## 4 Intelligent Sensors Model for IT Security Development Process
Peripheral transducers (sensors, control devices) can be connected through I/O subsystems. The SPI and I\({}^{2}\)C interfaces can be used for external coprocessor or memory (EPROM, FLASH) connection. The above mentioned FT 5000 transceiver, connected to the Neuron communication subsystem, is designed for the polarity-insensitive, free-topology, twisted-pair LonWorks networks. Each chip has a unique 48-bit identification number, called Neuron ID. Related Neuron firmware provides implementation of the LonTalk(r) protocol for LonWorks networks, developed by Echelon for years. The review shows that intelligent sensors have similar architecture. Analyzing these selected solutions, a general model has been elaborated. The model serves as a reference model for the devices discussed here. Sometimes refined, it can be used to prepare the -FOE description\" being a part of the security target specification, to define the security problem and to propose its solution. The level of details should be adequate to perform these tasks - a block scheme level is usually enough. A simplified, generalized sensor model, co-operating with the sensor network and elaborated on the basis of the above examples, consists of four-key elements (Figure 1):  
* microcontroller, equipped with a specialized operating system, communication and application software, different devices, such as memories, including non-volatile memories, interfaces, timers,counters, sometimes other coprocessors (e.g., crypto-processors, network processors and other specialized processors), interfaces to external memories, and other devices (I\({}^{2}\)C, SPI),
* low-power transducers (varied sensing/controlling devices),
* communication facilities, including low-power wireless facilities or traditional/industrial network interfaces (wired, optical facilities),
* power source (battery, solar, external sources). The intelligent sensor is able to perform some processing tasks to sample information and to communicate with other connected nodes in the network. Restricted sensor resources (related to processing, transmission, energy) limit its capability. The general model should be able to express the TOE user functionality and the essential parts of the TOE with respect to security issues, such as: what is a part of the TOE and what is a part of the TOE environment, connections with co-operating entities, logical and physical TOE boundaries, _etc_. These issues are important when the above mentioned TOE overview and TOE description sections of the security target are developed. Moreover, the general model should contain details sufficient to identify protected assets (where they are, who their owners are), affecting intruders, entities co-operating with the TOE, threats, and certain assumptions (e.g., dealing with the connectivity aspects). These issues are considered during further discussed security problem definition and solution. Depending on the project character, the TOE may encompass almost all elements from Figure 1, or only its selected parts, e.g., the TOE may be a -microcontroller without coprocessor\", -(cryptographic) coprocessor of the microcontroller\", -communication software\" or -application which processes, in the microcontroller, the data sampled by the sensor\", _etc_. Different solutions for different applications are possible. Analyzing the security of a given sensor node as the TOE, some details can be added, e.g., those from the above reviewed solutions. Figure 1: Generalized model of the intelligent sensor used for security analyses during the IT security development process.