The Internet of Things (IoT) is revolutionising the world we live in, connecting billions of ‘things’ that monitor and control our world, making our home and work lives better, more convenient and safer. The scale and rate of growth are both huge; with significantly more connected nodes than there are people on the planet and herein lays both the strength and vulnerability of the IoT.

As every single node is ‘connected’ it provides a potential access point (or ‘attack surface’) where malicious third parties can gain access to the network. Once the node has been breached then the attacker could simply steal data or other intellectual property, or render the system inoperable. They could also control equipment in a potentially dangerous way; IoT attacks can have actual physical implications.

At the heart of IoT nodes is the microcontroller (MCU) that runs the software and controls the node, and it is here that security efforts are focussed. Combining software and hardware security is the most effective approach and modern MCUs often incorporate sophisticated cryptographic/authentication engines, built-in security blocks, key management functions and tamper detection/prevention features. To protect potentially vulnerable communications within the network, the data passing to and from the node is commonly subject to encryption/decryption.

The boot-up phase is an area where malicious code can be injected to the system and it is imperative that only known software is used. This is achieved through a ‘Root of Trust’ so that the boot process is guaranteed to be secure. There are two aspects to this; firstly the software needs to be checked and authenticated before being executed and secondly, it must be stored in secure non-volatile memory (NVRAM) that prevents any form of tampering.

Given the relatively simple nature of most IoT nodes and, more importantly, the need to run on as little power as possible, the MCUs used generally tend to be lower-performance devices that are adequate for the required task, and nothing more. As such, the MCUs have little capacity to perform the additional security tasks and it is becoming a common approach to add a co-processor IC that is purely dedicated to providing security.

Infineon’s OPTIGA family of trusted platform modules (TPMs), include hardware accelerators that perform asymmetric encryption operations as well as algorithms to generate hash codes. Implementing an Infineon TPM means that data encryption and decryption can be managed away from the MCU, allowing the MCU capacity to be used for core tasks. This approach ensures high levels of security without impacting the MCU processing capacity.

Similarly, Maxim Integrated’s DS28C36 secure authentication chip works in conjunction with an MCU and external NVRAM to establish a Root of Trust. This secures the boot-up for the system and allows secure firmware-over-the-air (FOTA) updates on relatively simple, low cost hardware. The chip uses public/private keys and hash codes to authenticate software before allowing it to run on the MCU. Private keys are added by the equipment manufacturer in a secure environment at their factory, thereby encoding the firmware and protecting it. When booting up, the protected device retrieves the code and authenticates it using the private and public keys before permitting it to be executed.

Clearly security for the IoT is an important issue. While it may be possible to add security features as an afterthought, the best security schemes are when security is considered at the start of the design process, encompassing hardware and software aspects. Security co-processors remove the burden on the often relatively low-powered MCUs used in IoT systems, ensuring the highest levels of security in these relatively simple designs.

Mark Patrick joined Mouser Electronics in July 2014 having previously held senior marketing roles at RS Components. Prior to RS, Mark spent eight years at Texas Instruments in Applications Support and Technical Sales roles and holds a first class Honours Degree in Electronic Engineering from Coventry University.