For the most part, the biggest industrial cybersecurity trend lines over the past decade have progressed from IT-based approaches—including reliance on firewalls, DMZs, defense-in-depth strategies, etc.—to the more recent software-based strategies focusing on anomaly and intrusion detection. Running concurrent to this trend is a growing focus on embedded security.
Since embedded security is such a key facet of consumer electronic product security, e.g., the ARM root of trust used in modern smartphones, it’s a bit surprising that this concentration on embedded security has not yet made larger waves in the industrial sector. And though attention on this embedded approach for industry has been somewhat subdued compared to other approaches, there is a significant amount of ongoing activity.
Late last year, Mocana, a provider of Internet of Things (IoT) security for industrial control systems (ICS), partnered with Avnet, Xilinx, Infineon Technologies and Microsoft to introduce an integrated, high-assurance industrial IoT (IIoT) system. Srinivas Kumar, vice president of engineering at Mocana, says the system is comprised of advanced hardware and software built on the Avnet UltraZed-EG system-on-module and designed for IIoT and small form factor IoT devices. The hardware plus software combination of this system includes Mocana’s security software operating on the Xilinx Zynq Ultrascale+ MPSoC, leveraging the capabilities of Infineon’s Optiga TPM (Trusted Platform Module) 2.0 security chip.
“The integrated system interoperates with the Microsoft Azure cloud and is the first of its kind solution that makes it easier and more accessible for large and small companies to bring IoT devices and services to market that are secure and compliant with industrial cybersecurity standards,” says Kumar.
While the Mocana partnership is aimed more at developers of industrial systems, Bedrock Automation, a supplier of industrial controls, I/O and power supplies, has released a white paper detailing industrial cybersecurity practices for industrial end users. This new white paper comprises chapter four of Bedrock Automation’s ongoing white paper series. Designed to serve as an industrial cybersecurity resource document, the first portion of the white paper focuses on the conventional cybersecurity practices that apply to all industrial control systems. The second half, however, concentrates on “the application of intrinsic (i.e., embedded) cybersecurity advances that have been applied in military, aerospace and e-commerce, and are now being used to protect industrial control systems,” says Albert Rooyakkers, Bedrock Automation founder and CEO. “These create a hardware end-point root of trust that combines advanced cryptography, digital signing techniques, an industrial certificate authority and public key infrastructure (PKI) built into the control system to create an infrastructure for user defense.”
PKI, a process by which messages flow only between trusted parties, is a key aspect of embedded security discussed in this paper. Rooyakkers explains that the use of PKI does not eliminate the need for conventional, system-level network security measures, but it does add a new level of depth to the defense. “Elite hackers are expert at bypassing firewalls. In contrast, breaking properly implemented, strong cryptography is not a practical possibility,” he says.
Though widely used for Internet-based e-commerce applications, PKI is not yet widely used in industry. To help industrial end users better understand PKI, Rooyakkers explains its four key components.
The first component is asymmetric cryptography. “Normal or symmetric cryptography algorithms use a single shared secret key for both encryption and decryption. Asymmetric algorithms use keys in pairs,” Rooyakkers says. “In other words, what is encrypted by one member of the pair can only be decrypted by the other. A PKI works by making one member a closely guarded secret (the secret or private key) and freely sharing the other (the public key).
A digital signature is the second component of PKI. Here, a block of data is digitally signed using a two-step process. The first step computes a summary of the data using a one-way compression function. “This summary is then encrypted with the signer’s private key pair and appended to the data—this small encrypted block is the signature,” says Rooyakkers. “The complete appended signature record will also identify the signer, specify the cryptographic and summary algorithms used and provide the public key. Any third party can replicate the computation of the summary and decrypt and verify the signature.” A critical aspect of the digital signature is that a valid signature proves two things: 1) the signed data has not been corrupted and 2) the signature was computed using the corresponding secret key.
The third component of a PKI is certificates. The most common certificates are the X.509 certificates defined by the Internet standard RFC 2459. An X.509 certificate is a signed block of data that binds the identity of the owner to a public key. PKI uses certificates in three basic ways: First, it is the standard mechanism for distributing public keys; second, certificates are used to prove identity by a process called authentication; and third, certificates are used to establish secure channels of communication.
The CA, or Certificate Authority, is the fourth component of PKI. “This is the root of trust,” says Rooyakkers. “This is where certificates get signed, issued and managed. To prove identity, the certificate that asserts the ownership of the public key must be signed by a trusted party. That initial signature can, in turn, be verified with other certificates that form a chain of trust. A valid chain must always end with a signature created with the private key of the CA. The public key of the CA is normally provided by a certificate distributed to all parties.”
Once both parties have the CA’s public key and have been issued certificates and associated private keys, the first step for successful, secure communication is for the parties to exchange and validate certificates using the CA public key. “Assuming this succeeds, both can be certain that the CA did, in fact, issue the certificate offered by the other,” notes Rooyakkers. “Offering a valid certificate, however, proves nothing. The final and critical step is to require that each party prove they have the secret key that matches their offered certificate. The bottom line here is that each side is required to correctly encrypt a random number provided by the other.
This is how embedded, intrinsic security based on a web of trust is mediated by the PKI. PKI mechanisms allow all members of the trust web to recognize other legitimate actors and exclude imposters. PKI mechanisms also provide secure communication between members.
“In the case of a controller module in an industrial control system, PKI makes it possible to know, at the controller, which actor can be allowed to change the user programming, or whether an operator should be allowed to change a setpoint,” says Rooyakkers. “If the actor has the proper certificate and matching private key, the controller allows the action. If not, the controller blocks it. The basic concept is that simple. But in the context of industrial cybersecurity, it is a game changer.”
Leaders relevant to this article: