prpl is Pragmatic for Security

RTC MagazineWithin the prpl Foundation Security Working Group, Imperas is providing solutions for embedded hypervisor/OS developers. Simon Davidmann, Imperas CEO, wrote a guest blog for RTC Magazine, which focusses on embedded computing, including information for both hardware and software developers of embedded systems.

The article is about the security of embedded systems, what the prpl Foundation is doing about it, and what its Virtualization and Security PEG is focused on.

“Most of the public discussion about security presents various aspects of the problems, or a high level view of risks/solutions, or an individual company’s solution to their slice of the problem. The prpl Foundation’s Security Working Group is taking a pragmatic, cross-functional approach to security in embedded devices and systems. What do I mean by pragmatic and cross-functional?…”

Read the full article here.

Open source and virtualization provide a powerful combination for wireless routers

By , Imagination Technologies

Back in March 2015, the Federal Communications Commission (FCC) – a government agency tasked with regulating interstate communications in the United States – issued a security document that included a series of provisions related to the use of wireless devices that operate in the U-NII radio bands.

In essence, the FCC wanted the manufacturers of routers and other networking equipment to provide tightly defined access paths to all wireless transmission devices. Unfortunately, the FCC proposal is likely to result in OEMs locking down the whole firmware of their routers and thus preventing consumers from installing the open source operating system or software of their choice (e.g. OpenWrt or DD-WRT.)

Continue reading

Imperas, OVP and prpl

OVP diagramThe prpl Foundation recently published its first newsletter, as a way of extending communications with the embedded systems community.  Imperas CEO and Open Virtual Platforms™ (OVP™) founder Simon Davidmann wrote an article for the newsletter, titled “prpl Security Group and Imperas Address IoT Security Challenges via Multi-Domain Virtualization.”  That’s quite the long title.  What was Simon saying?

The full article has more detail, but here’s a summary:

The prpl Security PEG is defining a security roadmap to get from today’s software-virtualized solutions to full hardware supported virtualization, enabling multi-domain security across processors, heterogeneous SoCs and systems built on these technologies including connected devices, routers and hubs. As a provider of tools for embedded software development, Imperas’ unique perspective and added value to the collaborative PEG is in the tools for developing, testing and demonstrating the secure software stack.  Imperas is cooperating with the embedded software providers in the PEG to build Extendable Platform Kits™ (EPKs™) to accelerate development of the individual elements of the secure stack, and enable the easy analysis and verification of these elements in isolation as well as integrated into the complete stack.

The first product of this collaboration is an Extendable Platform Kit (EPK) using an Imperas Open Virtual Platforms (OVP) virtual platform based on the OVP model of the MIPS M5150, with SELTECH’s FEXER OX hypervisor and the Toppers (Tron) real time operating system (RTOS) as three individual guest operating systems (see Figure 2).  EPKs are designed to help users accelerate embedded software development, debug and test.  The platform and peripheral models included in the EPKs are open source, so that users can easily add new models to the platform as well as modify the existing peripheral models.

Enjoy reading the article!

Inadequate IoT Security is Setting Regulators on Collision Course with Consumers

By Art Swift, President prpl Foundation

It was Charles Dickens’ much celebrated novel Oliver Twist that first popularized the phrase “the law is an ass.” It resonated far and wide for people who viewed the British legal system of the time as unjust and at odds with common sense. Now, no one is suggesting that the highly evolved legal and regulatory system we have in the modern United States is anything like the situation Dickens described 177 years ago. But it remains that rules set by regulators and lawmakers have consistently failed to keep up with the pace of technological change – and there’s a real danger they could now threaten the development of the Internet of Things (IoT) and embedded computing.

Continue reading

Open source software under attack – is the worst still to come?

What we can learn from the recent cyber attacks to the popular website GitHub and why we should worry about what is likely to come next.

github-attackOver the last few days the popular website GitHub has been the target of a massive Distributed Denial Of Service attack – DDoS, apparently originated from China. As I write this note, the GitHub status webpage now indicates “Everything operating normally” and “All systems reporting at 100%”. However, I am afraid the story is far from over and the worst may still be to come.

Continue reading