Rambus has announced that its CryptoManager security platform now supports in-field feature and service provisioning, alongside SoC management and device personalization capabilities. “In-field feature and service provisioning enables complete silicon-to-cloud functionality to support the growing requirements of trusted applications,” said Dr. Martin Scott, senior VP and GM of the Rambus Cryptography Research division. “These include secure mobile banking, identity and entertainment, along with IoT device security.”
Search Results for: iot
Rambus lensless smart sensors go thermal
Rambus scientists have debuted thermal-enabled lensless smart sensor (LSS) technology at MWC 2016 in Barcelona. As Rambus Labs VP Gary Bronner notes, LSS now supports thermal capabilities alongside the visible spectrum. “LSS can enable a future where IoT technology is infused in every aspect of modern life, from smart cities and transportation to medical equipment and manufacturing,” said Bronner.
CryptoManager Trusted Provisioning Services
Security
CryptoManager Trusted Provisioning Services
Local and cloud-based trusted key creation, delivery and authentication services including optional hosting, operation and maintenance of CryptoManager Secure Infrastructure for secure SoC and device manufacturers, as well as downstream application developers and service providers.
How CryptoManger Trusted Provisioning Services Works
A key component to the CryptoManager Platform, our trusted provisioning services enable improved security for SoCs, devices and secure applications by providing a trusted path for sensitive data throughout their lifecycle. This sensitive data can include cryptographic keys and configuration settings to enable application security; personalization information for applications, devices and users; and application, device, and service features; as well as other forms of sensitive information enabling device life-cycle management and robust on-device security services.
The CryptoManager secure in-field provisioning capabilities are based on trust established early in the manufacturing process through integration with the CryptoManager Security Engine as a robust on-device root-of-trust.
This enables a complete cloud-to-silicon full-lifecycle security ecosystem that provides a new level of protection for devices in the field, and fundamentally changes the way that trust is established and managed for mobile devices and applications.
A number of high value mobile application segments are dependent on strong device-side security to manage risks and enable mobile application services businesses. These applications include mobile payments, smart ticketing, content protection, and other applications requiring strong identity, security and trust. With the prospect of multiple trusted applications which, in turn, require support from a mix of trusted stakeholders within the mobile ecosystem, the need for a unified, secure, and trusted provisioning platform has become essential.
The CryptoManager Root of Trust
Built around a custom RISC-V CPU, the Rambus CryptoManager Root of Trust (CMRT) is at the forefront of a new category of programmable hardware-based security cores. Siloed from the primary processor, it is designed to securely run sensitive code, processes and algorithms. More specifically, the CMRT provides the primary processor with a full suite of security services, such as secure boot and runtime integrity, remote attestation and broad crypto acceleration for symmetric and asymmetric algorithms.
Solution Offerings
Features
Deliverables
Features
Ubiquitous On-device Root-of-Trust
- Via a hardware core, endpoint security that begins at the SoC manufacturing stage of the lifecycle through keys provisioned very early in the manufacturing process to a trust root integrated in the mobile device chipsets; or
- Via a software agent that runs in the trusted operating system or the high-level OS when the hardware core is not present, endpoint security for in-service devices and other devices that lack a hardware core.
- Full-lifecycle Cloud-to-Silicon Secure Provisioning
- Enables trusted manufacturing provisioning services to chipmakers and device makers at all levels of the supply chain
- Provides trusted in-field provisioning services for Apps whether pre-installed by the device maker or provided by a service provider and downloaded from the App Store
- Customer owned and operated infrastructure – for service providers and network operators who want the control and flexibility of deploying the infrastructure that enables secure provisioning services for in-field devices within their data centres
- Secure provisioning infrastructure provided as a cloud service – hosted infrastructure option for service providers focus on rapid time-to-market and low upfront investment.
- Supply chain process monitoring to ensure production volumes and process yields are being accurately measured
- In-field provisioning transaction reporting accurately tracks the delivery of sensitive keys and data, and enables simple and dependable services billing
- Breaks reliance on traditional centralized trust authorities to broker trust for in-service devices
- Service providers and operators can establish independent trust with devices, users, and applications to enable secure device services throughout the device lifecycle
Deliverables
- Comprehensive cloud service for customers who prefer to consume the CM Infrastructure for secure provisioning as a service rather than a product.
- Hosts, operates, and maintains all components of the CryptoManager Infrastructure, allowing application developers and service providers, to leverage the trust and security of CryptoManager without having to own and operate provisioning infrastructure.
- Includes tools allowing easy integration of access to the cloud service into existing customer backend platforms for key provisioning and feature management of applications.
- 24×7 Support and Maintenance of CM Device and System Software
- Integration, Test, and Deployment Guides as well as Setup Support professional services
- Customer Admin / Operator Training and Certifications
Use Cases
Personalization
Large OEM customers requesting personalization, customer specific data preparation and feature customization of standard parts challenge the chipmakers ability to minimize inventory overhead and improve operating efficiencies.
Secure Key Provisioning
With mobile devices housing more and more sensitive data that is utilized in a wide variety of applications, chip and device companies must meet the complex security requirements for each potential use case or capability. Debug Access Control
The CryptoManager solution provides a method for chip and device companies to authenticate the device and authorize the provisioning of the debug enable/disable operation for each device.
Resources
Videos
Secure Element in the Cloud
Rambus Secure Element in the Cloud enables making financial transactions when using near field communication. To do this securely application issuers like banks and mobile network operators need to store credentials in an environment called the secure element.
Is Mr. Robot the new WarGames?
WarGames – which hit theaters way back in 1983 – is an early hacker film starring Matthew Broderick (David Lightman) and Ally Sheedy (Jennifer Mack). For the uninitiated, WarGames depicts the fictional story of David Lightman, a high school hacker who unintentionally accesses WOPR, a military supercomputer operated by the U.S. Department of Defense (DoD).
Believing he is playing an unreleased computer game, Lightman and Mack run a nuclear war simulation (Global Thermonuclear War) on WOPR, prompting a missile scare and nearly kicking off World War III. Ultimately, WOPR realizes that nuclear war is a “a strange game,” in which “the only winning move is not to play.” Watched by none other than President Regan himself, WarGames offers a stark warning about the danger and futility of nuclear conflict between the United States and the Soviet Union.
[youtube https://www.youtube.com/watch?v=hbqMuvnx5MU]
As Wired’s Scott Brown points out, the Cold War-era WarGames has essentially “written itself” into the cult lore of Silicon Valley. Indeed, Google co-founder Sergey Brin told a packed 2008 symposium in Mountain View that WarGames was a key movie of a generation, “especially for those of us who got into computing.”
Fast forward to 2016. Although the Cold War is long over, the dark, post 9/11 NYC depicted in USA Network’s Mr. Robot is far from a secure utopia. To be sure, the star of the wildly popular series is Elliot Alderson (Rami Malek), a cyber-security engineer and vigilante hacker who suffers from social anxiety disorder, clinical depression and a morphine habit.
“We now live in a world where hacks of all kinds are happening with alarming frequency and data dumps have become a weapon in both the geopolitical and personal arenas,” writes Jenna Worthman of the New York Times. “Mr. Robot feels, then, like a fictional CliffsNotes for the dark corridors of the Web. Cyber-espionage and geopolitical sabotage via cyber-attack is more than a paranoid fantasy; it is the new normal.”
Robot, says Worthman, may be fictional, but at least the series “helps us make sense of the strange new world taking shape beneath our feet.”
[youtube https://www.youtube.com/watch?v=gEm7vgXt2M0]
Meanwhile, Emmanuel Goldstein, writing in the 2600 Hacker Quarterly, notes that like Eliot, most of us are essentially trying to get by and figure out what’s right and wrong.
“This is what Eliot Alderson struggles with throughout the story. He remains a true hacker regardless of the choice he makes and how he’s manipulated,” he opines. “Sure, he breaks the rules a few times and invades the privacy of those he’s interested in, as is the case with members of virtually every element of society. And as a hacker, he’s very good at what he does. But it’s all of us who make the world of lost privacy, powerful integrated/intelligent systems and poor security a reality.”
Indeed, Kor Adana, a writer for the hit series, recently told a cyber-security conference that Robot has synched up well with real life events. As we’ve previously discussed on Rambus Press, a number of Robot hacks have actually occurred in reality, ranging from compromised PLC devices to malware-packed USB sticks dropped in parking lots to tempt unsuspecting victims.
“The show gets people on a certain wavelength when they realize oh, my webcam really can be used to spy on me,” said Adana. “And maybe I shouldn’t just blindly accept a CD from a street peddler. [Robot] illustrates the very real risks for the average person. An increased level of paranoia is clearly a good thing in this landscape. It comes along with the territory, because we know how to exploit these vulnerabilities.”
Clearly, Robot is helping to raise awareness of cyber-security risks for a more mainstream audience. In this context, the series may very well be the WarGames of 2016, with both hackers and security companies paying close attention to each episode of the blockbuster show. The specter of nuclear war between two superpowers may have faded along with the 1980s, but as Robot illustrates, our world remains a fundamentally insecure dystopia.
Building silicon foundations for security
Paul Kocher, the chief scientist of Rambus’ Cryptography Research division, recently presented a DesignCon 2016 keynote session that explored the crowded intersection of hardware, Moore’s Law and cryptography. As Kocher notes, cryptographic limits have historically been constrained by a salient lack of computing power.
“[Following Moore’s Law], more computing power enables much stronger algorithms,” he explained. “[Concurrently], more robust computing power has also led to an increasing number of security breaches at all levels. In fact, within two years, approximately 90% of all IT networks will experience an IoT-based security breach.”
This trend of insecurity can only be expected to continue, says Kocher, with analysts forecasting some 50 billion connected devices by 2020.
“There will be more devices, more valuable data and more complexity. What does this mean for attackers? More targets, reward and vulnerabilities,” he continued. “[As such], it is important to realize that security is fundamentally different from functionality. The former requires very different engineering strategies and assumptions.”
Incorrect assumptions, warns Kocher, often leads to negative outcomes.
“One could falsely assume hardware and software logic will be bug free. However, the reality is that current devices are one to three exploits away from total breach, with overwhelming likelihood of vulnerabilities at each layer,” the chief scientist confirmed. “SoCs are usually just one bug away from ruining software protections.”
One such vulnerability highlighted by Kocher during the keynote session was side-channel attacks.
“The [typical] assumption is that attackers only see the binary input/output data. The reality? Power & RF measurements show tiny correlations to individual gates,” he explained. “The information content of a secret key is tiny (typically 128-2K bits). Information can be extracted from noisy channels. The attack [vector] is to measure, divide into subsets and compare subset average.”
According to Kocher, the price of maintaining the insecurity status quo is steadily increasing due to FTC actions, litigation, insurance costs and various regulatory risks. In contrast, hardware-based security offers manufacturers a number of benefits, including deterrence against physical theft, optimized inventory management (chips can be configured and re-configured) and a separate IPR license for global trade (with configuration codes generated after import).
“Robust security will eventually be required – often for many use cases, such as DRMs, payment schemes, credential systems and device keys. [Plus], falling transistor costs – as per Moore’s Law – means lower per-chip manufacturing cost for security features,” he explained. “Moreover, it is important to remember that [stand-alone] software security doesn’t scale and there is no hope of eliminating bugs in existing software. The situation is getting worse, not better, as patching is expensive and not very effective.”
Separate chips, says Kocher, can help, although designers should be aware of the associated impact on cost, performance, size and power draw. In addition, interfaces – between the security and other chips – can themselves be vulnerable.
“Secure ‘on-SoC’ logic blocks are better, as they are isolated from the main processor and all of its software by an intra-chip security perimeter. In short, they are more cost effective and offer better security,” Kocher explained.
“[This is precisely why] the Cryptography Research division of Rambus designed the CryptoManager core to protect and deliver keys and configuration settings for use throughout an SoC’s hardware and software [layers]. Meanwhile, the CryptoManager server (or service) delivers keys and authorizations to factories or data centers and audits usage.”
The current generation of hardware, Kocher concludes, provides a rather poor foundation for consumer security.
“It is built with incorrect assumptions about software quality. The technology industry’s impact depends on finding solutions. Otherwise, the lack of security will erase net benefits from new technology such as the IoT,” he added.
