How to Crack the Security Crisis of Embedded Devices: Protecting Your Smart Vehicle and Industrial IoT Devices from Hackers

Recently, Infineon officially announced the acquisition of Cypress, and the news has been trending on social media.

On June 17, 2020, Infineon announced the launch of Semper Secure, further expanding its award-winning Semper NOR flash memory series, thanks to the storage technology and product line acquired from Cypress.

So, what are the features of this product? Official documents indicate that this product is the world’s most secure NOR flash memory, also offering ease of use and reliability. Why emphasize security? This is actually due to the increasing number of hacking incidents…

According to Gartner’s estimates, by 2023, there will be over 750,000 cars with autonomous driving features entering the market. As more and more cars become connected and equipped with autonomous driving capabilities, the possibility of malicious actors controlling cars on the road is gradually increasing, raising concerns.

Currently, Tesla, NIO, WM Motor, and XPeng have all equipped their vehicles with L2-L3 level autonomous driving systems, and autonomous driving is moving towards the L4 and L5 era. Additionally, HIS analysts predict that by 2035, there will be 21 million vehicles globally with L5 level autonomous driving. Uswitch reveals that among new cars registered in the UK, over 67% are smart vehicles, with this proportion expected to rise to 100% by 2026, and the market value reaching £52 billion ($57.1 billion) by 2035.

So, how many functions will vehicles have? Automatic parking, collision warnings, active braking, ACC adaptive cruise, VSA vehicle networking checks, ISA electronic police systems, TMC real-time traffic systems, 360-degree surround view, lane change assistance, LDWS lane departure warning systems, HMW distance detection and warnings, FCWS front collision warning systems, PED pedestrian detection, lane keeping systems…

Data shows that in 2010, the number of lines of code in cars was only 10 million, but by 2016 it had grown to about 150 million, an increase of 15 times. According to research, connected cars generate up to 25GB of personal data per hour, including data from drivers, vehicles, and passengers. This will only grow more rapidly as autonomous driving features become increasingly rich.

However, in 2015, hackers controlled an SUV through its infotainment system in a well-known incident. They first interfered with the vehicle’s audio and air conditioning systems, then forced the vehicle to stop in the busy traffic of the St. Louis highway. The hackers later proved they could go even further, including shutting down the engine and disabling the brakes.

Their entry point was the vehicle’s infotainment system connected to the internet, where hackers rewrote firmware and injected their code into adjacent chips. The reprogrammed chips could send commands to the rest of the car through the internal CAN bus vehicle network.

Figure 1: Hackers are watching your smart vehicle

Tesla, as a pioneer in autonomous driving, is often used by experienced hackers as a test subject. In 2016, Tencent Keen Security Lab remotely hacked a Tesla without physical contact, controlling the braking system, turn signals, seat positions, and door locks. This ultimately led to the ability to remotely unlock the car, open the windows when stationary, and remotely start the wipers, open the trunk, and brake while in motion.

In 2018, a Tesla Model 3 owner hacked his own car. After discovering a toolbox interface that allowed him to access relevant parameter information, he opened a new world, obtaining not only key parameters and performance information but also analyzing a series of key information.

In 2020, a group of hackers from McAfee Advanced Threat Research modified speed limit signs in an experiment, successfully tricking Tesla’s first-generation Autopilot system to accelerate from 35 mph to 85 mph. The consequences of this happening while driving are unimaginable.

With the rapid development of autonomous driving, safety issues cannot be overlooked. On one hand, the level of automation in autonomous driving is increasing, with more active intervention features posing direct threats to personal safety; on the other hand, singular safety measures cannot meet the needs of today’s systems, requiring a very complete closed-loop safety system to avoid harm.

Autonomous driving is widely concerned because it directly affects the safety of drivers and passengers. However, wherever there is code, there is the possibility of hacking. This includes cars, smart factories, hospital equipment, and portable medical products, all of which have numerous vulnerabilities that are susceptible to cyber attacks, including software updates, data downloads, and cloud connections.

According to Trend Micro’s Forward-Looking Threat Research Team, recent tests have confirmed how easy it is to control robots by modifying factory robot settings, damaging their components or harming personnel working nearby. Additionally, the research found thousands of industrial devices at risk of being hacked, residing on public IP addresses.

Attacks on smart factories not only affect production but can also endanger lives. Research conducted by Verizon indicates that 86% of attacks in the manufacturing sector are targeted, with nearly half involving intellectual property theft.

Figure 2: Wherever there is code, there is the possibility of hacking

Recently, a hospital discovered that commonly used anesthesia machines and ventilators had security vulnerabilities that hackers could exploit to adjust specific commands, including the gas composition within the machines. According to reports from the American tech blog Techcrunch, hackers could access these tools through hospital networks, modify machine protocols, and execute commands without authentication. These examples illustrate how easily interconnected devices can be attacked, highlighting the need to strengthen information security.

Recently, a large portable medical device manufacturer recalled a series of insulin pumps after discovering potential vulnerabilities that hackers could exploit to modify device settings via radio frequency signals. An increase or decrease in insulin dosage could pose life-threatening blood sugar level changes for patients using the device.

To legally prevent such hacking attacks, California passed the SB-327 bill in 2018. This bill, known as the “IoT Security Law,” is the first in the U.S. to require all interconnected devices sold to have some form of built-in security mechanism. Secure flash memory is one of the ways to help manufacturers meet this stringent requirement.

In addition to legal measures, many companies have also developed numerous security suites, including Arm, which has launched the PSA Certified™ IoT security device certification program, highlighting the market’s emphasis on security. Perhaps at the moment when devices are securely operating, hackers are always watching your device’s operating status parameters and performance, ready to breach it at any time!

According to Infineon’s response, flash memory devices are one of the primary targets for hackers because they store boot code, security keys, and other critical data necessary for the system’s normal operation.

Generally, the non-volatile memory devices used in smart IoT devices or autonomous driving devices, NAND Flash and NOR Flash, are the two most familiar products. Typically, NAND Flash is used in scenarios requiring large capacity, such as servers and cloud storage, while NOR Flash occupies the market for IoT embedded devices due to its reading and writing speed advantages.

From the memory market perspective, NOR Flash was initially a sideline, but with the rise of 5G, industrial IoT, and autonomous driving, its trajectory has gradually soared.

It is reported that in automotive ADAS, approximately 82% of automotive cameras rely on NOR Flash for booting, as NOR Flash’s reading and writing speed is faster, allowing for a better user experience without latency during startup. Moreover, embedded IoT devices typically require storage space of only a few megabytes to several hundred megabytes, making NOR Flash a better choice in terms of both size and latency.

Additionally, in high-reliability non-volatile memory technology, the industry has considered adopting options like RRAM and MRAM, but due to data integrity, cost, and process issues, they have not met the requirements for large-scale production. Although RRAM and MRAM have non-volatile storage functions in addition to volatile storage functions, in many cases, the significantly higher price per storage density is hard for automotive manufacturers to accept.

Although flash memory seems simple, the means to breach it are surprisingly diverse and difficult to defend against. Generally, there are several methods such as spoofing attacks, intrusions, replay communications, eavesdropping attacks, theft of security keys, side-channel attacks, and cloning.

Figure 3: Paths to Breach Flash Memory

Semper Secure flash memory is a product that uses NOR Flash, with three models available: 128 MB, 256 MB, and 512 MB, with a performance of 200 MHz DDR and a reading bandwidth of 400 MB/s under the xSPI standard; under the QSPI standard, the reading bandwidth is 102 MB/s, with 166 MHz SDR/102 MHz DDR.

It is important to note that Semper Secure has three key points:

1. Security: The main difference between Semper Secure and regular NOR Flash is the integration of an encryption module, which ensures the security and reliability of information from within. In many cases, many systems only have functional safety, which is often far from sufficient.

From an internal architecture perspective, it uses 45nm MirrorBit technology, divided into four main areas: security area, functional safety, reliability, and performance. Overall, Semper Secure uses a hardware-accelerated encryption engine to provide a hardware root of trust, enabling secure boot, secure storage, and secure remote upgrades.

By providing a secure area and adopting configurable access control, along with built-in protection against side-channel attacks, this technology also helps manage security authentication and encrypted storage communication. Additionally, it employs a flexible in-memory computation architecture combined with advanced encryption algorithms to adapt to ever-changing security needs, ensuring that products using this technology are not only secure now but can also meet future demands without the need for redesigning system hardware.

Figure 4: Semper Secure Schematic Diagram, showing multi-layer information security built into external NOR flash devices

In terms of security features, it has storage areas with access managers, secure boot with unique device secret identifiers (UDS), symmetric/asymmetric key configurations, key management, non-volatile anti-rollback counters, side-channel attack prevention (SCA), encryption engines and true random number generators (TRNG), communication encryption, diagnostics, secure boot (Safe Boot™), interface communication CRC and data CRC, error correction codes, EnduraFlex™, and serial memory controllers.

In terms of collaboration, Semper Secure flash memory provides hardware-protected secure storage for security keys, certificates, password hashes, application-specific data, configuration data, and biometric sensor data. Using standard bus protocols like QSPI and xSPI, it can work in conjunction with the main controller to achieve the required security levels for high-demand interconnected applications while being fully compatible with existing main controller memory controllers. Semper Secure flash memory ensures secure system boot, records key information, and extends working memory for essential functions.

Figure 5: External NOR flash and main processor working together to achieve high-level security for high-demand applications

Since various security features are already built-in, there is no need to configure additional security modules when selecting NOR Flash, which also provides a strong cost advantage.

2. Automotive-grade: The product’s operating temperature ranges from -40ºC to +125ºC and has passed AEC-Q100 automotive-grade certification (supporting PPAP). It is well known that automotive working environments are generally harsh, with high temperature requirements. In addition to environmental temperature, automotive-grade devices also require vibration, impact, reliability, lifecycle, and manufacturing processes.

3. Speed: Automotive applications must respond to CAN messages within 100ms after power-up, or it may endanger the driver’s safety. Secure flash completes the main MCU authentication and starts code execution within 10ms, ensuring secure boot.

Previous articles have also discussed the advantages of NOR Flash in reading speed. Notably, this product supports the JEDEC eXpanded SPI (xSPI) standard for x8 serial NOR flash, and supports reading bandwidth of up to 400 MBps. Therefore, it has an absolute advantage in speed.

Especially in terms of security, this product remains the main focus. Jim Handy, president of Objective Analysis, stated: “When flash memory is placed outside the main processor, ensuring the security of embedded systems becomes particularly important. Infineon’s secure flash solution, designed for situations where flash cannot be embedded in the MCU, is a highly competitive architecture. It offers better versatility for design engineers to choose from.”

Sam Geha, head of storage solutions at Infineon, stated: “For customers who prioritize information protection and system integrity, secure interconnected systems have become a top priority. As more interconnected systems use external flash to protect code and data, storage devices need to further enhance encryption security. Our newly launched Semper Secure NOR flash architecture adds an information security subsystem on top of the highly functional safety Semper product series, achieving end-to-end continuous protection and effectively ensuring that systems remain intact.”

Nowadays, many manufacturers are transitioning from hardware to software to ensure an ultimate development experience for developers. Of course, this product still has many convenient and quick kits and models for users to design efficiently.

From the Semper solution development kit (S-SDK), it uses C models and the wolfSSL security library, making it almost barrier-free for beginners, as C language is almost a necessity for embedded engineers. During the operation process, the S-SDK includes beginner kits, memory modules, and encryption algorithm verification modules to simplify evaluation operations and ensure compatibility.

Figure 6: Semper SDK brings great efficiency to developers

In addition to sample code, flash memory models, and evaluation kits simplifying the learning process, Semper also provides main control drivers that can be used for mass production and comply with MISRA-C standards, further enhancing development efficiency.

It is reported that Infineon’s 256 Mb Semper Secure NOR flash devices have already been provided to some customers as samples, with mass production expected in the second quarter of 2021.