Atmel Crypto Elements Atmel Corporation

Transcription

1 Atmel Crypto Elements Atmel Corporation

2 What about Security Atmel Corporation

3 Security Attacks in the News Can Atmel Help? YES! LIFX: Networked LED lamps betrayed Wi-Fi passwords 07/22/2014 Irina Hübner With the Internet of Things, completely new security issues that are grossly underestimated result.now it have white-hat hackers managed to identify the wireless key on networked LED lamps. security researchers have attacked the context of smart LED lamps of the US manufacturer LIFX. These can be switched on and off using a smartphone or tablet. In addition, the color and brightness on the mobile devices can be controlled. The LED lamps communicate with each other over 6LoWPAN and shall provide about each other's Wi-Fi access. Although they use the AES algorithm to encrypt the passwords. However, the key underlying is never changed, thereby making it attackers easy to figure out the desired data. To decrypt the wireless access, the so-called white-hat hackers had neither authenticated nor was noticed their presence on the network ktronik%2fledlighting%2fartikel%2f111302%2f&sandbox= Atmel Corporation

4 Internet as a Top Security Concern Heartbleed, Shellcock, Poodle, Anthem What s next? Shodan: The Scariest Search Engine on the Internet By David 1:41 p.m. ET April 8, 2015 Shodan navigates the Internet's back channels. It runs 24/7 and collects information on about 500 million connected devices and services each month. Countless traffic lights, security cameras, home automation devices & heating systems, connected to the Internet & easy to spot. Shodan searchers have found control systems for a water park, a gas station, a hotel wine cooler and a crematorium. Cybersecurity researchers have even located command and control systems for nuclear power plants and a particle-accelerating cyclotron by using Shodan. The biggest risk to a successful proliferation of IoT Edge Nodes is how much thinking, effort and resources developers are willing to invest in security when they define and design their product Atmel Corporation

5 Atmel Corporation

6 Atmel Corporation

7 Rogue software can see into memory. So, don t put important things there! Atmel Corporation

8 Atmel Corporation

9 Microprobers are Easy to Find Can purchase used equipment readily Doesn t require any special support use it in your kitchen Typically easy to run wires from working system to prober Atmel Corporation

10 Questions Do you see Copy's for YOUR product, batteries, consumables, extension boards on the market? Is YOUR brand / brand name important for you? Is YOUR product connected and able for Firmware upgrades? Do YOU want to prevent modifications of your Firmware. Do YOU trust a connected node e.g. sensor? Atmel Corporation

11 SmartConnect Security Messaging 4 major angles tackling IoT Security concerns Data-Link IP-Transport Service HW Key Storage Protection on the Wireless network Authenticate & Encrypt all wireless and IP packets. Local bad guy unlocks your front door from a van parked outside Protection on the Internet Authenticate & Encrypt contents of IP packets Internet bad guy unlocks your front door from North Dakota Protection of corporatelevel services Authenticate & Encrypt device identity and service. Bad guy spoofs software download to install software that leaves the front door unlocked. Protection from physically present hackers Hacker reads the keys off the physically present device, then inserts keys into the Device Identity, Data-Link, or IP-Transport protocol. Bad guy unlocks your front door while standing at the door. Security is only as strong as the weakest link Atmel Corporation

12 SmartConnect IoT Layered Security Solutions Offering best in Class Security for IoT Edge Nodes Layer 7: Application Layer 6: Presentation Layer 5: Session Layer 4: Transport Layer 3: Network Wi-Fi APPLICATION HOMEKIT, OIC, HTTP, FTP, SMTP, SNMP, TLS/SSL TCP/UDP IP, ARP, DHCP Security Level CryptoAuthentication -> Storage of Keys / Certificates On-Chip (WINC1500) TLS 1.0 (SSL) -> Ensures Data Encryption Coming out of the LAN, also Known as Internet Security Layer 2: Link Layer 1: Physical Atmel Corporation b/g/n On-Chip (WINC1500) WEP, WPS, WPA2 Personal WPA2 Enterprise -> Ensures Data Encryption within the LAN to avoid intrusion

13 SmartConnect IoT Layered Security Solutions Offering best in Class Security for IoT Edge Nodes Layer 7: Application Layer 6: Presentation Layer 5: Session Layer 4: Transport Layer 3: Network Layer 2: Data Link Layer 1: Physical 6LoWPAN / Thread APPLICATION CoAP, MQTT, Etc,.. UDP + DTLS TCP + TLS (not in Thread) IP 6LoWPAN (Thread) ContikiMAC Security Level CryptoAuthentication -> Authentication used for Anti-cloning, Ecosystem Management, Storage of Keys/Certificates On-Chip, HW/SW, mandatory (in Thread) DTLS 1.2 (EC-JPAKE) -> Authentication and key provisioning, Security outside of WPAN On-Chip, HW, mandatory AES-128 -> Basic Frame encryption Atmel Corporation

14 SmartConnect IoT Layered Security Solutions Offering best in Class Security for IoT Edge Nodes Layer 7: Application Layer 6: Presentation ZigBee APPLICATION ZCL Security Level CryptoAuthentication ATECC508A bundled -> Authentication Key Storage Layer 5: Session Layer 4: Transport Layer 3: Network ZigBee PRO On-Chip, HW, optional AES-128 On-Chip, HW, mandatory AES-128 Layer 2: Data Link Layer 1: Physical Atmel Corporation

15 SmartConnect IoT Layered Security Solutions Offering best in Class Security for IoT Edge Nodes Bluetooth SMART Security Level Layer 7: Application Application CryptoAuthentication ATECC508A bundled Layer 6: Presentation -> Authentication Key Storage Layer 5: Session Layer 4: Transport Layer 3: Network Layer 2: Data Link GAP SMP L2CAP GATT ATT Advanced Comm. Security BLE4.2 -> Enables Secure Connections -> Authentication with Key exchange. -> Association mode: Numeric Comparison HCI Link Layer Link Layer security BLE 4.X Layer 1: Physical Atmel Corporation Baseband + Radio -> Ensures Data Encryption within the Link to avoid intrusion -> Association mode: Just works, Passkey entry, Out of Band

16 Crypto Authentication and TPM Crypto elements with protected, hardware-based key storage work with any MCU to provide Confidentiality, data Integrity, & Authentication ECDSA Asymmetric ECDH Key Agreement supporting advanced algorithms SHA Symmetric Atmel Corporation Atmel Product Presentation - Q3 2015

17 Covering a wide range of applications To harden security at multiple layers Certified Hardware Requirements Access Point Security Gateway / Server / PC... MPU / TPM Gateway / POS Secure MPU Secur e MPU Connected Nodes Gateway / Server MPU / Connected Node Transport Layer Security MCU / MPU Wireless ATECC508A Accessories & Disposables Application Layer Security Challenge Response ATECC108A, ATECC508A, ATSHA204A, & ATAES132A Atmel Corporation Atmel Product Presentation - Q3 2015

18 Crypto Architecture Optimized for high security, ease-of-use and low cost Attackers cannot see what s inside Tamper-hardened Hardware Boundary Isolates any attack to a single device Standards based crypto engine between interface and memory ECC / SHA /AES Cryptographic Engine Unique Serial Number Monotonic Counters Secured EEPROM for keys & data Secured EEPROM High Quality Random Number Generator Tracks number of authentications I/O options simplify design in Multiple Serial I/O options Required for every crypto protocol Atmel Corporation

19 Hardware Security Features Strong Multi-Level HW Security: Active shield over entire chip All memories internally encrypted Data independent crypto execution Randomized math operations Internal state consistency checking Voltage tampers, isolated power rail Internal clock generation Secure test methods, no JTAG No debug probe points, no test pads No package or die identification Designed to Defend Against: Microprobe attacks Timing attacks Emissions attacks Faults, invalid command attacks Power cycling, clock glitches Partial personalization attacks ATMEL CryptoAuthentication Standard Devices Cannot achieve this level of security with software alone! Atmel Corporation

20 Portfolio with Complete Algorithm & Feature Mix High Security for Every Application, Use Case, Requirement ATSHA204A (SHA256-based Authentication) 4.5K bits secured storage (16 slots) Optimized for keys, secrets and configuration storage Very cost efficient ATECC108A (Asymmetric-key Authentication) No secrets in host more flexible usage 10K bits secured storage (16 slots) Well accepted from industrial customers Encryption Cryptographic Algorithms Hash ATAES132A(AES Authentication & Encryption) 32K bits secured storage (16 zones) Optimized for data storage, but includes 16 keys Examples: code, firmware, and biometric data ATECC Automotive ATECC108 automotive qualified version (development) Asymmetric- Key Symmetric- Key TPM AT97SC3204xxx & AT97SC3205xxx (Trusted Platform Module) In line to the TCG spec used in the PC world and more and more in the industrial world FIPS certified & CC EAL 4+ pending LPC, I2C & SPI available Atmel Corporation

21 7things you were not told about IoT 1. IoT will expose the difference between Smart devices and flat-out dumb. M2M vs. IoT. (Be aware of false starts) 2. Your new IoT product is DOA (Homekit?, OIC/All seen?, Thread? Others?) 3. One size does not fit all 4. Can you solve the HW puzzle? 5. Forget Big data, its all about small data now 6. Security: You get what you pay for 7. Scalability. IPV Atmel Corporation 06/05/2015

22 2012 Atmel Corporation. All rights reserved. Atmel, Atmel logo and combinations thereof, Enabling Unlimited Possibilities, and others are registered trademarks or trademarks of Atmel Corporation or its subsidiaries. Other terms and product names may be trademarks of others. Disclaimer: The information in this document is provided in connection with Atmel products. No license, express or implied, by estoppel or otherwise, to any intellectual property right is granted by this document or in connection with the sale of Atmel products. EXCEPT AS SET FORTH IN THE ATMEL TERMS AND CONDITIONS OF SALES LOCATED ON THE ATMEL WEBSITE, ATMEL ASSUMES NO LIABILITY WHATSOEVER AND DISCLAIMS ANY EXPRESS, IMPLIED OR STATUTORY WARRANTY RELATING TO ITS PRODUCTS INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT. IN NO EVENT SHALL ATMEL BE LIABLE FOR ANY DIRECT, INDIRECT, CONSEQUENTIAL, PUNITIVE, SPECIAL OR INCIDENTAL DAMAGES (INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS AND PROFITS, BUSINESS INTERRUPTION, OR LOSS OF INFORMATION) ARISING OUT OF THE USE OR INABILITY TO USE THIS DOCUMENT, EVEN IF ATMEL HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. Atmel makes no representations or warranties with respect to the accuracy or completeness of the contents of this document and reserves the right to make changes to specifications and products descriptions at any time without notice. Atmel does not make any commitment to update the information contained herein. Unless specifically provided otherwise, Atmel products are not suitable for, and shall not be used in, automotive applications. Atmel products are not intended, authorized, or warranted for use as components in applications intended to support or sustain life Copyright Atmel Corporation