Three trends in embedded systems security

By Haydn Povey, CEO of Secure Thingz

There are many trends in embedded systems security right now, with the most powerful three being compliance or assurance, cloud connectivity, and securing the supply chain.

Firstly, after many years of debate, governments around the world are starting to implement cyber security regulations. This is primarily being focused right now on markets where customers are not as technically adept, and specifically in consumer electronics, where the European ETSI EN 303 645 has become the leading global standard. This itself is based of work done by the IoT Security Foundation, which was adopted into UK regulation a couple of years ago.

The EN 303 645 has been picked up around the world and forms the basis of the NISTIR 8259 guidance published in response to the US’s Cyber Security Improvement Act of 2020. There are many other regulations out there, such as the ISA 62443 guidance for Industrial IoT, but they all have a common theme around the need to implement security best practice. There are thirteen best practices outlined in the European regulation, with four core, or central demands:

• enforcing formal cryptographic identity and authentication publishing vulnerabilities
• ensuring updates and patching for an agreed period
• protecting keys and other private information inside the device with protection of provisioned data

Compliance and security assurance to evolving legislation is critical to every developer, across medical, industrial, transportation and consumer markets. To support this work, we have invested in the development of the Compliance Suite products, supporting key learning and implementation to achieve assurance with standards.

Compliance Suite leverages the 13 Best Practice assurance guidance from the IoT Security Foundation. Here we can link the very granular requirements of the assurance spreadsheet and connect this back to the practical steps required in development. For example, the need to secure private data, and provisioned information, as securely as possible, can be linked back to the utilization of Protection of Provisioned Data. Similarly, authentication practices can be linked back to the root of trust instantiation and secure boot manager, etc.

Secondly, another major trend is the accelerating transition from embedded system through to edge computing, where most devices are connected. Whilst this is not true for every system, the reality is more and more devices are moving to cloud connectivity, with 5G rapidly driving down latency issues. Obviously, the large cloud solutions providers are very able to manage their services, but their biggest issue is how to successfully onboard millions of devices at scale. If every device took 5 minutes to onboard it would still take over 8 hours to onboard 100 devices. This is unsustainable and unscalable in practice.

The solution to this is to ensure all edge compute devices are provisioned at production time, ensuring every device has its own unique cryptographic certificate, but introducing the root certificate, or intermediate, into the cloud solution. This approach is scalable to literally millions of devices and is now available as part of the development tools platforms, such as Embedded Trust. Read our latest announcements around this “Secure Thingz accelerates mass production and provisioning of secure IoT devices” and “IAR Systems and Secure Thingz announce secure development and volume production platform to accelerate Microsoft Azure IoT migration”.

Thirdly, a trend I mentioned earlier is creating a secure supply chain. Whilst many organizations are worried about malware injection, and this is indeed an issue, the biggest business risk today is IP theft and counterfeit devices entering the supply chain. The OECD maintain that counterfeit goods account for $500B of trade annually, with electronics and electrical systems representing a substantial proportion.

In order to protect IP and inhibit counterfeit goods it is critical that every device is born securely, with code protected all the way into the device, avoiding both theft and manipulation. This then requires tools which inherently enable the OEM to constrain and control code from the point of development through to production in the far corners of the world.

The ability to secure the supply chain, manage IP, and protect keys is critical in every connected system. To support this, we have been working very closely with major silicon MCU vendors to support a range of new features, including enhanced device authentication, leveraging secure enclaves, and supporting the physical unclonable functions being integrated into many devices.