The minimum standard of quality for firmware devices has risen dramatically in the past years. When people spend even a modest amount of money on a device, they expect a certain level of functionality, reliability, and security. If someone buys a dog feeder with a camera on it, the expectation is that the live stream is visible to only them and not the rest of the world. Likewise, a medical implant shouldn’t allow just anyone to connect over BLE and modify its behavior. Although this level of security is common and implied, it never happens by accident, and it is rarely as robust in practice as it needs to be.
The embedded devices of the past may have been isolated from most of the world, but modern embedded firmware is often just as connected as our smartphones and computers. Internet connectivity has transitioned from being a novel feature to a bare minimum in some products. This can leave engineers overwhelmed: Not only are they debugging issues with interrupts and power supplies, they need to also be knowledgeable about HTTPS, PKI infrastructure, and the newest cryptographic vulnerabilities.
Luckily, there are many off-the-shelf solutions that significantly reduce the effort to implement this level of security. In this article, we will be looking at Microchip’s CryptoAuthentication™ Family of devices and how they can help any firmware project become more secure against even the most sophisticated attacks. This family of products provides integrated circuits as well as firmware, security infrastructure, and provisioning services.
There are many challenges to implementing robust security in firmware, and three of the most common categories will be covered in this article, showing how off-the-shelf solutions can take the implementation off of your plate. This gives you more bandwidth to tackle that pesky stack overflow that only happens every other Thursday.
Private Key Storage
One of the biggest challenges across all of security is key storage. Any device that connects to services over the Internet needs an identity, which usually takes the form of a private key and its corresponding certificate. Your cloud provider stores this list of approved identities and restricts access to only the devices you manufactured. This private key is very sensitive information and should ideally never be retrievable even through physical tampering. To possess the private key is to have all of the privileges of an authentic device.
But where can you store such sensitive data? Many modern processors ship with a secure flash peripheral that provides a region of persistent storage that is protected and only accessible by the processor itself and not externally. However, these solutions usually have limitations:
- The secrets still have to be passed around and handled on the device in plaintext
- The SoC only provides the storage; the firmware still needs to provide the complex cryptographic operations needed to sign and encrypt data with the given secrets
- Secure flash is usually empty by default and doesn’t come pre-provisioned with a trusted serial number for providing manufacturing attestation
- Secure flashes often have known vulnerabilities or are not designed to the same standards as dedicated hardware security modules
In addition, your product may be designed to use a processor that simply doesn’t provide secure flash to begin with, and changing parts may be out of the question, leaving you with no place to store that sensitive information.
To solve these issues, let’s take a look at the Microchip ATECC608C, a cryptographic co-processor with features like secure key storage, hardware-based crypto algorithms, and an I2C interface. The device also has a small physical footprint for flexible integration into any hardware design.
This part solves two of the biggest challenges that arise with private keys: storing them and using them. With regards to storage, the ATEC provides an incredibly high level of both software and hardware security (see the later compliance section). Once properly configured, the key never has to leave the part and will never come in contact with your firmware. Even the most careless engineer could not leak the secrets through irresponsible firmware design.
The second challenge of actually using the key is even more complex. The private key is almost never used as a standalone value; rather, it is used to generate CSRs or perform challenge-response authentication. Implementing these routines manually has several drawbacks. First of all, you need to perform the complex cryptographic operations in software, which can be more error-prone and inefficient when compared to hardware implementations. Second, the key has to exist in your processor’s RAM in plaintext, exposing it to sophisticated but still possible runtime attacks.
To mitigate this, the device provides implementations for common operations like TLS authentication that are performed directly on the hardware, so no plaintext values ever have to exist in your firmware domain. Microchip also provides software libraries that hook this functionality into common frameworks like wolfSSL, mbedTLS, and OpenSSL.
Provisioning Infrastructure
The next category has nothing to do with firmware at all, and it’s one of the most neglected aspects of device manufacturing. Even if your hardware design has Fort Knox-level security to protect your private key, the key still needs to get on the device during the manufacturing process. Further complicating this issue is the fact that the manufacturing process may take place overseas in a factory that you can’t completely trust or have constant physical access to. How do you get this incredibly sensitive information first into the factory and then into your device, all without any chance of being leaked or exposed? We’ll take a look at two possible options.
One approach is to kick the can down the road a little bit and ship devices to customers without any secrets at all. Then, during device setup, you can have a mobile application provision the device’s keys via BLE or some other wireless protocol. This allows you to ship the devices in a blank state, but it adds another complexity: you need a way to verify that your mobile app is connecting to an authentic device and not a man-in-the-middle. There are commonly-accepted solutions for this, but it is another wrinkle in the customer experience and an additional complexity in both the firmware and the cloud infrastructure. The advantage is that you completely control the provisioning process, and manufacturing can happen mostly isolated from your security architecture.
A second option is to use a provisioning service like Microchip’s Trust Platform. After finalizing your hardware design, you place an order with Microchip and arrange for the chips to be pre-provisioned. Microchip securely provisions the devices per your instructions and ships the parts directly to the contract manufacturer to be assembled on your PCBA. After provisioning, Microchip sends back a manifest of all of the public keys so you have a list to add to your cloud provider. There are even express options like Trust&GO that work out of the box with AWS IoT and Microsoft Azure. By outsourcing the provisioning, you gain access to a mature and proven process that takes the contract manufacturer out of the equation. However, that lack of control may be an issue for some teams who wish to have a closer connection with their security architecture.
In either case, it’s important to remember that manufacturing is one of the most important places to consider security. It is the place your product originates, and one of the most vulnerable periods of the product’s lifecycle. Unfortunately, it’s also one of the most neglected aspects of product development, even outside of the security conversation. Make sure that manufacturing is a first-class topic in your initial product development.
Compliance
Finally, a word on compliance. There are many industries that either require or strongly recommend a formal level of certification against an accepted standard. Common standards include those published by the National Institute of Standards and Technology (NIST/FIPS) and Joint Interpretation Library (JIL). When a device is submitted to one of these bodies for testing, they collect information like datasheets, technical documentation, and user guides. Then they try to exploit this information to attack and compromise the device. They also exercise the device against a rigorous set of functional tests. Based on the results of this entire effort, they assign a rating to the device.
When you purchase a device that has been certified under a standard like this, you are inheriting all of the engineering that went into making the device in the first place, which is a level of effort and financial commitment that most teams would never be able to provide. When a product is subject to some required certification standard, an off-the-shelf compliance solution can be a fast and cheap way to achieve that certification. Even when not required, it helps give stakeholders and ultimately customers a high-level of confidence that care has been taken in the security design. However, don’t think that you stick a certified part on your board and instantly be secure – even the most robust off-the-shelf solutions require care and knowledge to integrate properly.
Why Security Comes First
Regardless of how security problems are solved, it should be obvious that they need to be solved early in the design process. Robust security is not something that can be tacked onto a product in a few weeks prior to shipping to customers. The full infrastructure should ideally be fleshed out prior to both hardware and firmware design. Careful consideration needs to be given to how keys will be created, stored, and managed through the lifecycle of the product. Additionally, there should be mechanisms to revoke keys in the event sensitive information is compromised. There are many more topics to consider in the realm of embedded security, but hopefully you are now more aware of the off-the-shelf solutions available to you.
If your project requires IoT connectivity or robust security, Dojo Five offers the knowledge and experience to make your vision come to life. Our team of engineers has extensive experience with implementing strong security in a variety of industries. Connect with Dojo Five to discuss your project needs.
