"Device-specific risks" that cannot be prevented by measures on the system side alone

Cloud and network security measures have been significantly strengthened in recent years. Authentication infrastructure, encrypted communications, access control, and other technologies have been put in place, and system-centered defenses are becoming more mature. However, in actual product development, there are many cases where the security of the device itself is not sufficiently considered.

For example, in embedded devices,

- Only simple checks are performed on the MCU side
・Device IDs and parameters are stored in plain text
・There is no system to check whether peripheral accessories are genuine.

Such situations are still common.

In this situation, no matter how robust the system is, the problem arises that the "weak device" can be an entry point for an attack. Even if the communication path is encrypted, if the device itself is fake, it may be possible to connect to the system via legitimate procedures. In other words, a gap has been created where system-level security alone is not enough to "guarantee authenticity." And much of this is due to the fact that, although efforts are being made to fill this gap with MCU software, the system itself has a structure that cannot be fully strengthened by software.

To compensate for these "device-specific weaknesses" and ensure that only the correct device is operational, it is necessary to use hardware to strengthen the parts that cannot be handled by software.

Security functions that can be strengthened with hardware in areas that cannot be fully satisfied by software

When trying to ensure the security of embedded devices, the following hardware-level protection features are essential:

・Secure storage (safely stores IDs, settings, and verification data)
- High-quality random number generator (a fundamental element that determines the security of authentication)
- Side channel attack resistance (protection against analysis using electrical power and electromagnetic waves)
- Tamper detection (a mechanism to detect physical intrusions and protect internal data)
- Encryption calculations are completed within the chip (structure that prevents data from leaking to the outside)

These are security features that were originally intended to be implemented in hardware, but in reality, many products are trying to replace them with MCU software alone.

- Keys and identification information are stored in the flash memory inside the MCU
・Implementing encryption processing as software
・The debug terminal is active
・Implementation that leaks information when power analysis is performed

As a result, we are faced with a situation where "despite the design costs, the device remains vulnerable to hardware attacks." This is not a fault of the software, but a structural problem that forces software to take on areas that it cannot handle. This is why we need an approach called a "secure authentication IC" that complements the software.

The role of secure authentication ICs: A mechanism for proving "authenticity" using hardware

Embedded devices have security areas that cannot be strengthened by software alone. Secure authentication ICs are dedicated hardware designed to complement these "missing areas." The IC contains a mechanism to reliably prove that an embedded device is an "authentic device."

■ Authenticity check
Determines the authenticity of devices and accessories and prevents the use of counterfeit, counterfeit, or modified products.

■ Eliminate impersonation
It is possible to create a system that checks whether sensors and modules are genuine and prevents non-genuine ones from working even when connected.

■ Secure storage of configuration information and identification data
Identification data, function settings, and usage information, which can only be lightly protected within the MCU, are stored in a dedicated area that is difficult to read from outside.

■ Usage restriction management (usage count/license control)
You can safely manage licenses for printer ink cartridges, batteries, replacement parts, etc. based on the number of times they are used and their official authentication.

■ MCU load reduction by offloading authentication processing
Because the cryptographic calculations and verification processes can be completed within the hardware, the MCU only needs to "query the secure authentication IC," significantly reducing the costs of software implementation and verification.

Features of Analog Devices Secure Authentication ICs: Four Strengths and Over 35 Years of Experience

Analog Devices has been providing security ICs since 1987, shipping more than 4 billion units and boasting a world-leading track record. Based on this long-standing knowledge, the secure authentication IC incorporates the following four features:

How to Choose an Analog Devices Secure Authenticator IC Based on Your Application

Analog Devices' secure authentication ICs are broadly used for the following applications:

- Authentication of consumables and accessories/counterfeit prevention
・Module, IoT node, and peripheral authentication
・Secure communication and secure boot for gateways and external devices

For each application, there is a lineup of ICs with private key/public key authentication methods and interfaces such as I²C/1-Wire/SPI. Below, we will introduce representative products for each main application.

Related Information

• What is '1-Wire', a one-wire communication interface with 280 trillion security IDs?
• ChipDNA built-in security PUF technology *Redirects to manufacturer page
• 1-Wire *Redirects to manufacturer page

Inquiry

If you have any questions regarding this article, please contact us below.