Securing IoT devices from within
Connecting state and local government leaders
To ensure mutual authentication, a new solution uses a small chip that is preloaded with unique cryptographic codes to allow data to be transmitted more securely from an IoT device to the cloud.
Security experts have long fretted about the rapidly expanding number of internet of things devices. While most such tools may not contain data that should be protected, many connect to the cloud and represent easy targets for hackers to gain access -- not only to that device, but to all other devices connected to an IoT mesh.
To address this issue, AWS in 2015 released its IoT platform, which includes provisions for mutual authentication – which is intended to verify the integrity of all devices connecting to the AWS IoT cloud.
Connecting devices can use the AWS SigV4 method of authentication or follow the traditional approach of using X.509 certificates to manage public-key encryption. IoT managers can map roles and/or policies to each certificate so that devices or applications can be authorized (or de-authorized) without ever touching the device.
As might be expected, an organization with thousands of IoT-enabled devices might find it too difficult to provision and manage all those certificates and keys. One solution is the AWS the “Use Your Own Certificate” program, which allows original equipment manufacturers to register digital certificates signed by a third-party authorities with the AWS IoT platform using an application programming interface, according to Embedded Computing.
That means “unique cryptographic keys can be generated for each device during production, signed by a certificate authority … and then loaded into the AWS IoT platform to await a service request from systems containing the corresponding key pairs,” the site said.
A hardware solution that offers built-in end-to-end security between the device and cloud servers has been developed by Microchip Technology Inc. and AWS.
It uses a small chip that is preloaded with the unique cryptographic codes to allow data to be transmitted more securely from an IoT device to the cloud.
According to Eustace Asanghanwa, strategic marketing manager for Microchip Technology, the AWS-ECC508 chip eliminates the need for IoT device manufacturers to go through a multistep process of preregistering their device with AWS servers and generating encryption keys for communications. Instead, the AWS-ECC508, a 3mm by 2mm, 60-cent device (in quantities of 10,000 or more) handles the connection and encryption automatically.
The device can be soldered onto a circuit board and connected to the host microcontroller that configures the chip for the AWS IoT. Because the AWS-ECC508 is preconfigured to be recognized by AWS without any intervention, there is no need to load unique keys and certificates because the information is contained in a small, easy to deploy “crypto companion device,” the company said.
Unlike the RSA encryption algorithm in widespread use, the Microchip Technology processor employs a more efficient elliptic curve cryptography algorithm that does require as big a key and is, therefore, faster and calls for less hardware.
According to Asanghanwa, IoT device manufacturers have often not paid sufficient attention to building security into their devices because of an overriding focus on keeping costs down.
“Looking at the product holistically, the AWS-ECC508 actually reduces overall cost,” he said. “If you consider not just hardware but also implementation, such as the capital and operational costs of securely injecting keys and managing them in a supply chain, the AWS-ECC508 actually creates a significant cost-reduction for any given product.”
While the AWS-ECC508 will only work with Amazon Cloud Services, the underlying ECC508 technology can be configured to work with any storage or cloud vendor’s services.