Securing AWS cloud-based IoT devices
- By Patrick Marshall
Securing the growing number of internet of things devices is hard enough. But devices that are connected to the cloud are easy for hackers to access -- not just the device, but to all other “things” connected to an IoT mesh.
In 2015 Amazon Web Services released an IoT platform that allows for mutual authentication, aiming to verify the integrity of all devices connecting to the AWS IoT cloud.
To connect and authenticate, devices use AWS SigV4 or use X.509 certificates that traditionally manage public-key encryption. That means IoT managers can map roles and/or policies to each certificate so that devices or applications can be authorized (or de-authorized) without having to touch the device.
As might be expected, an organization with thousands of IoT-enabled devices might find it too difficult to provision and manage all those certificates and keys. One solution is the AWS the “Use Your Own Certificate” program, which allows original equipment manufacturers to register digital certificates signed by a third-party authorities with the AWS IoT platform using an application programming interface, according to Embedded Computing.
That means “unique cryptographic keys can be generated for each device during production, signed by a certificate authority … and then loaded into the AWS IoT platform to await a service request from systems containing the corresponding key pairs,” the site said.
A hardware solution that offers built-in end-to-end security between the device and cloud servers has been developed by Microchip Technology Inc. and AWS.
It uses a small chip that is preloaded with the unique cryptographic codes to allow data to be transmitted more securely from an IoT device to the cloud.
According to Eustace Asanghanwa, strategic marketing manager for Microchip Technology, the AWS-ECC508 chip eliminates the need for IoT device manufacturers to go through a multistep process of preregistering their device with AWS servers and generating encryption keys for communications. Instead, the AWS-ECC508, a 3mm by 2mm, 60-cent device (in quantities of 10,000 or more) handles the connection and encryption automatically.
The device can be soldered onto a circuit board and connected to the host microcontroller that configures the chip for the AWS IoT. Because the AWS-ECC508 is preconfigured to be recognized by AWS without any intervention, there is no need to load unique keys and certificates because the information is contained in a small, easy to deploy “crypto companion device,” the company said.
Unlike the RSA encryption algorithm in widespread use, the Microchip Technology processor employs a more efficient elliptic curve cryptography algorithm that does require as big a key and is, therefore, faster and calls for less hardware.
According to Asanghanwa, IoT device manufacturers have often not paid sufficient attention to building security into their devices because of an overriding focus on keeping costs down.
“Looking at the product holistically, the AWS-ECC508 actually reduces overall cost,” he said. “If you consider not just hardware but also implementation, such as the capital and operational costs of securely injecting keys and managing them in a supply chain, the AWS-ECC508 actually creates a significant cost-reduction for any given product.”
While the AWS-ECC508 will only work with Amazon Cloud Services, the underlying ECC508 technology can be configured to work with any storage or cloud vendor’s services.
Patrick Marshall is a freelance technology writer for GCN.