The Internet of Things (IoT) is indeed a buzzword today, but most engineers have long recognized that adding connectivity to any electronic device can bring numerous significant advantages. Thus, IoT is a very broad term that encompasses various applications, including everything from CCTV to IP-connected security cameras, as well as connected sensors in factories and wearable trackers, and even remotely controlled home heating systems.
One challenge faced by developers of all internet-connected devices is security. Mobile payment is a clear example: banks obviously want to avoid fraudulent transactions through mobile payments. However, IoT security threats are diverse and have far-reaching implications.
Why is security so crucial for IoT? The unprecedented amount of available data and the interconnectedness of all IoT systems, along with their potential threats, greatly heighten risk awareness. One factor that should not be overlooked is that some engineers previously developed systems that were not connected to the internet, and now they must develop connected products. We believe that banks have robust expertise to ensure the security of financial transactions, but how can we trust an engineer who has only developed USB webcams to ensure the security of IP-connected cameras?
Fortunately, if engineers take some time to follow a few basic guidelines, they will find that suppliers, including semiconductor companies and distributors, are currently offering relevant technologies and support to help develop more secure IoT products.
Risks and Threats
At a recent conference held in Chicago, Roman Budek from NXP stated that IoT designers need to consider and address six major security vulnerabilities. Regarding cloud data and system control, it is essential to consider remote attacks targeting cloud service providers, rather than simply assuming that a major service provider can resolve this threat.
The nature of the IoT means that devices are often accessible, and physical attacks on peripheral systems (such as controlling access using side-channel attacks) pose risks to many systems. Similarly, a vulnerable, counterfeit, or compromised device can undermine the security of internal networks. Many IoT vendors believe that interoperability with products from other companies is critical to commercial success, making this issue even more challenging.
Gateways or IP edge nodes provide opportunities for remote attacks. For example, in smart homes, gateways are often low-cost routers provided by the customer’s ISP, which have limited functionality and may even have unpatched vulnerabilities.
Smartphones, tablets, and smartwatches also pose security risks, as users may download rogue software that grants such software network access. Similarly, PIN phishing software can allow devices with applications to gain access to IoT systems. Ultimately, as IoT continues to mature and various devices are upgraded, obsolete devices may be implanted with Trojans, posing threats to other network devices.
Clearly, when designing IoT devices, engineers need to have a comprehensive understanding of the entire system, rather than merely focusing on the design of the product.
Ensuring the Security of Embedded Devices
When developing embedded IoT devices, engineers must ensure the following three points:
Data Integrity: Ensure that data is not exposed, only authorized personnel can access it, and ensure that data cannot be tampered with, leading to deliberate attacks or accidental errors.
Code Integrity: Protecting the code is also crucial. Code modifications must be detectable, and only authorized personnel should be able to modify the code. Additionally, many companies are concerned about intellectual property protection, which requires measures to prevent code theft.
Device Integrity: Ensure that connected devices are reliable and that their critical functions cannot be tampered with. Therefore, IoT devices require strong encryption key authentication and protection to prevent hacking and product counterfeiting.
To achieve these goals, security experts often mention six principles of embedded IoT security to strengthen support for developers: identity/authentication, authorization, auditing, confidentiality, integrity, and availability, many of which are fundamentally based on cryptography.
Providing Device Support for IoT Security
This is undoubtedly good news for IoT product developers, as many devices now support more convenient construction of security. For example, the NXP iMX 7Solo application processor, used in collaboration with element14 on the NXP WaRP7 IoT and wearable development platform, includes many built-in security features.
Figure 1: iMX 7 Solo Application Processor Diagram
One of the most obvious features is support for encryption, and the processor also supports hardware-accelerated encryption using CAAM (Cryptographic Acceleration and Assurance Module). This module also includes encryption and hashing engines that support various encryption standards.
There are two basic types of encryption algorithms: symmetric and asymmetric, and choosing the right algorithm is crucial for IoT system design. Symmetric algorithms use the same key for both encryption and decryption of data and have lower processing overhead.
Asymmetric encryption uses a “one-way” approach, with a pair of keys. The private key is kept secret and not distributed, while the public key is shared openly. If public key encryption is used, the private key must be used for decryption, and vice versa. This method makes the system easier to manage and more scalable.
A random number generator (RNG) is one of the requirements for encryption algorithms. This can be used to generate keys, and the keys must be generated randomly to prevent hackers from predicting the key and breaking the password.
IoT devices can be developed by providing on-chip hardware support. This not only ensures a higher level of security with robust encryption capabilities but also does not excessively impact the processor’s ability to run applications.
The processors used on the WaRP7 board also employ simple SPA or Differential Power Analysis (DPA) to prevent key prediction.
IoT security can also be enhanced through other features, such as those used in the processors on the WaRP7 and other processors.
Figure 2: ARM TrustZone
Complexity of Processing
This article only provides an example of certain features of an IoT board that can enhance security. The challenges engineers face are the various complexities described in this article. Clearly, engineers need support to ensure they have time to learn these features.
First, choosing the right development platform is crucial. Many resources (such as the design center of the element14 community) can provide detailed information about processor development platforms, software tools, and middleware. Application engineers and distributors like element14 play an important role in ensuring the correct components are produced while also shortening the learning curve for selecting appropriate tools and information.
The current state of high integration means that development platforms often consist of only a few components, which is almost ideal hardware for production. Element14 collaborates with many companies to create existing development boards like Raspberry Pi according to customer requirements to meet specific needs; or develop hardware based on specific requirements, allowing more engineering resources to be applied to the more complex and differentiated code.
Security Issues as One of the Biggest Challenges in IoT
Today, almost all electronic devices can benefit from network connectivity, whether for remote control, monitoring, or simple recording or data analysis. However, network connectivity can introduce many potential risks, which must be addressed with proper device and system-level security tools. With semiconductor and software vendors providing security support ranging from encryption to physical security, there is no longer any excuse for IoT product developers to avoid product security. However, the challenge engineers face is overcoming the inevitable complexities brought about by added functionalities. Therefore, they can seek help from suppliers like element14 to tackle these challenges.
1. The pros and cons of embedding an operating system in microcontrollers
2.Disassembling a DJI Drone, a core component that shocks 99% of engineers!
3.Linux tips from a ten-year veteran!
4.Today’s headlines Zhang Yiming: I have interviewed 2000 young people, and those who do well all have these 5 traits!
5.How I self-taught software testing?
6.6.1, recalling the “childhood” story of a technical CEO from a monthly salary of 300 yuan to a net worth of tens of millions!
Disclaimer: This article is a network reprint, and the copyright belongs to the original author. If there are copyright issues, please contact us, and we will confirm the copyright based on the copyright certificate you provide and pay remuneration or delete the content accordingly.