Using the tpm with iot

Size: px

Start display at page:

Download "Using the tpm with iot"

Alaina Pope
5 years ago
Views:

1 Using the tpm with iot David Grawrock Security Architect, Senior Principle Engineer

2 Agenda History Lesson What Does IoT Need How Does The Fulfill Needs Usage IoT Security 2

meeting in England, 2003 I was the TCG liaison to ISO SC27 to get

3 History Worked on the from 1999 through 2007 as Workgroup Chair and Technical Committee Vice-Chair These pictures are from a workgroup meeting in England, 2003 I was the TCG liaison to ISO SC27 to get the specification as an ISO standard (we were successful) IoT Security 3

Basic Functionality Root of Trust for Reporting (RTR) Enabling attestation Root of Trust for Storage (RTS) Enabling protected storage Platform adds Root of Trust

4 Basic Functionality Root of Trust for Reporting (RTR) Enabling attestation Root of Trust for Storage (RTS) Enabling protected storage Platform adds Root of Trust for Measurement (RTM) Enabling attestation and protected storage Isolated execution environment Mitigate attempts to manipulate keys and operations IoT Security 4

5 What Does IoT Need IoT Security 5

6 Ecosystem Sensor Gateway Network Simple goal, get data from sensor, send it up to analytics and then do something based on that analysis Management Analytics Does the ecosystem enable end to end security? IoT Security 6

7 IT/ Business Systems Vertical IoT Apps Ecosystem Details Illustration only, not for deep discussion On-Premise or Off-Premise Data Center or Cloud Sensor I/O WiFi + LP WiFi Bluetooth + BTLE 3G/4G/LTE (GPRS) ZigBee, Zwave 6LoWPAN WiHART Ethernet RFID 3 rd Party Cloud Data Transport Broker Data Ingestion & Processing Persistence & Concurrency Query Business Logic & Rules Sensor Sensor Actuator Sensor Actuator I/O MCU MCU U I/O P A L Gateway U P A L Gateway Device Attestation Network Infrastructure Device Attestation Security, Configuration & Management Asset Info, Policies & Metadata Storage Compute Analytics Services Orchestration APIs, API Libraries, SDK Business Portal U P A L Universal Protocol Abstraction Layer Data Center Management & Security (Monitoring, Auto-scaling, Logging, Eventing) Data Flow: MQTT, HTTPS, WebSockets, XMPP, CoAP, REST, AMQP, DDS, et al. Security & Mgmt Flow: MQTT, EPID, OMA-DM, TR-069, REST, et al. All compute devices have Identity Protection (EPID), Secure Boot, Smart Object ID, etc. IoT Security 7

8 Basic Questions for IoT What device are you Related is what are the device properties What is the software stack What is the execution environment Is there protected storage on the device Key material at a minimum Is there a Trusted Execution Environment Questions apply to any device in the ecosystem Mitigate software attacks, hopefully mitigate hardware attacks IoT Security 8

9 How Does the Fulfill the Needs IoT Security 9

What Device Are You Identifying the device enables analytics, operations, and management Can t rely on data or send commands to unknown device provides identity Can be fixed with

10 What Device Are You Identifying the device enables analytics, operations, and management Can t rely on data or send commands to unknown device provides identity Can be fixed with Endorsement Key (EK), anonymous with Attestation Identity Key (AIK), or provisioned by application Identities can be controlled using authorizations Richer set of authorizations in 2.0 IoT Security 10

11 What is the Software Stack Identifying the software in use enables management, updates, and finer control Software identity comes from RTM provides ability to attest to the software and allow authorizations and decisions based on the software identity IoT Security 11

Is There Protected Storage on the Device Entities want to rely on device properties and one critical property is the ability to provide long-term storage with

12 Is There Protected Storage on the Device Entities want to rely on device properties and one critical property is the ability to provide long-term storage with confidentiality and integrity guarantees provides storage that has both confidentiality and integrity Attestation proves the existence of the protected storage IoT Security 12

Is There a Trusted Execution Environment Need assurance that operations can occur without modification Especially true in keeping key material confidential

13 Is There a Trusted Execution Environment Need assurance that operations can occur without modification Especially true in keeping key material confidential has TEE mitigates both hardware and software attacks API only allows specific operations and key material never leaves without being encrypted IoT Security 13

14 Usage IoT Security 14

Properties s come in many shapes and sizes Discrete hardware devices Embedded hardware devices Firmware implementations Others are possible Different

15 Properties s come in many shapes and sizes Discrete hardware devices Embedded hardware devices Firmware implementations Others are possible Different properties for each Need to match the properties to the platform in question Sensor, gateway, network, cloud Specific use models matter IoT Security 15

16 IT/ Business Systems Vertical IoT Apps Where Are the s? Illustration only, not for deep discussion On-Premise or Off-Premise Data Center or Cloud Sensor Sensor Sensor Actuator Sensor Actuator I/O I/O MCU MCU U I/O P A L Gateway WiFi + LP WiFi Bluetooth + BTLE 3G/4G/LTE (GPRS) ZigBee, Zwave 6LoWPAN WiHART Ethernet RFID U P A L Gateway Device Attestation 3 rd Party Cloud Network Infrastructure Data Transport Broker Device Attestation Data Ingestion & Processing Security, Configuration & Management Persistence & Concurrency Asset Info, Policies & Metadata Query Storage Compute Analytics Business Logic & Rules Services Orchestration APIs, API Libraries, SDK Business Portal U P A L Universal Protocol Abstraction Layer Data Center Management & Security (Monitoring, Auto-scaling, Logging, Eventing) Data Flow: MQTT, HTTPS, WebSockets, XMPP, CoAP, REST, AMQP, DDS, et al. Security & Mgmt Flow: MQTT, EPID, OMA-DM, TR-069, REST, et al. All compute devices have Identity Protection (EPID), Secure Boot, Smart Object ID, etc. IoT Security 16

Questions Again What device are you provides identity What is the software stack provides RTM and attestation Is there protected storage on the device

17 Questions Again What device are you provides identity What is the software stack provides RTM and attestation Is there protected storage on the device provides storage Is there a Trusted Execution Environment provides the glue that can tie the stack together operations execute inside of IoT Security 17

18 Question s? IoT Security 18

19 Legal Information Intel technologies features and benefits depend on system configuration and may require enabled hardware, software or service activation. Performance varies depending on system configuration. No computer system can be absolutely secure. Check with your system manufacturer or retailer or learn more at Intel, the Intel logo, are trademarks of Intel Corporation in the U.S. and/or other countries. *Other names and brands may be claimed as the property of others Intel Corporation IoT Security 19

The Intel IoT Platform Architecture and Product Overview

The Intel IoT Platform Architecture and Product Overview Ramesh Peri Senior Principal Engineer and IoT Devkit Architect, Intel Corporation 1 Agenda Introduction Intel IoT Platform Architecture Roadmap