IoT Security: Hardware Root of Trust

PB 25 Rockwell newlogo 400

November 21, 2022

By  Rob Lodesky, Key Account Manager, HMS Networks

IoT has steadily gained popularity in recent years with more users migrating to digitalized products and smart gadgets. As an increasing amount of IoT equipment comes online, many unsecured items will be vulnerable to remote software assaults. Inadequate security gives hackers the opportunity to brick and commandeer a device to help build botnets. These malware networks introduce unauthorized code, steal data, or exploit their hosts through some other means. Because device manufacturers want to safeguard their reputations, their IoT devices must be secure. With more laws, regulations, and standards being created in this vein, security cannot be imposed as an afterthought. This is where Hardware Root of Trust comes into play.

What is Hardware Root of Trust?

Root of trust establishes the secure process boot up chain, called Chain of Trust, used to validate software and hardware used on the device. If the credentials used to implement the initial piece of code are verified, each successive piece of code executed is trusted. A strong root of trust consists of identity and cryptographic keys rooted in the hardware of a device. This establishes a unique, immutable, and unclonable identity to authorize a device in a network. It enables a secure boot process using keys for cryptographic operations, ensuring the authenticity of firmware and software until the OS (Operating System) is loaded.

How is Hardware Root of Trust Implemented?

Hardware root of trust can help with a range of security issues that are primarily divided into pre-boot and post-boot. Pre-boot can use a computer chip called a Trusted Platform Module (TPM) to verify/measure integrity and secure the boot process from low-level malware. TPM assists with various activities during post-boot, including root of trust for authentication. Systems that deploy hardware root of trust will use unified extensible firmware interface (UEFI), which offers options such as “Secure Boot” that help prevent attacks or infection from malware.

How does the Root of Trust process start inside a processor?

There are essentially two methods: the battery backed storage of secret keys and Physical Unclonable function (PUF). PUF is widely held as the industry standard for FPGAs and ASIC processors. PUF starts with a physical microstructure. These microstructures can be random imprints of some substance, such as foam, plastic, or even silicon. The processor then uses challenge response authentication to measure this random structure. (Most people know challenge response authentication as username/password – ask for a username, type a username.) These random measurements work in the same way: the processor measures something withing the microstructure, and the microstructure is measured and validated. The problem with cloning, or making the process unclonable, is ensuring the manufacturing process could not replicate the microstructure.

What are some of the other phases of Hardware Root of Trust?

Typically, solutions start with an Immutable Boot Loader (sometimes using a PUF), which then starts the BIOS (Basic input/output System) or UEFI validation process. The Phase 1 process uses RSA or ECC private key encryption, sometimes using a TPM to build the keys necessary for the RSA and ECC cipher suites. If an OS is used, the loader is validated using the same private key encryption, then finally the OS, and application (if used).

What other hardware might be necessary for Hardware root of Trust?

If startup speed is a factor in your design, SSL accelerators can offload some of the algorithmic horsepower typically done by the main processor. There are now chipsets built for this specific purpose. Entropy generating hardware can be used to achieve proper random Key generation, although a PUF can also be used, to some degree.



Related Articles

Network Infrastructure Featured Product Spotlight

PBUS 14 Panduit logo 400

This webinar presented by Beth Lessard and Keith Cordero will be highlighting three Panduit solutions that will optimize network equipment and cabling to ensure that your spaces are efficiently and properly managed to support ever-evolving business needs of today and beyond. Products that will be featured include PanZone TrueEdge Wall Mount Enclsoure, Cable Managers, and Adjustable Depth 4-Post Rack.


Editor’s Pick: Featured Product News

Siemens: SIMOVAC Non-Arc-Resistant and SIMOVAC-AR Arc-Resistant Motor Controllers

The Siemens SIMOVAC medium-voltage non-arc-resistant and SIMOVAC-AR arc-resistant controllers have a modular design incorporating up to two 12SVC400 (400 A) controllers, housed in a freestanding sheet steel enclosure. Each controller is UL 347 class E2, equipped with three current-limiting fuses, a non-load-break isolating switch, and a fixed-mounted vacuum contactor (plug-in type optional for 12SVC400). The enclosure is designed for front access, allowing the equipment to be located with the rear of the equipment close to a non-combustible wall.

Read More

Sponsored Content
Electrify Your Enterprise

Power is vital to production, and well-designed control cabinets are key. Allied Electronics & Automation offers a comprehensive collection of control cabinet solutions including PLCs, HMIs, contactors, miniature circuit breakers, terminal block connectors, DIN-rail power supplies, pushbutton switches, motor starters, overloads, power relays, industrial Ethernet switches and AC drives engineered to keep your operations running safely, reliably and efficiently.

Learn more HERE.

Products for Panel Builders

  • AutomationDirect: Productivity1000 and Productivity2000 Relay & TTL Modules

    AutomationDirect: Productivity1000 and Productivity2000 Relay & TTL Modules

    AutomationDirect has added new discrete and relay I/O expansion modules to the Productivity PLC family. For the Productivity1000 PLC series, a 4-channel, high current relay output module is now available. This module provides up to 7A/point for both DC and AC control circuits and features four Form C (normally open/normally closed) contacts. For the Productivity2000… Read More…

  • AutomationDirect: LS Electric XGB PLC Remote I/O Modules

    AutomationDirect: LS Electric XGB PLC Remote I/O Modules

    AutomationDirect has added several new additions to the powerful LS Electric XGB PLC series. For discrete (ON/OFF) monitoring and control, a new lower-cost 24 VDC 8-point input module, 8-point 12-24 VDC sinking and sourcing output modules, an 8-point relay module with Form A contacts, and a 16-point combination discrete input/relay output module are now available.… Read More…