The Internet of Things (IoT) adds wired or wireless connectivity to a slew of applications: factory automation, automobiles, medical equipment, smart cities, smart farms, building and home automation, appliances, smart grids, personal electronics, and many more.
In many cases IoT edge nodes are designed with embedded processors with only enough functionality to provide the required performance at low cost, so they don’t have enough spare processing power to implement a full array of security measures, or even any at all.
The billions of nodes present rich opportunities for mischief. Hackers can take control of multiple devices to build a botnet. Then they can use the combined computing power to send spam, spy on organizations, mount distributed denial of service (DDoS) attacks, or even amass Bitcoins through cryptomining（图。1）。
1. Coming soon to an IoT device near you. (Source:hdqwalls.com)
Sponsored Resources:
Several well-publicized events—hacked cardiac devices, baby monitors, security cameras, and, of course, the Mirai botnet—have underscored the need for designers to improve security from the edge node to the cloud.
Providing security for an embedded design has multiple layers. Designers must conduct a thorough risk evaluation and select appropriate measures so that an embedded node includes the needed level of security while still providing the proper functionality and keeping within the cost targets. Not an easy job!
Manufacturers have well-established internal procedures to protect data before the product leaves the factory: permission-based access controls, levels of user privilege, strong passwords, encryption when data is being moved and while it’s being stored, activity logging, and so on.
There’s also an additional set of external security issues that involve the interaction between the device and the cloud. The manufacturer must have a means of transmitting data securely into the cloud. Once the product is deployed in the field, there must be a way to ensure that only authorized devices have access to cloud resources and that devices only accept verified data from a trusted source.
主要的云提供商敏锐地意识到物联网应用程序固有的潜在安全问题。Amazon Web Services（AWS）IoT Core，Google Cloud Iot Core和其他提供商提供了全面的工具来帮助此过程。
Microchip’s CryptoAuthentication for IoT Applications
Strong authentication is the foundation of robust IoT security. Cloud providers are driving toward hardware-based security for strong device identity protection and to prevent identity spoofing, as well as protect against unauthorized firmware updates.
Microchip提供了行业最广泛的身份验证设备，具有基于硬件的信任存储和加密对策。公司的ATECC608ACryptoAthentication Secure Element为Google Iot Core和AWS IoT提供了安全的身份验证解决方案。该部分基于椭圆形曲线差异 - 赫尔曼（ECDH）安全协议和椭圆曲线数字签名算法（ECDSA）实现完整的不对称键加密解决方案。ECDH是一种提供加密/解密的关键协议的超安全方法；ECDSA为IoT设备提供签名验证身份验证。
与集成ECDH ECDSA, ATECC608A增刊lies the full range of IoT security tools—confidentiality, and data integrity—to systems with microcontrollers (MCUs) or microprocessors (MPUs) running encryption/decryption algorithms. The ATECC608A’s hardware executes the cryptographic solution up to 1000X faster than software running on a standard microcontroller. In addition, the part includes an integrated AES hardware accelerator to provide hardware-based security for LoRaWAN applications, plus enable small microcontrollers to have secure boot capabilities.
ATECC608A兼容芯片的AVR /rm MCU or MPU, as well as other MCUs or MPUs. In common with other CryptoAuthentication devices, the ATECCC608A delivers extremely low power consumption, communicates via I2C or a single-wire interface (SWI), and has a tiny form factor, making it ideal for space-constrained or battery-powered IoT applications.
每个ATECC608A都有保证独特的72位序列号的船。这允许主机系统或远程服务器验证序列号的签名，以证明序列号是真实的，而不是副本。
将ATECC608A连接到Google Cloud：概述
2. Microchip和Google为使用ATECC608A独特功能的物联网设备开发了一个简单的身份验证协议。（资源：谷歌)
样品IoT身份验证序列（图2）using the ATECC608A and Google Cloud IoT Core is as follows:
1. Start with a secure element.Any secure element stores private keys and blocks all attempts to physically hack the device and retrieve the keys. The ATECC608A, though, not only stores the private keys, but also validates the firmware and provide a more secure-boot capability for the device.
ATECC608A在内部生成自己的私钥，而不是使用外部证书授权（CA）的密钥。芯片使用真正的随机数发电机（TRNG）来创建键，使其几乎不可能得出，并且该密钥仍然是设备的内部。使用私钥，芯片可以生成一个可以由ATECC698A客户选择的CA签名的公钥。
Microchip在专用且安全的美国设施中执行此签名，其中客户的中间CA键存储在连接到制造线的安全服务器中。密钥对和证书均在受控环境中生成，启用审核和高水平的加密。
一旦安全元素分别生成了密钥对，则将相应的公共密钥发送到客户的Google Cloud帐户，并牢固地存储在Cloud Iot Core Device Manager中。因为Cloud Iot Core最多可以存储每个设备的三个公共钥匙；可以无需任何问题就可以执行关键旋转。
2. Use a JWT for authentication.TLS can establish secure communication between the device and the cloud. TLS can also provide authentication, but the TLS authentication stack is large; Google Cloud IoT Core employs a JWT (JSON Web Token) to authenticate the device because it’s more suitable for a resource-limited IoT device. A JWT is an open standard (RFC 7519) that defines a compact and self-contained way to transmit information securely between parties as a JSON object. The information in a JWT can be verified and trusted because it’s digitally signed. JSON is a standard text-based format for representing structured data as a series of key/value pairs.
Using this approach, the IoT device will establish a secure connection to the Google Cloud endpoint with TLS; it then generates a JWT, signs it with its private key, and passes it as a password. The Google Cloud endpoint receives the JWT and verifies the signature using the device's public key, thus establishing mutual authentication. The cloud customer can limit the duration of the JWT validity.
There are several benefits to combining the JWT method with the ATECC608A. The approach doesn’t depend on the TLS stack for device authentication, so updating to the recently finalized TLS 1.3 will be straightforward. IoT devices don’t need to store their public key and certificate or host a full TLS stack. Both reduce the memory requirement to well under 50 kB, possibly allowing the designer to move to a lower-cost MCU.
物联网传感器节点简化了物联网设备连接的评估
To demonstrate the ease-of-use of the ATECC608A in a Google Cloud IoT Core environment, Microchip incorporated the part into a sensor node board(Fig. 3)。AVR-IoT WG (part #AC164160) is a compact and inexpensive evaluation and development board that demonstrates the easy migration of bare-metal embedded-control applications to the Google Cloud. The kit includes hardware, software, and access to a sandbox account, so a designer can get online and begin evaluation in only a few minutes.
3. With the included hardware and software, the AVR-IoT WG allows a designer to begin evaluation in a few minutes. (Source:Microchip Technology)
In addition to the ATECC608A, the core components are:
- AVRATmega4808microcontroller features the 8-bit AVR processor running at up to 20 MHz with a hardware multiplier, 6-kB SRAM, 256 bytes of EEPROM, and up to 48 kB flash in a 32-pin package. The part uses the latest Core Independent Peripherals with low-power features, including Event System, intelligent analog, and advanced peripherals.
- TheWINC1510network controller is a single-band, 2.4-GHz b/g/n network controller optimized for low-power IoT applications. The part supports a variety of security protocols: WPA/WPA2 Personal and Enterprise, TLS, and SSL. The IoT sensor board also integrates the Wi-Fi antenna.
- The nEDBG “Nano Embedded Debugger” allows connection to development kits for ATmega4808 and other Microchip MCUs, as well as supports programming and debugging support via the company’s MPLAB X and Studio 7.0 IDE. The nEDBG offers a serial connection to a USB interface to provide data-streaming capabilities between the host computer and the onboard MCU, plus a mass storage interface for easy “drag and drop” programming.
The AC16460 also includes aTEMT6000ambient light sensor and a MicrochipMCP9808温度传感器，以及两个表示状态的用户配置按钮和指示灯LED(Fig. 4)。
4. LEDs on the AVR-IoT WG provide convenient status indications. (Source:Microchip Technology)
AVR-iot WG进行了预编程和配置，以证明与Google Cloud IoT Core的连接。董事会上的ATECC608A已在Google Cloud上的Microchip的AVR-iot（Sandbox）帐户中预先注册。每个安全元素都提供18位十六进制的唯一标识号（UID）和一个使用椭圆曲线密码学预先生成的公共或私钥对。
The UID can be viewed on the URL of the webpage application or via the serial command line interface. The ATECC608A private key is never revealed, but the public key can be viewed in the included PUBKEY.TXT file or via the serial command line interface.
Since the ATECC608 is pre-registered, the application only needs a Wi-Fi network with an internet connection to stream data to the Google Cloud.
CryptoAuthLib Software Library Speeds JWT Authentication
Microchip’s Crypto Authentication Library (CryptoAuthLib) is a software library designed to work with CryptoAuthentication devices like the ATECC608A. CryptoAuthLib incorporates management features for Public Key Infrastructure (PKI) X.509 certificates, saving the developer much time writing certificate management code for a specific driver. It also helps when integrating TLS into ECDH-capable CryptoAuthentication devices.
CryptoAuthLib eases the implementation of secure IoT features such as the Google JWT authentication protocol discussed above. Complex security operations are accessed through a set of function calls provided by the CryptoAuthLib application programming interface (API).
该库分为几个API类别，涵盖了各种加密认证应用程序的需求。这些API包括：
- 基本API—emphasizes ease-of-use
- Core API—allows use of any device feature
- PKI X.509 Certificates—PKI applications that store and retrieve X.509 certificates
- PKI TLS- 确定通信关键协议协议
- Crypto Utilities—general software hash implementations
- HAL—hardware abstraction layer integrates with physical interfaces
CryptoAuthlib用C编写，使其适用于多个平台，例如ARM Cortex设备以及Windows和Linux机器。
The Microchip Security Portfolio
Microchip offers a range of products for other security applications. Security-focused MCUs include the 16-bitPIC24FJ256GB412devices with an integrated hardware Encryption Engine, and 32-bitSAM L11andSAM D5x/E5xMCUs. Among the security-focused MPUs are theSAMA5D2andSAMA5D4。此外，几个产品系列帮助设计师将安全性添加到嵌入式系统中：
- TheTrusted Platform Module (TPM)family provides strong hardware-based public key (RSA) security on a single device for personal and tablet computers and embedded processor-based systems.
- CryptoMemoryproducts are cost-efficient, high-security, electrically erasable programmable read-only memory chips (EEPROMs) and host-side security for applications requiring comprehensive data protection.
- CryptoRFis a 13.56-MHz RFID device family that includes a 64-bit embedded hardware encryption engine, mutual authentication, and up to 64 kb of user memory.
Microchip’s broader security ecosystem includes Security Design Partners with TLS stack providers, Cloud experts, Certificate Authority companies, and CryptoAuthLib library experts.
Conclusion
As a part of their comprehensive portfolio of security products, Microchip Technology has developed the ATEC608A secure element to simplify the task of connecting an IoT device to the cloud. Microchip has combined with Google to offer a convenient hardware-based root of trust for Google Cloud IoT Core.
Sponsored Resources:
相关资源
- TheCircuit blog: “Microchip’s Secure IoT Sensor Node”
- “Getting Started With Your AVR-IoT WG Development Board” video
