Building secure devices on the intelligent edge with Azure Sphere. Paul Foster, Microsoft Dr Hassan Harb, E.On

Transcription

1 Building secure devices on the intelligent edge with Azure Sphere Paul Foster, Microsoft Dr Hassan Harb, E.On

2 Microcontrollers (MCUs) low-cost, single chip computers 9 BILLION new MCU devices built and deployed every year

3 Radio 2.4GHz WiFi MCU 192Mhz Cortex-M4 256KB SRAM 1MB NOR FLASH GPIO, I2C, I2S, etc. RTOS (no kernel)

4 Connected devices create profoundly better customer experiences. How does a consumer know the compressor in their fridge needs to be replaced? Option 1 Melted ice cream Option 2 Predictive maintenance

5 Mirai Botnet attack Everyday devices are used to launch an attack that takes down the internet for a day

6 SECURITY IS FOUNDATIONAL It must be built in from the beginning.

7 The 7 properties of highly secured devices Hardware Root of Trust Defense in Depth Small Trusted Computing Base Dynamic Compartments Certificate-Based Authentication Failure Reporting Renewable Security

8 Some properties depend only on hardware support Hardware Root of Trust Hardware Root of Trust Unforgeable cryptographic keys generated and protected by hardware Hardware to protect Device Identity Hardware to Secure Boot Hardware to attest System Integrity

9 Some properties depend on hardware and software Defense in Depth Dynamic Compartments Small Trusted Computing Base Dynamic Compartments Internal barriers limit the reach of any single failure Hardware to Create Barriers Software to Create Compartments

10 Some properties depend on hardware, software and cloud Certificate-Based Authentication Failure Reporting Renewable Security Renewable Security Device security renewed to overcome evolving threats Cloud to Provide Updates Software to Apply Updates Hardware to Prevent Rollbacks

11 Azure Sphere is an end-to-end solution for securing MCU powered devices The Azure Sphere OS with ongoing updates creates a Microsoft-secured software platform Azure Sphere certified MCUs, from our silicon partners, with built-in Microsoft hardware root of trust. The Azure Sphere Security Service guards every Azure Sphere device. It brokers trust, detects emerging threats, and renews device security.

12 Azure Sphere certified MCUs create a secured root of trust for connected, intelligence edge devices C O N N E C T E D with built-in networking S E C U R E D with built-in Microsoft silicon security technology including the Pluton Security Subsystem C R O S S O V E R Cortex-A processing power brought to MCUs for the first time Microsoft Pluton Security Subsystem Firewall ARM Cortex-A optimized for low power FLASH 4MB Firewall SRAM 4MB Network Connection WiFi in first chips Firewall ARM Cortex-M for real time processing C R O S S O V E R Cortex-A processing power brought to MCUs for the first time Firewall Firewall Multiplexed I/O Firewall GPIO PWM TDM I2S UART I2C SPI ADC

13 Azure Sphere MCUs create a secured root of trust for connected, intelligence edge devices Pluton features implemented in silicon include A hardware root of trust that -accelerates common cryptographic operations (ECC and AES) -generates public/private keypairs -implements secure boot (via ECDSA) A dedicated core and memory (TCM) that -resists side-channel attacks that focus on a single core A true random number generator that -defends against low-entropy attacks Measured boot and remote attestation that -uses a digest accumulator register and nonce register

14 Our Silicon Partners

15 The Azure Sphere OS is optimized for IoT, security, and agility Secure Application Containers Compartmentalize code for agility, robustness & security On-chip Cloud Services Provide update, authentication, and connectivity Custom Linux kernel Empowers agile silicon evolution and reuse of code Security Monitor Guards integrity and access to critical resources OS Layer 4 OS Layer 3 OS Layer 2 OS Layer 1 Azure Sphere OS Architecture App Containers for POSIX (on Cortex-A) On-chip Cloud Services HLOS Kernel Security Monitor App Containers for I/O (on Cortex-Ms) Hardware Azure Sphere MCUs

16 SIDE BAR Application platform Cortex-A App runs in Normal World user mode GPIO, UART and other interfaces Communicate with Azure IoT Hub or other clouds Microsoft provides all but app All signed by the Microsoft CA App updates delivered by Microsoft secure pipeline Sideloading during development Manifest file defines capabilities

17 The Azure Sphere Security Service connects and protects every Azure Sphere device OS updates from Microsoft Your app updates Protects your devices and your customers with certificate-based authentication of all communication Azure Detects emerging security threats through automated processing of on-device failures Responds to threats with fully automated on-device updates of OS App and Allows for easy deployment of software OS updates to Azure Sphere powered devices Remote attestation & cert based authentication Azure Sphere Security Service Online app and OS failure reports App data and telemetry Other cloud or on-prem infrastructure App data and telemetry

18 SIDE BAR Azure Sphere scenario Azure DPS

19 Modernize MCU development with Azure Sphere and Visual Studio Simplify development Focus your device development effort on the value you want to create Streamline debugging Experience interactive, context-aware debugging across device and cloud Collaborate across your team Apply tool-assisted collaboration across your entire development organization

20 Demo

21 SIDE BAR Deployment basics SKUs Components and applications Image and Image sets Feeds Device groups

22 Three components. One low price. No subscription required. An Azure Sphere certified MCU The Azure Sphere OS with ongoing on-device OS updates The Azure Sphere Security Service with ongoing on-device security updates

23 en to any MCU manufacturer are licensing our Pluton security subsystem royalty e for use in any chip* Azure Sphere is open en to any innovation U manufacturers are free to innovate with our L d OSS Linux kernel code base en to any cloud ure Sphere devices are free to connect to Azure or any er cloud, proprietary or public for application data

24 Home Energy Management System Hassan Harb #FutureDecoded, London, November 1 st

25 E.ON at a glance 31m customers ~500k connected energy assets ~1m km power grids

26 Trends in the energy sector Decarbonization Decentralization Electrification

27 Trends in the energy sector Decarbonization Decentralization Electrification IoT

28 Internet of energy: Security risk Decarbonization Decentralization Electrification IoT

29 in Mtoe Challenges: Increasing electricity consumption Industry Residential Residential (extrap.) Based on Key world energy statistics 2018 OECD/IEA 2018, Licence: as modified by E.ON Solutions GmbH

30 Challenges: Discrepancy between local generation and consumption PV generation Demand t

31

32 HEMS on azure IoT sphere HEMS edge intelligence

33 HEMS in action: Increase self-sufficiency through load shifting Storage management PV generation Demand modification Demand t

34 Thank you!

35 Get started with Azure Sphere today. Public Preview availability Azure Sphere OS Azure Sphere Security Service Visual Studio tools for Azure Sphere Available Now Azure Sphere development kits from Seeed studios For more information visit:

36 Let s secure the future.

37 Things to do next Session Feedback Please rate this session in the Future Decoded app! Microsoft UK AI Research Report Download the AI Report at Visit our Hands-on Labs on Level 3 Try technology out with on-demand labs and expert help Go deep with Documentation

38 aka.ms/ignitetourlnd