to-end encryption for embedded IoT applications uses Amazon

By Nick Flaherty www.flaherty.co.uk

Securing the Internet of Things is a key challenge that is vexing many designers.Developing a secure end-to-end solution all the way to the cloud can be extremely challenging with lots of different hardware and software involved. Often the IoT node developers leave this for the gateway, leaving the end points vulnerable.

This is why the Embedded Blog has focussed not only on the hardware and software of the embedded node, but the links up to, and through, the cloud such as crypto accelerator cards - Kalray Launches Krypto128 Accelerator Card. So Microchip's launch of an end-to-end security IoT module that connects directly to Amazon Web Services IoT (AWS IoT) is highly significant.

• Microchip adds independent peripherals to PIC

Microchip used its acquisition of Atmel to work with AWS to use the AWS mutual authentication IoT security model. This should help companies to implement these security best practices from evaluation through to production. The solution adds a high level of security, simplifies the supply chain, and is now one of the fastest ways to connect to the AWS Cloud. 

Currently, third-party manufacturers of devices that connect to AWS IoT service must take specific actions to comply with the advanced security model. First, they must pre-register their security authority to AWS servers in order to establish a trust model. Second, for each IoT device they must generate unique cryptographic keys that are mathematically linked to the pre-registered security authority. Finally, the unique device keys must remain secret for the life of the device. In volume production, the generation and secure handling of these unique keys can be a daunting challenge in the chain of manufacturing especially where third-parties with different trust and compliance levels are involved.

• A lot of IoT data is going to waste, says survey

All of this is a bit of a nightmare, to say the least, and one key reason why IoT security has been such a big issue.

Instead, the AT88CKECC development kit will allow customers to meet the security standard of AWS’ mutual authentication model and easily connect to the AWS IoT platform during the evaluation and engineering phase. Then the AWS-ECC508 device assists with meeting security standards during the prototyping and pre-production phase. Finally, devices will be customised for production stages to ensure information security in customer applications.

Customers simply solder the device on the board and connect it over I2C to the host microcontroller which runs an AWS Software Development Kit (SDK). Once this is complete, there is no need to load unique keys and certificates required for authentication during the manufacturing of the device as the AWS-ECC508 is pre-configured to be recognised by AWS without any intervention. All the information is contained in a small (3x2 mm), easy to deploy, crypto companion device.

• Say hello to the new I3C interface

The ECC508 device has strong resistance against environmental and physical tampering including countermeasures against expert intrusion attempts. In addition, the device features a high quality random number generator, the internal generation of secure unique keys and the ability to seamlessly accommodate various production flows in the most cost-effective manner. A typical IoT device consists of a small 8-bit microcontroller, and is battery powered. It is typically constrained for resources such as central processing unit (CPU) performance to provide low latency responsiveness, memory and code space for security protocols and for how much power they consume in order to preserve battery life. The ECC508 device has a low-power processor-agnostic cryptographic acceleration for compatibility with the widest range of resource-constrained IoT devices.

The AWS-ECC508 kit (AT88CKECC-AWS-XSTK, above) is available today priced at $249 each. The AWS-ECC508 (ATECC508A-MAHAW-S and ATECC508A-SSHAW-T) is available in UDFN and SOIC packages and is available today for sampling and volume production.

See www.atmel.com/tools/at88ckecc-aws-xstk.aspx for more information

• IoT to hit 27bn devices by 2025
• 2.5bn wireless IoT sensors to ship by 2021
• Kalray Launches Krypto128 Accelerator Card

ST chip boosts IoT security in any design

By Nick Flaherty www.flaherty.co.uk

To help tackle the challenge of securing the Internet of Things (IoT), ST has launched a separate security chip that can connect to any microcontroller via an I2C link.

The STSAFE-A100 can be designed-in by developers to provide security to Common Criteria EAL5+ without specialist security expertise through a comprehensive support ecosystem.

The STSAFE-A100 provides strong authentication services (see figures below) that help make sure only authorized IoT devices can access online services and only authorized accessories or consumables are recognized and accepted by an application. Interestingly, it is also compliant with the USB Type-C device-authentication scheme and secures communications with a remote host using Transport Layer Security (TLS) handshaking.

The chip uses a custom secure microcontroller (ST hasn't said which type of controller - the company uses the ARM SecureCore in other devices such as the ST19 and ST33 families) with its own embedded operating system that is certified to EAL5+, base don the company's experience in chips for highly secure banking and mobile phone billing systems.

Additional functions in the chip that further minimize any potential for security breaches include signature verification to ease secure boot and firmware upgrade, secure counters that allow usage monitoring, secure pairing with the host application processor, wrapping and unwrapping of local or remote host envelopes, and on-chip key-pair generation.

The STSAFE-A100 supports asymmetric cryptography including Elliptic Curve Cryptography (ECC) with NIST or Brainpool 256-bit and 384-bit curves, and symmetric cryptography using AES-128/AES-256. The STSAFE-A100 comes with a unique serial number on each die and its operating system comprises a kernel for authentication and data management and provides strong protection against logical, fault, side-channel and physical attacks.

“STSAFE-A100 delivers an economical and certified solution for state-of-the-art security in IoT and brand protection, presenting an alternative with clear advantages over existing approaches like software-based security running on a general-purpose microcontroller or an uncertified crypto-companion IC,” said Laurent Degauque, Marketing Director, Secure Microcontroller Division, MDG Group, STMicroelectronics. “Seamless integration puts security at the heart of the product and frees developers to focus on maximizing added value at the application level.”

ST has made design-in of its new secure element easy for customers by providing a complete ecosystem that includes an expansion board with Arduino headers, a microcontroller library, and reference implementations. These simplify attaching the STSAFE-A100 to a microcontroller such as any from the STM32 family.

The STSAFE-A100 secure element is scheduled to enter volume production in July 2016, as a 4mm x 5mm SO8N or 2mm x 3mm UFDFPN8.

Atmel moves IoT security into hardware

By Nick Flaherty www.flaherty.co.uk

Platform enables hardware crypto acceleration in IoT 

• Supports OpenSSL and wolfSSL TLS implementations for hardware key protection and Secure Execution Environments
• Accelerates core cryptographic processes with Co-Processor in  IoT Edge Nodes Applications
• Pre-loaded with Unique Keys and Certificates to Reduce Complexities in Manufacturer Supply Chains

Atmel, currently being acquired by MIcrochip, has launched the industry’s first hardware interface library for TLS stacks used in Internet of Things (IoT) edge node applications. 

Hardening is a method used for reducing security risks to a system by applying additional hardware security layers and eliminating vulnerable software. Atmel’s new Hardware-TLS (HW-TLS) platform provides an API that allows TLS packages to use hardware key storage and cryptographic acceleration even in small, resource constrained edge node designs. HW-TLS is pre-loaded with unique keys and certificates designed to reduce the complexities of generating secure keys in the manufacturing supply chain.

TLS protocol stack (Photo credit: Wikipedia)

OpenSSL is a general-purpose cryptography library that provides an open-source implementation of the Secure Sockets Layer (SSL) and TLS protocols. wolfSSL is a cryptography library that provides lightweight, portable security solutions with a focus on speed and size. The ATECC508A-OpenSSL and ATECC508A-wolfSSL libraries are available for immediate download at their respective software distribution repositories to provide more secure elements without disruption to the developer workflow.  

Secure hardening for both OpenSSL and wolfSSL is made possible with HW-TLS which allows those TLS software packages to interface seamlessly with Atmel's ATECC508A CryptoAuthentication co-processor. The ATECC508A provides protected key storage as well as hardware acceleration of Elliptic Curve Cryptography (ECC) cipher suites including mutual authentication (ECDSA) and Diffie-Hellman key agreement (ECDH). As such, HW-TLS allows developers to substantially harden Transport Layer Security (TLS), enhancing security for IoT-device and cloud-service ecosystems.

When used together, HW-TLS and the ATECC508A allow small, low-cost IoT nodes to implement strong cryptographic security. All private keys, certificates and other sensitive security data used for authentication are stored in secure hardware and protected against software, hardware and back-door attacks. In addition, the integrated ECC accelerators in the ATECC508A offload cryptographic code and math from the MCU allowing even a low end processor to perform strong authentication.

“Everyone with an interest in IoT security should be excited about Atmel HW-TLS with wolfSSL,” said Larry Stefonic, CEO, wolfSSL. “The combination of our secure software and Atmel’s new chips brings TLS performance and security to a level unrivaled in the industry. Atmel’s HW-TLS platform also makes it easier than ever for developers to incorporate truly hardened security into our TLS stack.”

With the rise of the IoT, security has become a pressing topic because autonomous remote devices are now routinely connecting to wireless networks to form complex smart-device and cloud-service ecosystems. As a result, autonomous smart IoT devices constitute a significant part of those networks and must be able to authenticate themselves to the network resources to maintain the integrity of the ecosystem. In addition, these remote, resource-constrained clients must be able to perform this authentication using minimal processing, memory and power.

Traditionally, TLS performed authentication and stored private keys in software. The Atmel Hardware-TLS platform closes the vulnerability gap in this arrangement by offloading the crucial key management responsibility to dedicated, tamper-resistant secure elements such as the ATECCC508A CryptoAuthentication device. In addition, the intensive crypto algorithms are processed in the CryptoAuthentication device, offloading the MCU on the remote devices and enabling the IoT edge node to authenticate to the cloud without a user-perceptible delay.Furthermore, Atmel Hardware-TLS comes as a complete platform pre-loaded with unique keys and certificates for eliminating the complexities of adding secure keys to each device in a manufacturing supply chain.

“With more and more remote devices being connected to the cloud every day in the era of the IoT, it becomes increasingly critical to ensure these devices are not vulnerable to attack,” said Nicolas Schieli, Sr. Director, Secure Products Group, Atmel. “Such devices can be entirely secure only when they are hardware secure, meaning the ‘secret’ keys are stored in a separate hardware unit. We are excited to bring this innovation to market, enabling device manufacturers that need to connect to the cloud to take advantage of hardware security.”

The Atmel Hardware-TLS platform complements Atmel Certified-ID, a seamless and secure keys provisioning platform for creating trusted Internet identities for smart connected devices.

Availability

Atmel Hardware-TLS: http://www.atmel.com/tools/Atmel-HW-TLS.aspx  

OpenSSL: https://wiki.openssl.org/index.php/Binaries

wolfSSL: https://wolfssl.com/wolfSSL/Home.html

Related articles

• Critical OpenSSL Flaw Allows Hackers to Decrypt HTTPS Traffic
• `Does Vulnerability Testing Expose All Attack Vectors ?
• OpenSSL Security Updates