Security Coprocessor Marks a New Approach to Provisioning for IoT Edge Devices

The advent of security coprocessor that offloads the provisioning task from the main MCU or MPU is bringing new possibilities for the Internet of Things (IoT) product developers to secure the edge device at lower cost and power points regardless of the scale.

Hardware engineers often like to say that there is now such thing as software security. And they quote Apple that has all the money in the world and an army of software developers. The maker of the iPhone chose a secure element (SE)-based hardware solution while cobbling the Apple Pay mobile commerce service. Apparently, with a hardware solution, engineers have the ecosystem fully in control.

Security is the basic building block of the IoT bandwagon, and there is a lot of talk about securing the access points. So far, the security stack has largely been integrated into the MCUs and MPUs serving the IoT products. However, tasks like encryption and authentication take a lot of battery power, a precious commodity in the IoT world.

Security coprocessor for provisioning: A new milestone in the IoT arena

Atmel’s solution: a coprocessor that offloads security tasks from main MCU or MPU. The Atmel ATECC508A security coprocessor uses elliptic curve cryptography (ECC) capabilities to create secure hardware-based key storage for IoT markets such as home automation, industrial networking and medical.

The ATECC508A crypto-authentication chip comes at a manageable cost—50 cents for low volumes—and consumers very low power. The chip makes provisioning—the process of generating a security key—a viable option for small and mid-sized IoT product developers.

A New Approach to Provisioning

It’s worth noting that security breaches rarely involve breaking the encryption code; hackers mostly use techniques like spoofing to steal the ID. So the focus of the Atmel ATECC508A crypto-engine is the tasks such as key generation and authentication. The chip uses ECC math to ensure sign-verify authentication and subsequently the verification of the key agreement.

The IoT security—which includes the exchange of certificates and other trusted objects—is implemented at the edge node in two steps: provisioning and commissioning. Provisioning is the process of loading a unique private key and other certificates to provide identity to a device while commissioning allows the pre-provisioned device to join a network. Moreover, provisioning is carried out during the manufacturing or testing of a device and commissioning is performed later by the network service provider and end-user.

What can happen to an unsecure node?

Presently, snooping threats are mostly countered through hardware security module (HSM), a mechanism to store, protect and manage keys, which requires a centralized database approach and entails significant upfront costs in infrastructure and logistics. On the other hand, the ATECC508A security coprocessor simplifies the deployment of secure IoT nodes through pre-provisioning with internally generated unique keys, associated certificates and certification-ready authentication.

It’s a new approach toward provisioning that not only prevents over-building, as done by the HSM-centric techniques, but also prevents cloning for the gray market. The key is controlled by a separate chip like the ATECC508A security coprocessor. So if there are 1,000 IoT systems to be built, there will be exactly 1,000 security coprocessors for them.

Certified-ID Security Platform

At the ARM TechCon held in Santa Clara, California on 10-12 November 2015, Atmel went one step ahead when it announced the availability of Certified-ID security platform for the IoT entry points like edge devices to acquire certified and trusted identities.

The Atmel Certified-ID platform leverages internal key generation capabilities of the ATECC508A security coprocessor to deliver distributed key provisioning for any device joining the IoT network. That way it enables a decentralized secure key generation and eliminates the upfront cost of building the provisioning infrastructure for IoT setups being deployed at smaller scales.

Toolkits allow system design houses to provision prototypes and first-run devices

Atmel, a pioneer in Trusted Platform Module (TPM)-based secure microcontrollers, is now working with cloud service providers like Proximetry and Exosite to turn its ATECC508A coprocessor-based Certified-ID platform into an IoT edge node-to-cloud turnkey security solution. TPM chips, which have roots in the computer industry, aren’t well-positioned to meet the cost demands of low-price IoT edge devices.

The San Jose, California–based microcontroller supplier has also announced the availability of two provisioning toolkits for low volume IoT systems at the ARM TechCon. The AT88CKECCROOT toolkit is a ‘master template’ that creates and manages certificate root of trust in any IoT ecosystem. On the other hand, AT88CKECCSIGNER is a production kit that allows designers and manufacturers to generate tamper-resistant keys and security certifications in their IoT applications.

Also read:

4 Reasons Why Atmel is Ready to Ride the IoT Wave

Atmel’s L21 MCU for IoT Tops Low Power Benchmark

6 Memory Considerations for IoT Designs Built Around Cortex-M7 MCUs

Majeed Ahmad is the author of the book The Next Web of 50 Billion Devices.