Speech / Paper :-) For more information visit www.asdf.international / www.asdf-wss.com

1. Embedded System Security-
A challenge for Internet of Things (IOT)
By:
Dr. Subramaniam Ganesan
Professor, ECE Department,
Oakland University
Rochester, MI 48309. USA.
1
WORLD SECURITY SUMMIT 2014
30 DECEMBER, 2014 :: BANGKOK, KINGDOM OF
THAILAND, ASIA
http://www.asdf-wss.com/

2. Dr. Subramaniam Ganesan, is a Professor in the department of Electrical and
Computer Engineering, Oakland University, Rochester, MI 48309, USA. He is a
senior member of IEEE, was IEEE Computer Society Distinguished Visiting
Speaker, IEEE Region 4 technical activities member and Fellow of ISPE. He
received Life time Achievement award from ISAM, Lloyd L. Withrow
Distinguished Speaker Award from SAE, Best Paper award from ISAM, Best
Teacher award from ASEE, and Oakland University. He is the editor in chief of an
International Journal of Embedded system and Computer Engineering and
International journal of Sensors and applications. He is the session organizer on
“Systems engineering” at SAE world congress for the past 15 years. More details
about him can be obtained from the web address:
www.secs.oakland.edu/~ganesan. His research interests are in Real time
system, parallel architectures and computer systems, Mobile computing,
Automotive embedded systems and signal processing. He holds patents in
embedded system
2

3. Agenda
• Embedded System- Real Time systems, IOT
• Embedded System Security problems
• Challenges in IOT security and solutions
• Hardware (FPGA) solution
• Conclusions
3

4. Abstract
Internet of things (IOT) has billion dollar market in the coming years.
Wireless sensors, RFID technologies and low cost-high performance-
small size computer boards play a great role in IOT implementation.
In this presentation, challenges in IOT implementation, especially
embedded system Security are covered. Advanced wireless sensors,
handheld mobile devices, data routers with cloud based computing,
and cheap PC boards like Arduino are security threat.
Some of the challenges and available solutions for reliable
communication needed of IOT, system and data security are discussed.
4

5. You are slowly drowning
In IOT
5

6. Surfing the Web inside a car ?!
25 percent of cars will be connected to the
Internet by 2015 [source: Barry].
6
Today's connected cars physically access the Internet
in several ways. Some cars, such as those equipped
with the Ford Sync system, tap into the Internet
connection on a driver's smartphone or a wireless
USB adapter. Others, such as the 2011 Audi A8, use
a separate data connection built into the car that
accesses the Internet through a phone company's
data service. There are aftermarket products to
enable Internet access in cars as well -- the Autonet
Mobile router connects to the Internet through a 3G
or 4G cellular connection and allows Wi-Fi-enabled
devices in and near the car to go online [source:
Autonet Mobile]

7. What is an Embedded System?
• Electronic devices that incorporate a computer (usually a
microprocessor) within their implementation.
• A computer is used in such devices to simplify the system
design and to provide flexibility.
• Often the user of the device is not even aware that a
computer is present.
7

8. What’s the Internet of Things
 Definition
(1) The Internet of Things, also called The Internet of
Objects, refers to a wireless network between objects,
usually the network will be wireless and self-
configuring, such as household appliances.
------Wikipedia
(2) embedding short-range mobile transceivers into a
wide array of additional gadgets and everyday items,
enabling new forms of communication between
people and things, and between things themselves.
------WSIS 2005
8

9. IoT in a home
9

10. What’s the Internet of Things
From any time ,any place connectivity for
anyone, we will now have connectivity for
anything!
10

11. The challenge of IoT
How to convince users that the IoT technology will
protect their data and privacy when tracking
Potential Solutions
Legal &
Regulatory
Technical
Control
Social Ethic
Market
Self-regulation
11

12. Single Board Computers bring low cost
computing power to IoT
• SBC are Cheap
• Easy to integrate with any device or sensors- using USB
port
• Has Wireless interface
• Has internet interface
• Algorithm development are easy using PC
12

13. Cheap PC boards
Since the coming of the Raspberry Pi Model B, single-board
computers (SBCs) have become a prevalent force in the
development world. These pocket-sized devices have taken the
online maker community in particular by storm, providing PC
functionality to a plethora of open-source projects in amazingly
compact, cost-effective, and low-power platforms.
http://www.eetimes.com/document.asp?doc_id=1319262&itc=eetimes_sitedefault&cid=NL_EET_Daily_20130821&elq=9dea33a652464fea8c40a538cb1f3f6e&elqCampaignId=841
13

14. Pushing the limits of technological creativity achievable in the palm of one’s hand
SBCs are poised to change how we approach embedded systems development. 14

15. 15

16. • Embedded systems, which are used pervasively in our
lives, now contain our sensitive personal data, identity,
and even our purchasing power, and perform several
safety-critical functions. Some examples include mobile
phones, MP3 players, automotive electronics, medical
appliances, and ubiquitous devices such as sensors and
RFID tags.
• Unless embedded system security is adequately
addressed, it will become a concern that impedes the
adoption and usage of many embedded system products,
applications, and services. 16

17. • Several technologies have been developed to address
information security (cryptography, secure
communication protocols, anti-virus tools, firewalls,
intrusion detection, and so on), which can be adapted
to embedded systems.
• These technologies can be referred to as "functional"
security measures, since they usually specify functions
that must be added to the target system without any
consideration of how they are embodied in hardware or
software. 17

18. • Most real security attacks do not directly take on
the theoretical strength of cryptographic algorithms;
instead, they target weaknesses in a system's
"implementation".
18

19. Effective security solutions can be realized only if they are
built-in at various stages of the design process (architecture,
HW design, and SW development).
Assurance gap, which refers to the gap between functional
security measures and truly secure implementations, the
security processing gap, which arises due to the processing
requirements of the additional computations that must be
performed for the purpose of security, and the battery gap,
which is a consequence of the energy consumed in
performing security-related functions.
19

20. Security Problem
• Various security attacks on the data/sensor by
unauthorized persons are possible.
• This leads to research challenges in security
algorithms, authentication, privacy, prevention of
denial-of-service attacks, secure routing etc.
• Security hardware and software should become part
of the sensor node architecture.
• Encryption need to be used in WSN to prevent eaves
dropping and tampering data.
20

21. System Vulnerabilities
Rad level servlet
and camera glue
code
Tracking service
and
user interface
Nextel/
Internet
Mote network
Camera control
node (Linux)
Jumbotron
controller
VGA to NTSC
adapter
Rad detector,
mobile phone
mote
Internet
Mac/Link
Network
Application/Service
Physical
• Jamming
• Bogus tracking results
• Tracking command
Spoofing
• Battery consumption
attack
• MAC DoS
• Eavesdropping
• Packet dropping
• Mis-forwarding
• ID spoofing
• Forging routing
Information
• Disclosing/modifying
/replaying tracking results
Sensor network vulnerabilities
Traditional network/system vulnerabilities
• Denial of Service Attack
• Information disclosing/modification/replaying
• Address Spoofing
• etc..

22. Security Issues in Sensor Networks
Security IssuesMechanisms
Jamming Physical
Mac/Link
Network
addressing
routing
forwarding
MAC DoS
Eavesdropping
Address spoofing
Forge routing information
Drop/forward to wrong neighbor
Release/modify content
Msg Auth Code
Application
/Service
Encryption
Secure Routing
Source Authentication
Link Level Encryption
Attach Detection
User ID spoofing
User Authentication

23. 23
Reference: SHASHIDHAR PERURU
23

24. FUNCTIONAL SECURITY
MECHANISMS
Cryptographic algorithms, including symmetric
ciphers,
Public-key ciphers.
Hash functions.
Network security protocols ( IPSec and SSL )
BUT, they are not tamper proof and do not provide
complete security solutions.
24
http://www.flickr.com/photos/aperture_lag/2328240402/
24

25. CAUSES OF SECURITY LAPSES
 Operations in untrusted environment
 Network induced vulnerability
 Downloaded software execution
 Complex design process
25
http://media.maxim-ic.com/images/appnotes/2033/2033Fig04a.gif 25

26. CLASSIFICATION OF ATTACKS
 Based on functional objectives
 Privacy attacks
 Integrity attacks
 Availability attacks
 Based on agents or means used to launch attack
 Software attacks
 Physical or Invasive attacks
 Side Channel Attacks
26
26

27. PHYSICAL AND SIDE CHANNEL
ATTACKS
 Buffer overflow problem
 effects can include
overwriting stack memory,
heaps, and function
pointers
27
SOFTWARE ATTACKS
 Physical Attacks
 Power Analysis attacks
 Timing attacks
 Fault Injection attacks
 Electromagnetic Analysis attacks
http://img133.imageshack.us/img133/6973/intrusiontn3.jpg
27

28. COUNTERING SECURITY ATTACKS
 Specific objectives of the mechanisms
 Attack Prevention
 Attack Detection
 Attack Recovery
 Tamper evident design technique
28
28

29. COUNTERMEASURES FOR SOFTWARE
ATTACKS
The major considerations are :-
1. Ensure privacy and integrity of sensitive code and
data during every stage of software execution in an
embedded system.
2. Determine with certainty that it is safe (from a
security stand point) to execute a given program
3. Remove security loopholes in software that make the
system vulnerable to such attacks
29
29

30.  Hardware Support
 Idea is to isolate or restrict secure memory areas
 Cryptocell ™
 Secure Bootstrapping
 Operating System Enhancements
 Software authentication and validation
30
http://www.discretix.com/images/CryptoCellComple.gif
http://www.discretix.com/images/HWcontext.gif
30

31. COUNTERMEASURES FOR PHYSICAL
AND SIDE CHANNEL ATTACKS
 Physical attack protection
 IBM 4758 PCI cryptographic adapter
31
31

32.  Bus encryption
 Use of crytoprocessors
 Side channel attack protection
 Randomization
 Data Masking
32
32

33.  It is a comprehensive security solution for SOCs
 Foremost and primary objective is to segregate access
to sensitive information of a ARM based SOC
architecture
CASE STUDY : ARM TRUSTZONE™
33
http://www.windowsfordevices.com/files/misc/arm_trustzone_arch_concept_diag.gif
http://www.arm.com/rximages/21885.gif
http://www.design-reuse.com/news_img2/
news16975/arm_trustzone.gif
33

34.  Trusted Code base
 Regulates the entire security of entire system
 Regulates all security tasks that involves manipulation of
keys
 Uses demarcation to separate domains using ‘S-bit’
34
34

35. Embedded Systems
35

36. 36

37. 37

38. 38

39. 39

40. 40

41. • As embedded systems evolve from isolated devices to
always-on networked devices, security will become
increasingly important, as a hijacked device could wreak
havoc on an entire network.
• Strengthening the security at all levels of the security
pyramid will thus be simultane-ously more challenging and
more critical to society.
41

42. Experimental Platform for
Model-Based Secure Embedded System Design
Reference: Vanderbilt University

43. Model-based Approach
Models facilitate formal analysis, verification, validation
and generation of embedded systems
Functional
Models
Component
Models
Componentized Model
Platform
Model
Deployment Model
Generators
(Interpreters)
Composition Platform
(e.g.: AADL)
HW/SW Architecture
(Windows, Linux)
Source Files
(e.g.: SimuLink, Hand crafted code, etc.)

44. Integrate Security into Models
Generators
(Interpreters)
Secure Composition Platform
(e.g.: AADL security extension)
Hardware, OS service
(e.g.: Kernel partition)
Source Files
(e.g.: SimuLink, Hand crafted code, etc.)
Security Extension examples
• Role Based Access Control
• Secure Links
• Fair Exchange
Functional
Model
Component
Model
Secure Componentized Model
Platform
Model
Deployment Model
Security
extension
Security
service
Secure Component Structure Model
Security
policy

45. Advantages
• Advantages to integrate security into model-based
embedded system development
– Introducing security at design level
– Verifying required security properties using explicit security
models
– Consistent and automatic configuration of security services
offered by the operating system
– Investigating design tradeoffs between performance and security
properties

46. An Example based on AADL
• AADL (Architectural Analysis and Design Language
– SAE Aerospace Standard (AS5506)
– provide a standard interface and environment
for system designers to model, analyze and
generate embedded system code.
AADL Components
AADL Metamodel

47. AADL Security Extension
An example security mechanism
Role-based Access Control
• Objects – subject to access
control
• Operations – execution of
some functions on objects
• Permissions – approval to
perform operation on RBAC
protected object
• Roles – job with assigned
authority and responsibility
• Users – human being,
machine, network or agent
requesting operation on
objects
Security Extension Metamodel

48. Platform Security Service Modeling
Security Service Providers
• OS (ex: Linux, LynxOS, WinCE)
• HW (ex: Space Partitioning,
Memory protection)
• Services of different applications
• (ex: Web Browser Based
Authentication)
• Partition in OS
Platform Security Models with sufficient detail enable Code
Generators to access Platform Specific Security Services
Theoretical Security Concepts
(Platform Independent)
Security
Requirements
of a System
Existing Security Solutions
Provided Different Platforms
Security
Capabilities
of a Platform
Mapping between requirements
and underlying capabilities
( Ideally requirements are the
subset of the capabilities )
Platform Security Service
Model
-- Abstracts out security
properties of the platform
that are essential for the
design flow

49. Software Architecture with Security Extension
Embedded Hardware Target
Real-Time
Operating System
AADL Runtime System
Application
Software
Component
Application
Software
Component
Application
Software
Component
Embedded Hardware Target
Real-Time Operating System
OS Security Extension
App App App
AADL
Runtime
System
Application
Software
Component
AADL
Runtime
System
Application
Software
Component
AADL
Runtime
System
Application
Software
Component
API
API
AADL Execution Environment
AADL Extended AADL

50. Experimental Platform Architecture
10/100BASE-T or 802.11b
Plant
Simulator
Data Acquisition Board (DAQ)
Embedded
System Board
Embedded
System Board
Embedded
System Board
The Data Acquisition Board
interfaces plant simulation
with embedded system
boards
The Plant Simulator acts as
the physical environment in
which the embedded system
would run
The embedded system boards
run distributed control
algorithms

51. Implementing Systems on Platform
• The experimental platform
facilitates “Hardware”-in-
the-Loop testing of
controllers.
• High fidelity plant simulations
behave just as the actual
physical environment would.
• Controllers can run on various
operating systems with
different security designs.
• Code for controllers is
generated based on security
models for the embedded
system

52. Putting things
Together!
10/100BASE-T or 802.11b
Plant
Simulator
Data Acquisition Board (DAQ)
Embedded
System Board
Embedded
System Board
Embedded
System Board
Automatic Code Generation
and Deployment
TheprocessofAADLcodegeneration

53. Results
• Real-Time Simulation of Three
Tank Fluid Transfer System
• With I/O register protection only
the tank control process has
permission to write to I/O channels
• Model-Based approach can map
desired security properties to
underlying platform services such
as POSIX capabilities (e.g.
CAP_SYS_RAWIO)

54. Application-Driven Testbed for
Secure Wireless Sensor Network Design

55. Dirty Bomb Detection & Localization
Stadium with Sensors Deployed
Google Earth Illustration of Localization System
Automatic Camera Feed
~12 Static
XSM Motes
(positions
known )
Guard moves with an
XSM Mote, tracked by
RIPS technology

56. Architecture
Rad level servlet and
camera glue code
Tracking service and
user interface
Nextel/
Internet
Mote network
Camera control
node (Linux)
Jumbotron
controller
VGA to NTSC
adapter
Rad detector,
mobile phone
mote
Internet

57. Peer Authentication Scheme
• Objective
– Provide efficient, effective, and flexible peer sensor
authentication
• Basic Idea
– Symmetric-key based (SkipJack in TinySec)
– Each sensor node has a different set of keys through a pre-key
distribution scheme
– Multiple MACs are generated for each message from a sensor
node
– MACs are verified at the receiver sensor using its common keys
with the sender

58. A Simple Example
A
D
B
C
1
4 2
3
A
D
B
C
D
C
B
C
C
I am C
You are not C,
since you don’t
have key 3
You are not C,
since you don’t
have key 2
I know you
are not me.
Sensors A, B, C,
D have different
combination of
overlapping keys:
A: 1, 4
B: 1, 2
C: 2, 3
D: 3, 4
Sensor A pretends to be C,
appends message
authentication code (generated
with key 1 & 4) to outgoing
messages

59. Implementation and Results
• We implement the peer authentication scheme as a
component (MultiMAC) under TinyOS (based on SkipJack
in TinySec)
• Measurement Results
– Computation time: 5.3 ms;
– Verification time: < 0.1 ms, 1.3~1.4 ms or 2.5 ms, if receiver has 0,
1 or 2 keys in common with sender.
• Demonstration Video
– Windows Media

60. There are four components to creating an anti-
tamper solution:
Tamper resistance is the ability to resist tamper attempts, and is
achieved by specialized features.
Tamper detection is the ability to make the system or user aware of the
tamper event
Tamper response is the countermeasure procedure that a system must
take once tampering is detected.
Tamper evidence must be detectable so authorized personnel
inspecting the system can identify whether the system has been
tampered with.
60

61. 61
Solution provided by ALTERA FPGA chip

62. 62

63. 63

64. 64
Recognizing the susceptibility of JTAG, Cyclone III LS FPGAs take extra
precautions by restricting access to the JTAG port. Traditionally, the
JTAG port always was enabled on FPGAs, and any instructions
received on the JTAG I/O pins would execute immediately. In Cyclone
III LS FPGAs, the native state of JTAG is restricted to only those
instructions required for compliance to the IEEE specification. The
JTAG port can be reset to accept the full instruction set. However,
resetting the JTAG port causes the Cyclone III LS FPGA automatically
to erase all configuration within itself (including the volatile AES key,
if used), before allowing full access on the JTAG pins. Therefore, a
user cannot use the JTAG port to test or modify the design in any
way.
JTAG Threat Protection

65. Protection Beyond Today’s Threats
The security features in Cyclone III LS FPGAs go beyond the immediate needs
of the market to protect the bitstream during configuration and to protect
the design from the JTAG port. In addition to these features, Cyclone III LS
FPGAs provide tamper-detection capabilities to identify advertent and
inadvertent bitwise manipulation of the design using cyclic redundancy
check (CRC) circuitry. The CRC circuit continuously checks the configuration
of the FPGA for single- or multiple-bit changes to the configuration due to a
soft error (or SEU) caused by atmospheric neutrons. In the case of an error,
the system is notified immediately to take corrective action. This ultimate
control over system behavior allows various activities such as error logging
or a graceful shutdown. The CRC feature can also act as an additional layer of
anti-tamper protection, alerting the user if the memory contents have
changed since the FPGA was last configured.
65

66. Tamper Resistance – Clearing Sensitive data
Though the definition of zeroization involves a clear plus verification
that all data was cleared, most applications will benefit from a
zeroization which clears all memory cells of the FPGA. The Cyclone III LS
zeroization solution breaks out the clear function and the verification
function to provide the maximum design flexibility to the user. By
default, the clear function clears the configuration RAM, which
contains the design itself, and the embedded RAM, which contains any
design specific data. Additionally, the AES encryption key can be
cleared independently of the rest of the device.
66

67. Cyclone III LS FPGAs offer an uninterruptible clock source through an
internal oscillator. This ensures that if the system clock or input clock to
the FPGA is manipulated, the system can still perform health checks,
monitor the FPGA configuration through the CRC, and initiate or
perform corrective action if an unexpected event compromises the
security of the design. The existence of an internal clock source gives
designers full control over systems in the field, ensuring that the
designs can protect themselves in the event of a threat.
67

68. Cyclone III LS FPGAs
Cyclone III LS FPGAs offer security features for a complete anti-tamper
solution on a low-power platform, allowing designers to meet
constraints and ship product with confidence that the IP is protected.
68

69. Anti-Tamper Components Description
Altera Cyclone III LS Solution
• Tamper resistance Specialized features Encryption key
• JTAG-port protection
• Tamper detection Awareness Programming failures
• Cyclical redundancy check (CRC)
• Tamper response Countermeasures Zeroization of all configuration
memory
• Tamper evidence Visible evidence Multiple unsuccessful
programming
69

70. 70
• A mechanism is required to record (measure) what software is/was running
• Requires to monitor the boot process
• Needs an anchor to start the measurement from a Root of Trust
• Nobody should be able to modify or forge these measurements
• Some shielded location for the measurements is required
• Now you know that your platform is in a defined state
• Why should someone else believe this claim?
• A mechanism to securely report the measurements to a 3rd party is
required
• Secure storage
• Allow access to data only if system is in a known state
• Cost efficient implementation and production
Trusted computing

71. 71
TCG- Trusted computing Group is a non-profit organization formed to develop, define,
and promote open standards for hardware-enabled trusted computing and security
technologies, including hardware building blocks and software interfaces across multiple
platforms
TCG specifications enable more secure computing environment to protect and
strengthen the computing platform against software-based attacks and physical
attacks
TCG specifications are freely available from www.trustedcomputinggroup.org
Trusted Platform Module (TPM) is a major building block to achieve the goals of a
trusted computing system

72. 72
Trusted Platform Module (TPM)

73. 73

74. Components on TPM chip
I/O
Crypto Engine:
RSA, SHA-1, HMAC, RNG
Non Volatile
Storage
(> 1280 bytes)
PCR Registers
(16 registers)
Other
Junk
RSA: 1024, 2048 bit modulus
SHA-1: Outputs 20 byte digest

75. Conclusion
• Security is an increasing concern in embedded system design and it is
becoming a real threat in IOT environment.
• Embedded System security considered at the hardware level,
software level, algorithms, and application levels. Traditional crypto
algorithms and techniques are useful with modification to suit the
device.
• Using a model-based approach, security can be considered as an
integral part through design process
• Experiment platforms are critical to validate security designs
75

76. REFERENCES
1. IEEE SECURITY & PRIVACY 2006, securing embedded systems by David Hwang etal.
2. www.discretix.com/wp.../Security-Challenges-in-Embedded-Designs.pdf
3. https://hal.archives-ouvertes.fr/hal-00389976- embedded system security
4. Cryptocell™, Directrix http://www.discretix.com/CryptoCell/
5. ARM TrustZone™ http://www.arm.com/products/security/trustzone/
6. IBM 4758 PCI cryptographic adapter http://www-
03.ibm.com/security/cryptocards/
7. ARM DONS ARMOR,TrustZone Security Extensions Strengthen ARMv6
Architecture By Tom R. Halfhill {8/25/03-01}
8. Security in Embedded Systems : Design Challenges,Srivaths Ravi and Anand
Raghunathan,NEC Laboratories America,Paul Kocher Cryptography Research,and
Sunil Hattangady,Texas Instruments Inc.
9. www.cryptography.com/public/pdf/DPA.pdf
10. Into the Zone: Building Secure Systems with ARM® TrustZone® Technology- TI
application note .
11. Building Security into Embedded Systems: Yuan Xue , Institute for Software
Integrated Systems , Vanderbilt University.
12. Embedded security challenges in automotive designs, Part 2 by Eran Rippel, Discretix
Technologies
13. Anoop MS, Public Key Cryptography – Applications algorithm and mathematical
explanations, May 2007
76
76

77. References
automotive embedded systems.
• http://www.autosec.org/pubs/cars-usenixsec2011.pdf
a great reference on secure RTOS from NSA:
• https://www.nsa.gov/ia/_files/sse-100-1.pdf
77