Presto Engineering – Outsourced Secure Provisioning – Even Their Secrets Have Secrets

When I first heard about Presto Engineering I was enamored by a statement on their web site that claimed that one of their secured solutions included, “The ability to incorporate your secrets without knowing them”. If Mr. Spock would have been in the room his eyebrow would have certainly raised. Indeed, what does that statement mean?

It turns out that in the world of the Internet of Things (IoT), almost every device has a communications link associated with it and that link is vulnerable to attack. As a result, companies building IoT systems are working feverishly to incorporate security into their devices. While security can be “programmed” into your software, almost everyone is now using hardware features to make their IoT systems more secure. And, though there are several different types of hardware security measures that can be employed, almost all of them require some type of “provisioning”. Presto Engineering is one of the companies that really knows how to do this step well.

So what is the provisioning thing and why is it so important? This brings us full circle to the statement that raised our proverbial eyebrow. Provisioning is the process whereby the secrets necessary for security functions are incorporated into individual IoT devices. The trick here is that the chain of secrecy for this data must be such that even the people doing the provisioning of an IoT chip can’t know the secrets. Yep, you heard that right. The last thing you want to do is go to the trouble of building a highly secured IoT chip only to have your secure UIDs, transport keys, authorization certificates etc. get intercepted and compromised before they ever get loaded into the chip. So, the secrets being loaded have to be secret to everyone including the company doing the actual physical provisioning.

Depending on the end IoT application, there will be different levels of secrecy and control required. In fact, the industry has even set up procedures to provision secure chips in a way that can be audited according to a set of international standards known as the Common Criteria for Information Technology Security Evaluation. These criteria specify what is known as Evaluation Assurance Levels (EALs) that range on a scale from an EAL1 (minimal) to EAL7 (government and military high security). EAL5 is typical for highly demanding commercial applications such as banks, payment, pay TV, secure access control systems, etc. The important part is that the “provisioner” uses rigorously controlled and auditable processes to securely handle its customers’ secrets while ensuring absolute integrity and confidentiality of this operation.

Security hardware can be provisioned at the wafer level during wafer probe; at the chip level, after packaging; or at the board level once the chips are placed on the board. Depending on where the provisioning is done, there will be processes that need to be in place to ensure that “secret data” can be securely transmitted to the provisioner. Additionally, the provisioner will also need to ensure that the data will remain secure until it can be physically encoded into the ICs. This implies secure connections and servers between the secret data supplier and the various manufacturing sites where the provisioning is done.

There are several strategies that can be employed to insure data integrity for the EAL required. The higher the EAL, the costlier the strategies get. For a company like Presto Engineering, the trick is to have the ability to customize the offerings to enable enough security for the requirement while minimizing the costs to their customers.

Presto, in fact, does just that. They have a comprehensive and flexible IT system that allows them to connect customers’ secret data with dedicated data storage rooms while complying with different EAL requirements. As an example, if the EAL is relatively low, Presto may be allowed to use virtual machines on shared servers to keep different customers’ data separated. By sharing servers, they can keep costs down.

Alternatively, if the EAL requirement is high, the customer may demand their data be handled only on customized high-security servers (also known as hardware security modules or HSMs). Per the diagram, the HSMs may be owned by Presto or by the customer. In either case, the more dedicated and more secure, the higher the cost and greater the lead time to deploy the provisioning systems.

In addition to data storage, Presto has secured test floors (EAL5+/6) and secured warehouses where provisioned parts are kept until they are shipped via secure methods to their customers’ locations. Presto also has expert trained staff operating secured flows who can assist customers in preparing devices for standards certification such as secure element card EMVCo testing (Eurocard, MasterCard and Visa).

Many enterprise level companies handle these provisioning tasks by themselves, however in the world of IoT, there are large numbers of small and medium sized enterprises (SME) for which this would be a daunting task. Nearly all the places where provisioning takes place are handled outside the walls of the SMEs, putting their secret data at risk. SMEs really need to look to outsourced provisioners to manage their costs, schedule and security risks.

Ideally, an outsourced provisioner should offer certain key capabilities:
[LIST=1]