In its free-to-attend BrightTalk webcast, Trusted Computing Group’s (TCG) Marketing Work Group Chair Thorsten Stemlau and Dennis Mattoon, Principle Software Development Engineer for Microsoft Research, stressed the importance of hardware security. Sharing their expert insight, they explored the integral role that Root of Trust (RoT) has to play in keeping millions of Internet of Things (IoT) devices safe and secure from attack.

RoT lays the foundation for trusted computing within device operating systems and initiates a chain of trust which is vital to ensure that devices boot securely with legitimate code. As the first line of code to be executed, verified, and trusted, it generates the execution of each subsequent piece of code. Representing the baseline of protection within a device, and being inherently trusted by the system, the RoT serves a vital purpose in cyberattack immunity and must be secure by design.

Deep-rooted Protection

TCG’s Trusted Platform Module (TPM) is the standard hardware RoT, providing secure storage of boot and runtime state, as well as cryptographic secrets such as private encryption keys. Resistant to physical attack, the chip prevents attackers from recoding the device and accessing stored data by hiding these keys so that the data cannot be read, and authorized users cannot be locked out. This, combined with the Device Identifier Composition Engines (DICE) by TCG, provides cost-effective, foundational security for any system or component due to its simple and adaptable hardware requirements.

Providing hardware-based identity and attestation, the DICE creates a platform for data integrity, device recovery and system updates. It does so with a layered boot architecture, generating Unique Device Secrets, or individual fingerprints with each layer and configuration. This means that if different code is booted, the deviation from the standard boot will be recognized and different secrets will be generated – preventing attackers from accessing any genuine data should they tamper with the device. If, however, a vulnerability did exist and disclose a secret, the code would automatically patch and re-key the device, making it possible to recover the data while preventing it from being read.

Securing a Moving Target

In the context of a wider network, it is integral to take steps to eliminate any risk in the transmission of data between devices. Devices which request data must prove their authenticity in order to be validated to receive it, allowing information to be shared among devices safely, without being exposed to unauthorized third parties. Attestation offers just this; measures which prove that a given device is running secure software with which to receive protected data. This process includes measuring the specifications of the device and verifying the platform’s manufacturer-generated Reference Integrity Manifest (RIM) to confirm the authenticity of the data request. By taking such thorough steps to ensure that data is transmitted and received between authorized network devices, the risk of exposing valuable information to attackers or leaking sensitive data is dramatically minimized. Methods such as these are integral to computer networks, both enterprise and residential, to secure the movement of their data. By making certain that data can only be shared with certified devices, networks can be protected from security breaches, software alteration and data leaks to unauthorized drives.

Make or Break for the IoT Ecosystem

It is predicted there will be more than 21 billion IoT devices by 2025 – making it imperative that these devices are safeguarded through the adoption of proven security practices. With such devices supporting everyday functions such as working to home, the expectation for complete personalization and customization of these platforms is rising. Our lifestyles are becoming increasingly influenced by IoT, and a wider range of more in-depth data is required to ensure the level of customization that is so in demand. The enrichment of more detailed data stored within networks at an increased volume makes for a valuable source of information, increasing the risk of attack as cyberthieves are provided with an opportune target.

By implementing the TPM, DICE and RIM as part of a cybersecurity system which offers protection, detection, recovery, measurement and attestation, devices can not only protect the data which they store, but quarantine compromised components and heal vulnerabilities in their systems. The broad span of RoT beyond singular devices to include the wider network is integral to protecting end-users, especially as more interactive and customizable IoT technology emerges.

It is more important than ever to maintain trusted computing best practices and employ full-coverage security measures to protect ever-sensitive, personal information from leaks and threats. TCG has been working on advancing hardware security and enabling a RoT pole position within its relevant work groups. This webcast summarizes the course of action that they have taken so far and what the organization plans for the future to ensure that devices remain secure in an increasingly connected world.