Trusted Computing for IoT
and Industrial Systems
September 26, 2017

Agenda• IoT Security• Industrial Security• Trusted Computing– IoT Applications– Industrial Applications• Call to Action
Copyright 2017 Trusted Computing Group2

IoT Security

Copyright 2017 Trusted Computing Group3

Definition
Internet of Things (IoT) is:a world where physical objects are seamlessly
integrated into the information network

Copyright 2017 Trusted Computing Group4

Why IoT?
Smart Home

Automotive

Industrial

1

New capabilities and services

2

Greater efficiency

3

Increased flexibility and customization

ICTSource: Infineon Technologies | graphics are courtesy of Infineon

Copyright 2017 Trusted Computing Group5IoT Trend Affects All Markets
Smart vehicles

Smart city & energy

Smart industry & business

Smart home & consumer
devicesSmart cars

Energy & infrastructure

Factory automation

Smart home›
››
›

››

›

›

ADAS / autonom. driving
Connected car
Car security
(H)EV

›

›

Commercial, agriculture &construction vehicles
incl. Trucks & Busses›ADAS / autonom. driving›
Secured connectivity›(H)EV

Generation (renewables)
Advanced transmission& distribution / storage
Utilities (water), traffic (electr.
toll collection), outdoors,
government
Environmental sensors›

Industrial automation- Motor & motion controller- Power quality- Power tools
Industrial robotics

Building automation

Medical equipment

›
››
›

›

Automation
Access control
Air conditioning
Elevators/escalators›

Health sensors
Diagnostics
Rehabilitation systems

Other forms of transport

Professional lighting

Other businesses

›
›
›
›

- Building lighting›

Commercial aircraft
Connected trains
Ships (ferry & container)
Light electric vehicles- Street lighting- etc.

e. g. Banking & securities,
education, mining, retail andwholesale, transportation andlogistics›››

Home automation incl. homeappliancesHome energy management
Home security & safety
Lighting

Smartphones, tablets &PCs

Consumer Electronics &wearables›››

Media players, smart glasses,
smart watches
Well-being (health & fitness,assisted living
Gaming

ICTCommunication Networks

Data Center / Server Farms

Source: Infineon Technologies | graphics are courtesy of Infineon
Copyright 2017 Trusted Computing Group6

IoT Architecture
Gather data
Analyze
Send commands

Reliably convey dataand commands

Send and receive
data and commands
Source: Infineon Technologies | graphics are courtesy of Infineon

Copyright 2017 Trusted Computing Group

7

IoT Attacks Growing

Copyright 2017 Trusted Computing Group8

Each Layer can be Attacked

Bad Server

An Eavesdropper
listening in on data orcommands can reveal
confidential information
about the operation ofthe infrastructure.

Bad Device

A Bad Server sending
incorrect commands canbe used to trigger
unplanned events, tosend some physicalresource (water, oil,electricity, etc.) to an
unplanned destination,and so forth.

A Bad Device injecting
fake measurements candisrupt the control
processes and causethem to react
inappropriately or
dangerously, or can beused to mask physicalattacks.

Source: Infineon Technologies | graphics are courtesy of Infineon

Copyright 2017 Trusted Computing Group

9

IoT Defenses

Source: Infineon Technologies | graphics are courtesy of Infineon

Copyright 2017 Trusted Computing Group10

Industrial Security

Copyright 2017 Trusted Computing Group11

Industrial Automation Architecture

Copyright 2017 Trusted Computing Group12

Industrial IoT Brings Changes
Smart Factories / Industrial IoT / Industry 4.0› "Lot size 1": Ability to produce highly individualized products› Cloud analysis: Enabling data mining, deep learning and cost reduction› Predictive maintenance: Based on sensor data gathered and analyzed as big data

Implications››››

Greater communication within the plant and beyond
Reconfigurable, smart manufacturing equipment
New business models and opportunities
New security risks

13

Security Effects of Industrial IoT
New security paradigms› "Closed shop floor" paradigm not applicable anymore› Security risks touch all machines with greater potential impact› Industrial security is becoming part of corporate strategies

Implications› Strong protection required› Availability has higher priority than Confidential or Integrity› System-wide security approach required

14

Industrial IoT Countermeasures

Source: Industrial Internet Security Framework
https://www.iiconsortium.org/IISF.htm
graphics are courtesy of Industrial Internet Consortium

Copyright 2017 Trusted Computing Group15

Trusted Computing

Copyright 2017 Trusted Computing Group16

What is a Trusted System?

A trusted system is…
predictable, even under stress
trusted based on experience and/or evidence
based on fundamental properties (identity, integrity)
Copyright 2017 Trusted Computing Group17

Principle of Least Privilege Leads toRoot of Trust (RoT) Concept• RoT = Minimized, strongly protected security function• RoT used for highly security-sensitive functions– Generate random numbers– Store and use long-term keys
– Verify system integrity• Benefits– Reduce risks• Compromise of long-term keys
• Undetected system compromise

Copyright 2017 Trusted Computing Group18

Trusted Platform Module (TPM)• Standard Hardware Root of Trust• TPM = ISO/IEC 11889• Benefits• Foundation for secure software• Resistant to attacks/hacks• Built-in virtual smart card

• Features• Authentication• Encryption• Attestation
Copyright 2017 Trusted Computing Group

Identity
Integrity
19

Why Hardware?
Software Security is Not Enough

Graph used withpermission ofCapers Jones.

Copyright 2017 Trusted Computing Group20

Who Uses TPM?
• Desktops, Laptops, Tablets, Phones• Financial Services– ATMs– Cash registers– Slot machines• Industrial Control Systems• Cars• Network routers• Gateways• Printers
Copyright 2017 Trusted Computing Group21

Trusted Computing for IoT• TCG standards are used in many IoT devices• Based on this experience, TCG has developed– Common use cases– Framework showing how to use TCG tech
– Implementation guidance– Demonstrations of Trusted Computing in IoT

Copyright 2017 Trusted Computing Group22

Top Questions in IoT Security•Who are you?

•Can I trust you?

•

Can you protect yourself against malware infection?

•

Can you protect yourself against hardware tampering?

•Can you protect data at rest?

•

Can you prepare a device for resale or decommissioning?

•

Can you safely engage in cryptographic protocols?

•

Can you support common models of provisioning?

•

Can you securely maintain evidence?

•Can you be managed easily?

•Can you secure legacy hardware?

Copyright 2017 Trusted Computing Group23

TCG IoT Use Cases• Device Identity• Secure Software and Firmware Updates• Secure Communications• Secure Data Storage• Device Resale and Decommissioning• Device Provisioning• Protecting Against Malware Infection• Maintaining Audit Logs
• Remote Device Management• Securing Legacy Hardware
Copyright 2017 Trusted Computing Group24

TCG Collaborating with IoT Industry• Formal liaison relationship with ETSI, international telecoms
standards body, for work on secure networking protocols• Formal liaison relationship with Mobey Forum to help enable
trusted mobile transactions, etc.
• Working with SAE Vehicle Electrical Hardware Security TaskForce, a sub-committee of the SAE Vehicle Electrical System
Security Committee re auto security requirements andsolutions• Regular input to NIST, NHTSA and other agencies andgovernment groups• Relationships with information assurance agencies worldwide

Copyright 2017 Trusted Computing Group25

IoT Security Resources• TCG IoT Architect’s Guide:
https://trustedcomputinggroup.org/tcg-architectsguides• TCG Guidance for Securing the IoT:
https://trustedcomputinggroup.org/guidancesecuring-iot-using-tcg-technology-referencedocument• 6 ways to Boost IoT Security article:
http://ubm.io/1LahjI4• IoT Security Groundswell article:
http://ubm.io/1K7MOPW• Practical Tips to Securing the IoT article:
http://bit.ly/1K7WUTH

Copyright 2017 Trusted Computing Group26

Industrial Security Resources• TNC IF-MAP Metadata for ICS Security
https://trustedcomputinggroup.org/tnc-if-map-metadataics-security/• Architects Guide: ICS Security Using TNC Technology
https://trustedcomputinggroup.org/architects-guide-icssecurity-using-tnc-technology/• Industrial Internet Security Framework:https://www.iiconsortium.org/IISF.htm• ISA/IEC 62443
https://www.isa.org/isa99/
Copyright 2017 Trusted Computing GroupIISF References TPM

Source: Industrial Internet Security Framework
https://www.iiconsortium.org/IISF.htm
graphics are courtesy of Industrial Internet Consortium

Copyright 2017 Trusted Computing Group28

IEC/ISA 62443 References TPM

Copyright 2017 Trusted Computing Group29

Call to Action

Copyright 2017 Trusted Computing Group30

Call to Action
1. Use Trusted Computing to Secure IoT andIndustrial Systems2. Join TCG and then Industrial Sub Group–https://trustedcomputinggroup.org/membership

3. Help Create Deliverables– Guidance for Securing Industrial Equipment– Platform Firmware Profile
For more information, email
admin@trustedcomputinggroup.org
Copyright 2017 Trusted Computing Group31

Thanks
Q&A？

Copyright 2017 Trusted Computing Group32