Just as agile software principles are being adapted for hardware development, so secure provisioning IT practices are finding their way into the semiconductor industry — a move accelerated by the necessity of keeping the increasing number and vulnerability of connected IoT devices. While LoRa technology is sweet spot for low-power connectivity, security remains an area for improvement in the market due to vulnerabilities that leave the network and application server keys accessible in the memory of modules and microcontrollers paired with a LoRaWAN stack. And, as applications and products become more successful, the changes of hacking increase dramatically. If keys are accessed in a LoRaWAN device, a hacker can impersonate it and authorize fraudulent transactions, which can result in a scalable attack with substantial losses in service revenue, recovery costs and brand equity.
Partnering with LoRaWAN network stack developer The Things Industries (TTI), Microchip Technology recently announced the industry’s first end-to-end security solution that adds secure, trusted and managed authentication to LoRaWAN devices at a global scale. The solution brings hardware-based security to the LoRa ecosystem, combining the MCU- and radio-agnostic ATECC608A-MAHTN-T CryptoAuthentication device with The Things Industries’ managed join servers and Microchip’s secure provisioning service.
“What we’ve done together today is to take the LoRa technology to the next level by addressing security,” says Zavier Bignalet, security product manager in Microchips Secure Products Group. “We’ve worked first with AWS to develop secure authentication mechanism with the cloud and entity. We’ve done the same thing with the Google IoT core. So, the next logical step with the positioning of Microchip in LoRaWAN industry.”
TTI is one of the backend providers of the LoRaWAN industry that provides application servers, network servers and now join servers. What Microchip is providing is the addition the secure element; a secure key storage that pre-provisioned with keys using Microchip’s pre-provisioning service. The Microchip factories are equipped with specific equipment to trigger they key generation side of the device, creating a secure physical boundary.
“The IT world does a good job of key authentication and protection,” says Bignalet, “So TTI didn’t invent anything; they simply applied normal IT practices to the lower backend.”
The join solution significantly simplifies provisioning LoRaWAN devices and addresses the inherent logistical challenges that come with managing LoRaWAN authentication keys from inception and throughout the life of a device. Traditionally, network and application server keys are unprotected in the edge node, and unmonitored, as LoRaWAN devices pass through various supply chain steps and are installed in the field.
The Common Criteria Joint Interpretation Library (JIL) “high”-rated ATECC608A comes pre-configured with secure key storage, keeping a device’s LoRaWAN secret keys isolated from the system so that sensitive keys are never exposed throughout the supply chain nor when the device is deployed. Microchip’s secure manufacturing facilities safely provision keys, eliminating the risk of exposure during manufacturing. Combined with The Things Industries’ agnostic secure join server service to the LoRaWAN network and application server providers, the solution decreases the risk of device identity corruption by establishing a trusted authentication when a device connects to a network.
Similar to how a prepaid data plan works for a mobile device, each purchase of an ATECC608A-MAHTN-T device comes with one year of managed LoRaWAN join server service through The Things Industries. Once a device identifies itself to join a LoRaWAN network, the network contacts The Things Industries join server to verify that the identity comes from a trusted device and not a fraudulent one. The temporary session keys are then sent securely to the network server and application server of choice. The Things Industries’ join server supports any LoRaWAN network, from commercially operated networks to private networks built on open-source components. After the one-year period, The Things Industries provides the option to extend the service.
Bignalet noted that both Microchip and TTI used the same type of infrastructure the “Big Five” — Amazon, Facebook, Apple, Google, and Microsoft — all use the hardware secure model in their data centers where the most critical information on the planet resides.
The ATECC608A is agnostic and can be paired with any MCU and LoRa radio. Developers can deploy secure LoRaWAN devices by combining the ATECC608A with the SAM L21 MCU, supported by the Arm Mbed OS LoRaWAN stack, or the recently-announced SAM R34 System-in-Package with Microchip’s LoRaWAN stack. For rapid prototyping, designers can use the CryptoAuthoXPRO socket board and The Things Industries provisioned parts in samples with the SAM L21 Xplained Pro (atsamd21-xpro) or SAM R34 Xplained Pro (DM320111).
The ATECC608A-MAHTN-T device for The Things Industries, including the initial year of prepaid TTN service, is available in volume production for $0.81 each in 10,000-unit quantities.
Leave a Reply