9.8 The Internet of INSECURE Things

The IoT will change our lives, bringing huge benefits and making a positive impact on society and the economy, but it requires trusted systems with efficient security and privacy mechanisms from devices to the Cloud. For years digital security technologies have proven their efficiency in telecom, banking and ID applications. Technical solutions exist and can be reused as a toolbox to provide security and privacy for the IoT.

In this session we will describe how STMicroelectronics' scalable security offer based on STM32 microcontrollers and STSAFE secure microcontrollers make it possible to build secure IoT solutions with the right level of robustness, The STMicroelectronics scalable offer for IoT security can also be adapted to efficiently combat various threats. STMicroelectronics, a global semiconductor leader supplying the market with the most advanced technologies and solutions and a 20-year presence in security, is committed to contributing to a more secure connected world.

In this session practical design methods and experiences are presented centered on STM32 devices. Gateways and connected IoT devices networks need to be secured as well as the devices themselves. Suitable safeguards must be integrated to prevent network interfaces and emdedded firmware updates from becoming security holes themselves; these safeguards refer to securing the data stored by the device, secure communication and protecting the device from cyber-attacks Software and hardware development approaches are outlined along with practical experiences that meets the appropriate security level of modern IoT platforms.

The SEcube™ (Secure Environment cube) platform presented in this session is an open source security-oriented hardware and software platform constructed with ease of integration and service-orientation in mind. It is based on a single-chip design embedding three main cores: a highly powerful processor, a Common Criteria certified smartcard, and a flexible FPGA. The software components include several libraries of ready-to-use components that provide developers with different entry levels to adoption. This way, security experts can avail of the open source character and verify, change or write from scratch the entire system, starting from the elementary low-level blocks. At the same time developers who use the predefined primitives can experience the SEcube™ as a high-security black box suitable for security-oriented services in several fields, like IoT, Automotive, etc.

The growth and diffusion of high technology consumer communication devices and the following tech skills in average user are pushing industry to put connectivity/network functions in devices. Automotive industry is riding as well this wave. Vehicles are nowadays implementing new "Cyber Physical Features" by collecting information from the physical system and processing it via interconnected cyber systems, creating thus new challenges for safety and security. In addition, an increasing number of vehicles are nowadays connected to the Web, and the capillarity of interconnected IoT devices are drawing the future for the customer expectations in term of innovative services. Historically, security was first of all achieved with isolation of subsystems and, nowadays, with the growing number of interconnected systems that are indirectly interconnected with IoT services highlight how component level countermeasures are important but not enough to enforce protection in a modern vehicle. A multi-level, coordinated, system wide approach is necessary such as isolation of safety critical systems, secure gateways, virtualization, trusted software injection and execution, but not only. It requires also a re-design of vehicle data transport infrastructure with new communication standards with the adoption of secure protocols like sCAN.