ADVERTISEMENT FEATURE COVER STORY
IS YOUR IOT SECURITY AT RISK?
Companies and organisations are building their vital infrastructure around the data and insight received from millions of connected devices. But , Andrew Frame, director of business development at Arm asks, are we doing enough to protect these devices?
T
his year, more Internet of Things (IoT) devices will ship than ever
before. This increased connectivity will transform our homes, businesses and entire cities but as companies race to seize the opportunities the IoT brings they may, inadvertently, be putting us all at risk. In our fast-paced and cost- sensitive environment, security is not always a priority and poorly designed products are open to attack. To minimise the risk of exploitation Arm has introduced its Platform Security Architecture (PSA). It is a framework that brings together industry best practice and enables designers, developers and manufacturers to build more secure devices.
SECURE BY DESIGN The Arm PSA simplifies and standardises IoT security. It makes it quicker, easier and more affordable to design the right level of protection into a connected device. There are three key components and each is underpinned by a set of technical resources that make security straightforward, even if you do not have access to dedicated expertise. 1. Analyse
Assess potential risks and identify the right level of security for different IoT devices and use cases 2. Architect Hardware and firmware architecture specifications that cover the core set of security principles, as identified in the security analyses 3. Implement Security technologies and silicon IP to help designers build more secure devices Since its introduction just over a year
ago, PSA has gained momentum. It is now widely recognised and many of Arm’s partners are working with the framework. Key developments include:
12 DECEMBER/JANUARY 2019 | ELECTRONICS
THREAT MODELS AND SECURITY ANALYSES The first stage of PSA involves analysing the operating environment and understanding and documenting the ways a device could be attacked. It is a process known as threat modelling and security analysis (TMSA) and it helps to determine how robust security measures need to be. TMSA has been used in the mobile
industry for some time. In that setting, the output is usually referred to as an English Language Protection Profile. However, it will be new to many IoT designers. Arm has released example threat models for three common IoT devices: a smart water meter, a network camera and an asset tracker. The freely available documents guide designers through the entire TMSA process and can be applied to any device.
HARDWARE AND FIRMWARE ARCHITECT SPECIFICATIONS Four important documents now bringing PSA to life: The PSA Security Model: outlines important details for deploying secure services, starting with 10 key goals for designing devices with known security properties
Technical requirements for firmware boot and update
Trusted Base System Architecture for M (TBSA-M): detailed hardware requirements for Arm based systems
PSA Firmware Framework: a standard programming environment and fundamental Root of Trust (RoT) security services Arm is also making secure software
development simpler, quicker and less costly with Trusted Firmware-M. It is a completely open-source reference implementation firmware that meets the PSA specifications.
Trusted Firmware-M has been created for the latest Armv8-M based microcontrollers, but also includes recommendations for processors based on earlier versions of the Arm architecture. For a consistent developer experience, new PSA Application Program Interfaces (APIs) and API compliance test kits have now been created for different developer communities. PSA Developer APIs for Real Time Operating System vendors and software developers
PSA Firmware Framework APIs for security experts implementing custom security functions
TBSA-M test kits designed for chip designers (which checks the hardware
implementation against the PSA TBSA-M specification) The Developer and Firmware
Framework APIs, corresponding API testing kits and the PSA architecture documents that underpin them are architecture agnostic. PSA is about fundamentals that can be applied to any architecture, not just Arm’s.
SECURING THE NEXT ONE TRILLION CONNECTED DEVICES Over the past 12 months Arm has worked closely with its partners to create a common security framework for the IoT ecosystem. Leading cloud, hardware and silicon providers have endorsed or supported the PSA and the principles it is based on. As Arm’s Director, Secure Device Ecosystem, David Maidment, explains: “The Arm PSA is an industry-wide attempt to put an end to uncertainty and fragmentation. IoT is a huge opportunity and we need to make sure we’re taking the necessary measures to secure every device to avoid or minimise future attacks.”
Arm
www.arm.com/psa-resources e:
psaenquiries@arm.com
/ ELECTRONICS
Page 1 |
Page 2 |
Page 3 |
Page 4 |
Page 5 |
Page 6 |
Page 7 |
Page 8 |
Page 9 |
Page 10 |
Page 11 |
Page 12 |
Page 13 |
Page 14 |
Page 15 |
Page 16 |
Page 17 |
Page 18 |
Page 19 |
Page 20 |
Page 21 |
Page 22 |
Page 23 |
Page 24 |
Page 25 |
Page 26 |
Page 27 |
Page 28 |
Page 29 |
Page 30 |
Page 31 |
Page 32 |
Page 33 |
Page 34 |
Page 35 |
Page 36 |
Page 37 |
Page 38 |
Page 39 |
Page 40 |
Page 41 |
Page 42 |
Page 43 |
Page 44 |
Page 45 |
Page 46 |
Page 47 |
Page 48 |
Page 49 |
Page 50 |
Page 51 |
Page 52
