How to Build Secure, Highly Reliable
Critical Systems and Networks
for the IoT
Trusted Computing Group
Seminar at IoT SWC 2017©2017 Trusted Computing GroupAgenda0930
10001005
1040
11101135
1200

Check-in, Networking, and Demos
TCG Welcome and Overview
Key Concepts of Trust and Application for IoT Security
A Foundation for Trust in the IoT
Industrial IoT Security: a New TCG Approach
Q&A with the Speakers
Networking and Demos©2017 Trusted Computing GroupTCG Overview

TCG OVERVIEW©2017 Trusted Computing GroupWho is the Trusted Computing Group?
The TrustedComputing Group(TCG) is aninternational
industry standardsgroup focused on
TrustedComputing since
its founding in2003.

• You may know TCG for
our technical specs &guidance such as:– Trusted Platform
Module (TPM 2.0)
– Self Encrypting Drive(SED)– Trusted NetworkCommunications(TNC)©2017 Trusted Computing GroupWhat is a Trusted Platform Module (TPM)?
•Standard Security Module• Supports TPM standards•

Features• Authentication• Encryption• Attestation•

Benefits• Foundation for secure software• Resistant to attacks/hacks• Built-in virtual smart card©2017 Trusted Computing GroupISO/ IEC11889

What is a Self-Encrypting Drive (SED)?
•

Standard Secure Storage Device• Supports SED standards•

Features• Encryption•Works withSCSI and SATABenefits• Always on encryption• No performance impact• Protection against Physical Attacks,loss and theft• Cryptographic instant erase/Wipe©2017 Trusted Computing GroupWhat is Trusted Network Communications (TNC)?
•Security Automation Standards• Features

IETF NEA &SACM• Manage Network Endpoints• Enable New Capabilities•

Benefits• Automation for All Phases ofCybersecurity• Preparation• Detection• Analysis• Response©2017 Trusted Computing Group

KEY CONCEPTS OF TRUST AND
APPLICATION FOR IOT SECURITY©2017 Trusted Computing GroupToday’s Speakers

Steve Hanna
InfineonTechnologies

Monty Wiseman
General ElectricCompany

Lee Wilson
Onboard Security©2017 Trusted Computing Group

Dennis Mattoon
Microsoft

Key Concepts of Trust and Applications
for IoT Security
Steve Hanna, Infineon Technologies
Monty Wiseman, General Electric Company
Lee Wilson OnBoard Security©2017 Trusted Computing GroupA Foundation for Trust in theInternet of Things
Dennis Mattoon, Microsoft©2017 Trusted Computing GroupINTRODUCTION• Today’s cyber-attackers are sophisticated and relentless intheir continual efforts to seek out and exploit
vulnerabilities.
• At the same time, market segments like IoT are driving
architectures and solutions with challenging power,security, resource, and other constraints.

©2017 Trusted Computing GroupINTRODUCTION• To effectively address these challenges a security
architecture must be:••••

Free or very cheap, and not just in BOM cost
Adaptable, with minimal silicon requirements
Scalable to millions of endpoints per solution
Standards-based, i.e., interoperable• And most importantly, it takes a combination of hardware
support and software techniques©2017 Trusted Computing GroupWHY HARDWARE SUPPORT?
• There are problems with software-only solutions• Device Identity• If a bug leads to disclosure of Device Identity secret then how dowe securely (and remotely) recover and re-provision a device?

• Device State and Attestation• Cannot trust software to report its own health• Roots of Trust, data encryption, entropy, etc.
• How do we securely extend trust chain, store keys, etc.?
©2017 Trusted Computing GroupBEWARE SIMPLISTIC HW SOLUTIONS• Why not just store Device Identity key/secrets in fuses?
• If malware can manage to read the fused key then you are nobetter off than with a software-based key• TPMs are great but, especially in IoT solutions, systems
and components probably won’t have TPMs or similarsilicon-based capabilities (cost, complexity, physical spaceon the MCU/SoC)• We need something different©2017 Trusted Computing GroupDICE AND RIOT
• Device Identifier Composition Engine (DICE, TCG)
• Robust, Resilient, Recoverable IoT (RIoT, MSFT)• New specification from the Root of Trust for Measurement subgroupin the Trusted Computing Group (TCG)• Foundational security for IoT at near zero cost
• Simple hardware requirements mean DICE is adaptable to most anysystem or component• Provides HW-based identity and attestation, and a foundation forsealing, data integrity, device recovery and update©2017 Trusted Computing Group

THE DICE MODEL• In a DICE Architecture device startup (boot) is layered• Beginning with a Unique Device Secret (UDS), secrets/keys
are created that are unique to the device and each layerand configuration• This derivation method means that if different code orconfiguration is booted, secrets are different• If a vulnerability exists and a secret is disclosed, patching
the code automatically re-keys the device©2017 Trusted Computing Group

THE DICE MODEL

DICE Architecture

DeviceFirmwareBoot Loader
CPUHSM

Fuse/NV-key

OS Loader, OS, Apps…

Boot steps / time

Boot steps / time

Traditional Security
Processor©2017 Trusted Computing Group

Keys and Certificates for Device
Identity, Attestation, sealing, etc.

RIoT Core
Compound Device Identity

HW/SoC
Fuse/NV-key

THE DICE MODEL••••PowerOn

Power-on (reset) unconditionally starts the DICE
DICE has exclusive access to the UDS
Each layer computes the secret for next layer (via OWF)
In this derivation chain, each layer must protect the secret it receives
DICELayer 0Layer 1

UniqueDeviceSecretSecret 0

Secret 1©2017 Trusted Computing Group…

Layer nSecret n

WHEN SOMETHING CHANGES• The branch illustrates the result of a code/config change
DICELayer 0Layer 1

UniqueDeviceSecretSecret 0

Secret 1• Updates provide a way torecover a device or component
if bad code leaks a secret.

Layer 1’PowerOn©2017 Trusted Computing Group

Secret 1’…

Layer nSecret n…

Layer nSecret n’

A DICE ARCHITECTURE (RIOT)
••

•

•

Underlying architecture for HW-based
Device Identity and Attestation (Azure)
DeviceID – Stable and well protectedlong term identifier for a device orcomponent
Alias Key – Derived from combinationof unique device identity (HW) andidentity of Device Firmware (SW)Integrates DICE-enabled HW withexisting infrastructure©2017 Trusted Computing GroupBUT THAT’S JUST ONE EXAMPLE• We can build on DICE to enable many high-value scenarios• Secure remote device recovery (Cyber Resilient Platform Initiative)••

Recover unresponsive (i.e., p0wned, hung, etc.) devices
Greatly reduced cost: no need for physical device interaction• Supply chain management••

Several recent damaging cyber-attacks were the result of malware
introduced in the supply chain
DICE attestation lets end-customers trust far less of the supply-chain,e.g., just the storage-subsystem or flash vendor• Component identity, authenticity, licensing, and many more©2017 Trusted Computing GroupDICE TAKEAWAYS• Flexible security framework, not one size fits all• Minimal silicon requirements, low barrier to entry• Foundation for strong cryptographic HW-based device identity andattestation, data at rest protection (sealing), and secure device
update and recovery• Public announcements from SoC, MCU, and flash memory vendors so
far with more on the way• Represents the ongoing work of the DICE Architectures Workgroup(DiceArch WG) in TCG. Come join us!
©2017 Trusted Computing Group23

REFERENCES•••••

Device Identifier Composition Engine (DICE) specification
DICE Architectures Workgroup (TCG)
RIoT – A Foundation for Trust in the Internet of Things
Cyber-Resilient Platform Initiative
Partners and Demos:•••

Microchip CEC1702 and SecureIoT1702
Micron Authenta••

Sequitur Labs (i.MX6, SAMA5D2)
STMicroelectronics (STM32L4xx)

Azure IoT:••

Strengthening IoT Security
Zero-Touch Provisioning with Azure IoT©2017 Trusted Computing Group24

Industrial IoT Security:
Overview of a New TCG Approach
Monty Wiseman, General Electric Company©2017 Trusted Computing GroupAgenda• Introduction to Industrial Security• TCG and Industrial Security Today• New Industrial Sub Group• Call to Action©2017 Trusted Computing Group

26

IoT Attacks Growing©2017 Trusted Computing Group27

Introduction to Industrial Security©2017 Trusted Computing Group28

Industrial Automation
Architecture©2017 Trusted Computing GroupIndustrial IoT Brings Changes
Smart Factories / Industrial IoT / Industry 4.0› "Lot size 1": Ability to produce highly individualized products› Cloud analysis: Enabling data mining, deep learning and cost reduction› Predictive maintenance: Based on sensor data gathered and analyzed as big data

Implications› Greater communication within the plant and beyond› Reconfigurable, smart manufacturing equipment› New business models and opportunities› New security risks©2017 Trusted Computing GroupSecurity Effects of Industrial IoT
New security paradigms› "Closed shop floor" paradigm not applicable anymore› Security risks touch all machines with greater potential impact› Industrial security is becoming part of corporate strategies

Implications› Strong protection required› Availability has higher priority than Confidential or Integrity› System-wide security approach required©2017 Trusted Computing GroupIndustrial IoT Countermeasures

Source: Industrial Internet Security Framework
https://www.iiconsortium.org/IISF.htm
graphics are courtesy of Industrial Internet Consortium©2017 Trusted Computing GroupTCG and Industrial Security Today©2017 Trusted Computing GroupTCG Industrial IoT Security Resources•

TCG IoT Architect’s Guide: http://bit.ly/1RzLRa6•

TCG Guidance for Securing IoT: http://bit.ly/2f8RYkK•

TNC IF-MAP Metadata for ICS Security
https://trustedcomputinggroup.org/tnc-if-map-metadata-ics-security/•Architects Guide: ICS Security Using TNC Technology
https://trustedcomputinggroup.org/architects-guide-ics-security-using-tnctechnology/•Industrial Internet Security Framework: https://www.iiconsortium.org/IISF.htm©2017 Trusted Computing GroupIndustrial Internet Consortium’s IISF
References TPM

Source: Industrial Internet SecurityFramework
https://www.iiconsortium.org/IISF.htm
graphics are courtesy of Industrial InternetConsortium©2017 Trusted Computing GroupIEC/ISA 62443 References TPM©2017 Trusted Computing GroupTCG’s New Industrial Sub Group©2017 Trusted Computing GroupPurpose of Industrial SG••

Provide specifications and guidance to implementers and users regarding the use ofTrusted Computing technologies for Industrial applicationsDeliver:– Reference Documents• Guidance, …

– TCG Specifications• Industrial Platform Firmware Profile,• TPM Profile?,• …

– Marketing and Educational Materials• Architects Guides• Webinars©2017 Trusted Computing GroupWhich TCG Technologies?
• TPM
• TNC
• OPAL• Etc.

©2017 Trusted Computing GroupCall to Action
1. Join TCG and then Industrial Sub Group–https://trustedcomputinggroup.org/membership

2. Help Create Deliverables– Guidance for Securing Industrial Equipment– Platform Firmware Profile

For more information, email
admin@trustedcomputinggroup.org©2017 Trusted Computing GroupQ&A with Our Speakers

Steve Hanna
InfineonTechnologies

Monty Wiseman
General ElectricCompany

Lee Wilson
Onboard Security©2017 Trusted Computing GroupDennis Mattoon
Microsoft

Networking and Demos with©2017 Trusted Computing GroupThank You For Joining Us Today
Learn More at
www.trustedcomputinggroup.org©2017 Trusted Computing Group