Embedded World 2017 – IoT coming of age.

by Cesare Garlati – Chief Security Strategist, prpl Foundation

Last week I had the pleasure of attending Embedded World 2017 in Germany as I was invited to give a couple of presentations on the pioneering work we have been doing at the prpl Foundation with regards to the prplHypervisor™ and prplPUF™ APIs for securing IoT. As it turns out, IoT was the top line at the conference that drew in more than 30,000 trade visitors – and the event solidified the notion that embedded computing is now synonymous with IoT.

IoT Security: Pushing the boundaries of resource constrained devices

The main theme running throughout was the challenge of pushing resource constrained devices to the limits. From a tech provider’s perspective, this was the most pervasive, well-defined issue being tackled at the show – how do we push the capabilities when it comes to functionality and security in low power devices with limited memory and minimal CPU resources?

With IoT, applying security technology after the fact or using encryption as used in a traditional security model is simply not an option in devices that don’t have the battery power, memory or CPU to support such measures, much less being able to afford the expense when the device itself costs so little. Yet, the fact that these are physical devices makes them so much more dangerous to human life and therefore the security should be taken just as seriously as that of a data centre.

Open Source as (one) answer

The answer for much of these basic security questions meant that more and more vendors are adopting – or seriously considering – the use of open source software. Though not everyone was aligned with the true value of open source, some even felt opportunistic, it was encouraging that the message of using open source, with all the extra eyes on it, is getting through.

Having said that, and knowing that open source software is notoriously more resilient than proprietary, closed source software – it does have its issues that vendors and manufacturers need to be aware of. Namely, though it is open and freely available, open source is not free. Yes, there is no licensing fee, but that is not to say it doesn’t come with the expenses of developing expertise, ensuring the organisation using it has the right liability cover, maintenance and working with open source communities to get the best out of it. As with anything in life, using open source requires upkeep to get the most from it.

In silicon we trust

Using open source protocols to get the basics right in IoT means that embedded devices can truly be interoperable with each other. What stops this from being a security risk is trust. The other element I discussed and which received over an hour of questions from the audience was the prplPUF™ API, the Physical Unclonable Funtions implementation of the prplSecurity™framework. I think everyone can agree that we’ve established that embedding secrets in a device is just not a good idea – and if you need proof, look no further than the Vault 7 revelations; not even the CIA can hide such secrets. Instead, what if you could extract a unique identifier from the silicon itself, something that is exclusive and repeatable and unable to be cloned?

This could have all sorts of applications for improving and strengthening security in embedded devices and the real genius of it is that it’s something that already exists with in the hardware itself – much like a digital fingerprint.

By using the prpl platform which combines open source with the use of a light-weight hypervisor for security by separation and PUF to establish trust in embedded systems, we’re looking at a much safer future for IoT.

 *   *   *

For more information or to get involved in the groundbreaking work prpl is doing with improving embedded computing security, visit us at http://prpl.works or contact me directly at @CesareGarlati

prpl is Pragmatic for Security

RTC MagazineWithin the prpl Foundation Security Working Group, Imperas is providing solutions for embedded hypervisor/OS developers. Simon Davidmann, Imperas CEO, wrote a guest blog for RTC Magazine, which focusses on embedded computing, including information for both hardware and software developers of embedded systems.

The article is about the security of embedded systems, what the prpl Foundation is doing about it, and what its Virtualization and Security PEG is focused on.

“Most of the public discussion about security presents various aspects of the problems, or a high level view of risks/solutions, or an individual company’s solution to their slice of the problem. The prpl Foundation’s Security Working Group is taking a pragmatic, cross-functional approach to security in embedded devices and systems. What do I mean by pragmatic and cross-functional?…”

Read the full article here.

The Internet of Things: Life-changing tech or a disaster waiting to happen?

Reposting from Tech City News NOV 02, 2016 http://techcitynews.com/2016/11/02/the-internet-of-things-life-changing-tech-or-a-disaster-waiting-to-happen/

By Cesare Garlati, chief security strategist at the prpl Foundation, an organisation working to make the IoT safer, explains how startups can get IoT security right to avoid being subjected to harm.

miraiThe Internet of Things (IoT) is exciting new territory for many startups and innovative companies looking to push boundaries and connect even the smallest devices to attempt to simplify and enhance our lives. But the security of these devices is fundamentally flawed for a number of reasons.

Continue reading

Open source and virtualization provide a powerful combination for wireless routers

By , Imagination Technologies

Back in March 2015, the Federal Communications Commission (FCC) – a government agency tasked with regulating interstate communications in the United States – issued a security document that included a series of provisions related to the use of wireless devices that operate in the U-NII radio bands.

In essence, the FCC wanted the manufacturers of routers and other networking equipment to provide tightly defined access paths to all wireless transmission devices. Unfortunately, the FCC proposal is likely to result in OEMs locking down the whole firmware of their routers and thus preventing consumers from installing the open source operating system or software of their choice (e.g. OpenWrt or DD-WRT.)

Continue reading

How to Stop our Smart Homes from Turning Against Us

Tech Target IoT Agenda, May 31, 2016 – Art Swift, President prpl Foundation

The Internet of Things is transforming our homes into data centers before our very eyes. Yet unlike in the data center, we don’t have IT professionals on call to manage, patch and secure these systems. Already in 2016, there are reports of LG Smart TVs being targeted by scareware.samsung-smartthings-iot-security And just recently, new research has highlighted serious flaws in the Samsung SmartThings platform which could allow remote hackers to unlock doors, trigger false fire alarms and reprogram security settings inside our smart homes. Many home users are unfortunately unprepared to deal with such events. They need to wake up to the fact their innocuous-looking domestic IT could be hijacked by cybercriminals or government spooks, with potentially serious consequences. But industry and regulators also need to take action — to force manufacturers to improve the security of consumer electronics products.

Read the full article at IoT Agenda.

Imperas, OVP and prpl

OVP diagramThe prpl Foundation recently published its first newsletter, as a way of extending communications with the embedded systems community.  Imperas CEO and Open Virtual Platforms™ (OVP™) founder Simon Davidmann wrote an article for the newsletter, titled “prpl Security Group and Imperas Address IoT Security Challenges via Multi-Domain Virtualization.”  That’s quite the long title.  What was Simon saying?

The full article has more detail, but here’s a summary:

The prpl Security PEG is defining a security roadmap to get from today’s software-virtualized solutions to full hardware supported virtualization, enabling multi-domain security across processors, heterogeneous SoCs and systems built on these technologies including connected devices, routers and hubs. As a provider of tools for embedded software development, Imperas’ unique perspective and added value to the collaborative PEG is in the tools for developing, testing and demonstrating the secure software stack.  Imperas is cooperating with the embedded software providers in the PEG to build Extendable Platform Kits™ (EPKs™) to accelerate development of the individual elements of the secure stack, and enable the easy analysis and verification of these elements in isolation as well as integrated into the complete stack.

The first product of this collaboration is an Extendable Platform Kit (EPK) using an Imperas Open Virtual Platforms (OVP) virtual platform based on the OVP model of the MIPS M5150, with SELTECH’s FEXER OX hypervisor and the Toppers (Tron) real time operating system (RTOS) as three individual guest operating systems (see Figure 2).  EPKs are designed to help users accelerate embedded software development, debug and test.  The platform and peripheral models included in the EPKs are open source, so that users can easily add new models to the platform as well as modify the existing peripheral models.

Enjoy reading the article!