Smart Industry 1/2017

efore and after it. This means the
data needs to be decrypted and reencrypted
every step of the way.
It is often said that the security level
of an entire system depends on its
weakest link. Since a lot of outside
vendors and suppliers are involved,
like connectivity providers and gateway
manufacturers, the number of
possible weak points begins to rise
exponentially.
So how about adding an extra layer
of strong device-to-server security,
over a LAN, a WAN and IP? It sounds
very interesting but it also sounds
rather complex.
We need a simple – and cheap –
solution. Avnet Silica has devised a
way to provide personalization and
provisioning services to every single
device in the supply chain quickly,
efficiently and, above all, at less cost
than ever before.
Before examining Avnet's solution,
let’s ask ourselves what a typical task
involves? Let’s say your mission is to
deliver a ‘Top Secret’ predictive maintenance
message from your device,
a robot, securely over the internet to
a target server in the robot’s production
factory. Connected objects talk
to servers through the internet but
the problem is that your message is
usually decrypted and encrypted a
few times on its journey. Remember,
the transmission has always to be
highly secure.
The challenge is to secure this supply
chain with HTTPS featuring transport
layer security (TLS). This calls for
a complex security system. First, you
need someone trustworthy to do
the certificate management so the
objects can encode messages with
unique IDs and keys that can only be
decrypted with specific certificates.
The robot and the target server now
each have their own unique, very
secret private key. The robot sends
its certificate to the server to authenticate
itself. The server tells the Key
Management System to check the
certificate to make sure it really
comes from the robot.
If the certificate is okay, the server
then sends its own certificate to the
robot, which checks it in turn. Next,
the robot and the server generate a
session key from the certificates and
their private keys.
Finally, the message is encrypted
with this unique session key and is
sent to the server. As the server has
generated the same session key, it can
decrypt the message and read it.
So far so good! But it’s not quite as
easy as it looks because it’s still not
really safe. You have first to make sure
the key management and certificate
are tightly secured and for this we
need:
• a Hardware Security Module (HSM)
to generate keys for access only
• servers and firewalls for communication
with the outside world
• a virtual fortress with thick walls,
safety steel doors and armed guards
to keep the HSM safe.
You’ve guarded your HSM, but the
robot still needs to be secured. This
means another HSM, a firewall and a
personalized secure element, or MCU,
containing a certified microcontroller
and embedded software.
And you still need more! You also
have to provision your server with
keys and certificates and codes to
establish end-to-end security.
To build all these elements from
scratch and ensure a really secure
transaction would probably require
a couple of million euros – even for a
very small installation.
The Avnet initiative
Avnet Silica has developed a unique
solution to cut time and cost from
this complicated process. In May
2016, we introduced a competitive
service business model to simplify
access to this technology through
our advanced logistics facility at
our German headquarters in Poing,
near Munich.
Here, secure microcontrollers are
programmed by the Avnet Silica
staff using firmware supplied by our
partner Trusted Objects – adding a
new set of functions and commands
tailored to the exact requirements
of the customer’s final application
and global security architecture.
To build this
from scratch
would cost you
many millions
even for a small
installation
Objects you can trust:
At Avnet's Advanced
Logistics facility in Poing
near Munich, engineers
routinely program secure
microprocessors .
The resulting microcontroller is
programmed as a secure element to
execute cryptographic primitives and
complex functions. These comprise
AES, ECC encryption, decryption,
signature, secure key renewal, onboard
key generation, true random
number generation, handling of
certificates, and much more – while
never exposing secret keys to the
outside world.
This fortified warehouse is capable
of personalizing secure elements,
in small to large volumes, in order
to meet the needs of any customer
project. In this way, Avnet Silica and
its partners enable customers to
benefit from the depth and breadth
of their expertise to address personalization
and security for IoT projects.
We are currently developing our
own stacks and APIs which will be
able to handle TLS derivatives, and
easy-provisioning schemes running
on various radio links, a service we
will offer together with UbiquiOS
Technology and Avnet Services.
Finally, Avnet Silica is establishing
certification authority services with
a trusted partner for customers who
wouldn't wish to invest in a full public
key infrastructure themselves.
Personalization and securely provisioning
devices to servers end-to-end
are the best, and by far the simplest,
way to secure the Internet of Things.
And we at Avnet Silica can help you
make it happen.
91