Experts say 2021 was the year of ransomware, but things changed in 2022 as criminals realized an estimated 17 billion IoT devices represented an easier target. While IT hardware and software security has dramatically improved, the IoT has lagged.Many IoT products need to be adequately secured and, as such, represent vulnerable entry points for attacks on critical infrastructure. Or the IoT device itself can be the specific target due to the data it hosts &ndash; for example, video from security cameras and patient information from medical wearables.There is a steady stream of news items about cyberattacks affecting everyday businesses and well-known brands. These can result in financial losses, privacy breaches, or individuals being blocked from accessing critical services. But now key infrastructure is also proving a major target, posing a danger to health, energy, food, water, and communications.<h2>IoT as a growing attack surface for cybercrime</h2>This is a problem that&rsquo;s not going away. Inexpensive wireless components are proving a boon to connectivity. The price of turning a dumb device into a smart device can be as low as 10 cents, says security expert Mikko Hypp&ouml;nen. That&rsquo;s encouraging vendors to add wireless connectivity to many devices, even if the benefits might be minor. And Hypp&ouml;nen explains that whenever an appliance is connected, that also makes it vulnerable.According to analyst firm IDC, there will be almost 42 billion IoT devices by 2025. The vulnerable products among that network will contribute to a cost of cybercrime that&rsquo;s set to grow to $10.5 trillion by the same year, according to research firm Cybersecurity Ventures. The growing number of connected devices creates a larger &lsquo;attack surface&rsquo;&mdash;the number of potentially unprotected targets a miscreant can seek to exploit. In addition, the large volumes of data gathered and transmitted by billions of connected IoT devices create a bigger target for interception.<h2>Addressing the vulnerability of connected devices</h2>Enhancing the <a href="https://www.nordicsemi.com/Support/Security" target="_blank">security</a> of the IoT is challenging. Cyber attackers benefit from the complexity of the network, as the more companies, equipment, devices, and software are involved, the more opportunities there are for exploitation. Such complexity emphasizes the importance of security being considered at all stages of a product&rsquo;s lifecycle - not just when it&rsquo;s in the field.Even simple IoT products, smart thermostats, for example, should be endowed with a degree of protection. It&rsquo;s not expensive to build-in simple protection such as secure-boot and secure-update with anti-rollback. Secure boot ensures the device verifies that its original software, and any subsequent update, is authorized and is safe to run. Anti-rollback prevents an older (and potentially vulnerable) version of the firmware being reinstated.Even greater security can be achieved by isolation. Isolation provides a barrier between the firmware responsible for potentially vulnerable interfaces and the security critical code. Non-critical information can still be extracted from the isolated area for general operation of the IoT device, but no security critical information is accessible beyond the isolated area. The device might also feature secure storage for security critical data and assets.<h2>Changing IoT-customers&#39; expectations of security</h2>In the wake of heightened awareness of cyber-attacks, public expectations of IoT devices have shifted. A survey by the U.K. government in 2020 found nine out of ten people now expect smart devices to have basic embedded features to protect user privacy and security.In response, <a href="https://www.psacertified.org/" rel="noopener" target="_blank">PSA Certified</a>, a framework for securing connected devices, has brought together major stakeholders to consolidate a range of security approaches into a standardized approach for the IoT. It developed a <a href="https://www.psacertified.org/what-is-psa-certified/using-psa-certified/" rel="noopener" target="_blank">four-stage framework</a> that guides developers through the steps necessary to implement the right level of security for a product. Nordic itself has aligned with the framework.Regulators in several countries are also outlining expectations and establishing minimum security standards for IoT products. In the EU, lawmakers recently introduced security standards that require internet-connected products to have &ldquo;appropriate levels of cybersecurity&rdquo;. In the U.S., recent Executive Orders on cybersecurity have led to the development of IoT security standards by The National Institute of Standards and Technology (NIST).<h2>Unlocking the value of the IoT</h2>Improved security can help developers of IoT solutions unlock stronger customer relationships, especially in contexts where reliability is critical. A prime example is the <a href="https://www.psacertified.org/products/fluence-wireless-flex-dimming-receiver/" rel="noopener" target="_blank">Wireless Flex Dimming Receiver</a> lighting solution from illumination company Fluence, which is built using Nordic&rsquo;s nRF52840 SoC and is PSA Certified.The product is targeted at the agriculture sector and enables growers to increase the amount and quality of produce by optimizing lighting conditions. Its built-in security features make it resistant to disruption increasing industry&rsquo;s trust in connected commercial solutions. This trust must now extend to key smart infrastructure such as smart electricity distribution grids, education, and healthcare.As wireless IoT suppliers like Nordic, industry consortiums like PSA Certified, and regulators around the globe work to prioritize digital security, we may finally see inherent high levels of protection that will unlock the full potential of the IoT.<hr>This article was first published on Nordic&#39;s&nbsp;<a href="https://blog.nordicsemi.com/getconnected" target="_blank" rel="nofollow" id="isPasted"></a><a href="https://blog.nordicsemi.com/getconnected?utm_campaign=2021%20wevolver" target="_blank" rel="noopener noreferrer">Get Connected Blog</a>. &nbsp;

Many IoT products need to be adequately secured and, as such, represent vulnerable entry points for attacks on critical infrastructure. Or the IoT device itself can be the specific target due to the data it hosts – for example, video from security cameras and patient information from medical wearables.

Why cybercrime is an increasing threat to the IoT

<h2 dir="ltr" id="isPasted">Introduction</h2>GraphQL is a query language that provides a more efficient, powerful, and flexible alternative to RESTful APIs (GraphQL, 2023). A RESTful API is an architectural style for an application program interface (API) that employs HTTP requests to access and use data. GraphQL was developed as an alternative to RESTful APIs by Facebook in 2012 and was converted to an open-source platform in 2015. GraphQL allows clients to request data from the server in a more specific and tailored way, reducing the amount of data that needs to be transmitted. This not only reduces the resources used but also streamlines and accelerates the process of accessing data. In this article, we will discuss what is GraphQL, its pros and cons and security concerns that developers need to know.<h2 dir="ltr">Pros and Cons</h2>One of the main advantages of GraphQL is that it allows clients to specify the exact data they need, reducing the amount of data transmitted over the network. This can lead to faster load times and improved performance, especially on mobile devices where bandwidth is limited. Additionally, GraphQL provides a more intuitive and flexible way of querying data, allowing developers to define complex queries with ease. It also allows API maintainers to add or remove fields without impacting existing queries. Developers can build APIs with their preferred methods, and the GraphQL specification will ensure they function in predictable ways for clients.Moreover, GraphQL also enables real-time data updates. Clients can subscribe to certain data and receive updates in real-time. This makes it easier to build reactive and interactive applications, which is especially important for real-time data scenarios.On the other hand, one of the main disadvantages of GraphQL is that it can be more complex to implement than RESTful APIs. In GraphQL the major operation of a data query is done on the server side, which adds complexity for server developers. Moreover, it can be challenging to optimize queries efficiently. Additionally, caching can be more challenging since queries can be customized, and there is no one-size-fits-all solution. Another limitation of GraphQL is that it may require different API management strategies compared to REST APIs, particularly when considering rate limits and pricing.<h2 dir="ltr">Top Security Issues</h2>GraphQL presents some security issues that developers should be aware of. A primary security issues is the possibility of denial-of-service (DoS) attacks. Since GraphQL allows clients to define queries, an attacker could potentially craft a malicious query that would consume considerable server resources, leading to a DoS attack.Another security issue is related to query depth and complexity. Attackers could craft a complex query that consumes a lot of server resources, leading to performance issues. This is because a GraphQL query is able to take in multiple actions, meaning that a developer cannot predict beforehand what amount of server resources will be utilized in an action. Therefore, the same strategy for limiting the number of requests on an API for cannot be used for GraphQL. Additionally, attackers could use GraphQL to perform data exfiltration attacks by creating queries that extract sensitive information from the server.A common issue encountered in GraphQL-based applications is presence of flaws in authorization logic. While GraphQL helps implement data validation, it is up to the API developers to implement authorization and authentication checks. The multiple levels of resolvers used for GraphQL APIs significantly add to its complexity since authorization checks are required for both query-level resolvers and resolvers that load additional data.<h2 dir="ltr">Mitigation Strategies</h2>To mitigate the security issues presented by GraphQL, developers can take a number of preventive steps. First, they should limit the query depth and complexity by setting limits on the number of fields and nested objects that a query can have. Additionally, they should implement measures to limit the rate of queries to prevent DoS attacks. Developers should also sanitize user input to prevent injection attacks.Authentication and authorization mechanisms should be applied to prevent unauthorized access to sensitive data. Another preventive measure is logging and monitoring of the system to detect and respond to any suspicious activity.In addition to the security concerns, developers should also consider performance issues presented by GraphQL. Since GraphQL queries can be highly complex and customized, it can be challenging to optimize them and ensure that they are performing as intended. To address this issue, developers can employ batching and caching techniques to reduce the number of requests to the server.<h2 dir="ltr">Conclusion</h2>GraphQL is a powerful technology that, when implemented correctly, presents an extremely elegant methodology for data retrieval with several advantages over RESTful APIs. Due to the amount of queries and their complexity, GrqphQL is also prone to some security and performance issues that developers need to be aware of. By implementing the right mitigation strategies, developers can ensure that their GraphQL APIs are secure, reliable, and performant. Overall, GraphQL is a powerful tool that can help developers build more efficient and flexible applications, but it&#39;s important to approach it with caution and take the necessary steps to mitigate potential issues.<hr><h2 dir="ltr">References</h2>GraphQL, 2023.&nbsp;Homepage.&nbsp;[Online]&nbsp; Available at: https://graphql.org/

GraphQL is a query language that provides a more efficient, powerful, and flexible alternative to RESTful APIs (GraphQL, 2023). A RESTful API is an architectural style for an application program interface (API) that employs HTTP requests to access and use data.

What is GraphQL? Pros and Cons, Top Security Issues, and Mitigation Strategies

This article provides a detailed overview of the Modbus TCP protocol fundamentals, communication, data representation, security, daily life applications, and integration.

Modbus TCP: A Comprehensive Guide to the Protocol and Its Applications

Exploring the design, development, connectivity, security, and more aspects of IoT devices

Internet of Things: A Comprehensive Guide to its Engineering Principles and Applications

<h1 id="isPasted">What Is Secure Boot?</h1>In the context of Internet of Things security, Secure Boot refers to the process of authenticating a device&rsquo;s firmware and operating system against a known secure cryptographic key placed on the device at the time of manufacture. This authentication occurs every time the device is booted to validate that the firmware or code being loaded is the legitimate version that was placed there by whoever produced it.With Secure Boot, a bad actor who gains physical access to a device embedded in an IoT system or product would be unable to boot the device with their own modified firmware or bootloader, as this wouldn&rsquo;t cryptographically match the secure key implemented by the manufacturer.<h3>Why Is Secure Boot So Important for IoT Device Security?</h3>Secure Boot is one of the most important security features in any IoT product. When physical products are connected to the Internet, they become vulnerable to cyberthreats&mdash;as such, manufacturers must not only consider physical security, but also cybersecurity practices pertaining to the device firmware, connectivity, and application ecosystems that surround their products.One of the most common attack vectors for physical devices involves a bad actor getting physical access to an IoT device or gaining remote access via a port scan. Once they do this, they can assume control by booting the device with their own firmware. This can lead to undesirable device behavior, stolen business or customer data, or loss of the device.Secure Boot makes this difficult&mdash;if not impossible&mdash;because the device is signed with a cryptographic key when it&rsquo;s manufactured. If the firmware doesn&rsquo;t match the key, the device simply won&rsquo;t work, thereby thwarting the bad actor.Check out our&nbsp;<a href="https://www.particle.io/iot-guides-and-resources/iot-security-checklist/" rel="noopener" target="_blank">IoT security checklist</a> for more common threats to IoT products.<h1>How Does Secure Boot Work?</h1>Secure Boot can be thought of as a series of validation layers that mutually check each other when a device powers on and loads its embedded software. A lot of physical device attacks take the form of manipulating the boot process into causing the device to behave in an incorrect manner, perhaps by loading manipulated software.<img src="https://s3-us-west-1.amazonaws.com/wevolver-project-images/froala%2F1688035271667-01-Secure-Boot_Particle__1_.webp" style="width: 766px;" class="fr-fic fr-dib">By using cryptography to protect the initial bootup instructions via strong encryption and then authenticate the next layer of instructions via digital signatures, a device will not allow itself to boot up modified or unsigned software. The P2 is the first Particle product to ship with the initial version of secure boot enabled, with more features to support additional layers on the way.At Particle, we&rsquo;ve always performed a cloud-side firmware integrity check&mdash;meaning that when a device comes online and connects to our device cloud, we validate that the installed firmware matches what is expected of the code.The Secure Boot process allows for a bottom-up check in addition to Particle&#39;s top-down approach, allowing the device to perform cryptographic validation offline before a cloud connection is established. This dual approach makes for a highly secure platform suitable for a variety of hardware applications.<h1>Examples of Secure Boot in Action</h1>So, which industries are designing products with Secure Boot functionality?<h3>Electric Vehicle Charging Manufacturers</h3>Many countries are moving forward with the electrification of the transportation industry. In particular, the U.K.&mdash;which has assumed a leading role in the movement&mdash;is taking great strides to ensure that EV infrastructure is not only widely available but connected.The&nbsp;<a href="https://www.legislation.gov.uk/uksi/2021/1467/part/2/made" rel="noopener" target="_blank">Electric Vehicles (Smart Charge Points) Regulations 2021</a> legislation that took effect in the U.K. on June 30, 2022, requires all public and private EV chargers to be Internet-connected. These regulations include strict&nbsp;<a href="https://www.particle.io/iot-guides-and-resources/ev-charger-security/" rel="noopener" target="_blank">security requirements for connected EV chargers</a>, including Secure Boot. More specifically, all EV chargers will have to support an enhanced security scheme that includes Secure Boot by January 1, 2023.Here&rsquo;s a snippet of the regulatory requirements:*(3) A relevant charge point must be configured so that&mdash; (a) it checks, when it is first set up by the owner, and periodically thereafter, whether there are security updates available for it; (b) it verifies the authenticity and integrity of each prospective software update by reference to both the data&rsquo;s origin and its contents and only applies the update if the authenticity and integrity of the software have been validated;(4) A relevant charge point must be configured so that&mdash; (a) it verifies, via secure boot mechanisms, that its software has not been altered other than in accordance with a software update which has been validated in accordance with sub-paragraph (3)(b) above; (b) if an unauthorised change to the software is detected, it notifies the owner and does not connect to a communications network other than for the purposes of this notification.*In the context of individual EV chargers or charger networks, Secure Boot is a vital security practice that prevents negative outcomes such as:<ul><li>Energy theft</li><li>Impeded charging</li><li>Stolen customer or business data</li><li>Access to system owners&rsquo; home Wi-Fi networks</li><li>Physical equipment and infrastructural damage due to malicious or improper usage</li></ul><h3>Industrial Control and Automation Systems</h3>As demonstrated by ongoing conflicts, the battlefield has evolved to include highly specialized operations against critical infrastructure and industrial control systems. Standards like the&nbsp;<a href="https://www.iec.ch/blog/understanding-iec-62443" rel="noopener" target="_blank">IEC62443</a> have been designed to reduce the risk of malicious actions to these types of devices.It doesn&rsquo;t take much imagination to understand how damaging a targeted attack to critical infrastructure can be, which is why devices that have a direct impact on power, water, gas, and other utilities need to be specifically hardened against both remote and physical attacks.<h1>Implementing Secure Boot in Your Own IoT Products</h1>In this section, we&rsquo;ll dive into the major steps you need to take to build Secure Boot into your IoT products.<h3>Start With Secure Boot-Enabled Devices</h3>Many open source devices and platforms like Raspberry Pi and Arduino run a version of embedded Linux that leading penetration testing company Pen Test Partners said could lead to &ldquo;<a href="https://www.pentestpartners.com/security-blog/smart-car-chargers-plug-n-play-for-hackers/" rel="noopener" target="_blank">easy extraction of all stored data</a>, including credentials and the Wi-Fi Pre-Shared Key.&rdquo;These modules are popular for prototyping, with some companies even using them in their production processes&mdash;but while they&rsquo;re inexpensive and easy to use, they often fall short of reasonable enterprise-grade security standards.Most open source device firmware doesn&rsquo;t come with Secure Boot functionality off the shelf, and it&rsquo;s hard to tell if the proper security steps have been taken when devices are sourced from third-party manufacturers. This leaves devices open to bad actors who can get root access to the device firmware, run their own firmware on it, and assume device control as a result.That&rsquo;s why hardware security must be your first concern when evaluating devices.Because Particle owns its manufacturing and production capacities, every Particle device is signed with an individual key at the time of manufacture that&nbsp;ensures compliance with most Secure Boot requirements.Our Secure Boot mechanism is backed by&nbsp;<a href="https://www.fortanix.com/company/pr/2022/01/fortanix-announces-industry-first-100th-production-customer-for-confidential-computing" rel="noopener" target="_blank">Fortanix HSM</a>, which is used in highly secure communications devices for enterprise and government use. Our newest&nbsp;<a href="https://www.particle.io/devices/enterprise-iot-wifi-modules/" rel="noopener" target="_blank">IoT Wi-Fi modules</a>, the Photon 2 and P2, are manufactured with built-in encrypted flash and&nbsp;<a href="https://www.arm.com/technologies/trustzone-for-cortex-a" rel="noopener" target="_blank">ARM TrustZone</a> technology.<ul><li>Encrypted flash prevents malicious actors from taking chips off the board and reading their contents, as everything is garbled without the key set at the factory.</li><li>ARM TrustZone is a well-known mechanism that provides a layer&mdash;or &ldquo;zone&rdquo;&mdash;of trust between the secure device functions and the operating system. With it, the parts of the device that generate cryptographically secure keys and the general user space where you write your firmware are separated by a layer of abstraction, ensuring the areas that require absolute integrity cannot be manipulated.</li></ul>Check out our in-depth comparison of&nbsp;<a href="https://www.particle.io/compare/particle-vs-arduino/" rel="noopener" target="_blank">Particle vs. Arduino</a> to see how Particle provides an extra layer of security out of the box.<h3>Use a Hardened and Stable Device Operating System</h3>Open source OSs often expose code irrelevant to a device&rsquo;s function, which makes the device vulnerable to potential threats like port scans. If you don&rsquo;t have a team that knows how to reduce the attack surface of the device firmware, you may unwittingly expose yourself&mdash;and your customers&mdash;to cyberthreats.By contrast, Particle devices come pre-integrated with our embedded IoT operating system, Particle Device OS, which includes:<ul><li>Minimal attack surface. Particle Device OS has no open ports and leverages only services that are essential to connect to the Particle Cloud. By removing the extra fluff included in most open source OSs, Particle Device OS is secure and ready to use right out of the box.</li><li>Abstracted APIs. Particle Device OS abstracts the complex integration among microcontrollers, modems, peripherals, verified libraries, and your application firmware, setting up your product&rsquo;s physical device to work seamlessly and securely.</li><li>Long-term support versions. Particle Device OS LTSs are independent branches of the operating system that are feature-frozen in time&mdash;in other words, they do not receive updates with new features, API changes, or improvements that change device function or standard behavior. These versions are covered by an extended support window to address bugs, regressions, and vulnerabilities.</li><li>Over-the-air updates. Particle OTA Services lets you push OTA updates with a single line of code or a few clicks, making it simple to add new features, respond to security vulnerabilities, and change product behavior after you&rsquo;ve shipped. Learn more about&nbsp;<a href="https://www.particle.io/iot-guides-and-resources/iot-ota/" rel="noopener" target="_blank">IoT OTA updates</a>.</li></ul><h3>Build a Secure and Encrypted Data Pipeline</h3>Security doesn&rsquo;t just happen directly on the device; the cloud side must also provide an extra layer of security through integrity checks to verify that the correct version of the firmware is running when the device boots. If an unexpected input or code change appears, your cloud solution should prevent booting and alert you.Particle Cloud, our secure and reliable&nbsp;<a href="https://www.particle.io/platform/particle-cloud/" rel="noopener" target="_blank">IoT device cloud</a>, does this for you as soon as you turn on any Particle device.Here&rsquo;s what Particle Cloud provides from a security standpoint:<ul><li>The modules are&nbsp;bound to your account only, with limited access and two-factor authentication employed for secure access to the cloud management interface. Your devices cannot be moved to another account for OTA reprogramming, and only you can unclaim a device from your account.</li><li>Devices are paired with the cloud platform and&nbsp;reverse-connect to a trusted endpoint used for further connectivity.</li><li>Devices are authenticated as they connect to the cloud using&nbsp;public key cryptography. This process assures that the cloud is what it purports to be and is not rogue.</li><li>Particle Cloud&nbsp;knows what firmware to expect. If that firmware doesn&rsquo;t show up when the device connects, the cloud will&nbsp;intervene in real time to fix the issue with an update, thereby protecting against firmware modification attacks.</li><li>Particle Cloud&nbsp;doesn&rsquo;t store event payloads or any proprietary information belonging to you or your customers. Rather, storage is limited to diagnostic data that is used solely to ensure optimal device performance and gets auto-purged regularly.</li></ul>Secure Boot is a foundational practice for securing IoT devices and products. Don&rsquo;t let your devices live out in the field with critical vulnerabilities&mdash;equip your products with Secure Boot-enabled devices and an integrated IoT Platform-as-a-Service to easily ship products without compromising security.

Learn why Secure Boot, a process for authenticating IoT device firmware, is critical for building safer connected products.

What is Secure Boot? The Foundation of IoT Security.

In this episode, we discuss how MIT researchers tackle the problem of counterfeit seeds by using unclonable labels made of silk nanoparticles. These labels help ensure that farmers are using genuine seeds, preventing losses and maintaining the integrity of crops.&nbsp;<iframe height="200px" width="100%" frameborder="no" scrolling="no" seamless="" src="https://player.simplecast.com/b84075c2-bd3c-4a8f-b96b-c8dc6a2caa81?dark=false" class="fr-draggable" data-lf-form-tracking-inspected-kn9eq4roawkarlvp="true" data-lf-yt-playback-inspected-kn9eq4roawkarlvp="true" data-lf-vimeo-playback-inspected-kn9eq4roawkarlvp="true"></iframe> <hr>EPISODE NOTES(0:40) - <a href="https://www.wevolver.com/article/tackling-counterfeit-seeds-with-unclonable-labels" target="_blank">Tackling counterfeit seeds with &quot;unclonable&quot; labels 🌱🔐</a><hr>As always, you can find these and other interesting &amp; impactful engineering articles on Wevolver.com.To learn more about this show, please visit our<a href="https://www.wevolver.com/profile/the.next.byte" target="_blank">&nbsp;shows page</a>. By following the page, you will get automatic updates by email when a new show is published. Be sure to give us a follow and review on<a href="https://podcasts.apple.com/nl/podcast/the-next-byte/id1548255861?l=en" target="_blank">&nbsp;Apple</a> podcasts,<a href="https://open.spotify.com/show/6lPPsRtegnivsRUEsQ09R7?si=IPMiah7xT_apJtPjqvXMlA" target="_blank">&nbsp;Spotify</a>, and most of your favorite podcast platforms!

As a way to reduce seed counterfeiting, MIT researchers developed a silk-based tag that, when applied to seeds, provides a unique code that cannot be duplicated. Credit: Photograph courtesy of the researchers. Edited by Jose-Luis Olivares, MIT

In this episode, we discuss how MIT researchers tackle the problem of counterfeit seeds by using unclonable labels made of silk nanoparticles.

Podcast: Authenticating Seeds To 5X Crop Yields

This is the third&nbsp;article in a&nbsp;<a href="https://www.wevolver.com/article/iot-needs-trust-the-current-state-of-iot-security" rel="noopener noreferrer" target="_blank">3-part series</a>&nbsp;that explains the current state of IoT security and introduces cutting-edge, highly secure MCUs from Alif SemiconductorTM.&nbsp;There is a surge of interest in Machine Learning (ML) and Artificial Intelligence (AI) applications. This interest is partly driven by the explosion in data generation, which enables modern enterprises to access very large volumes of digital data from a variety of different sources, such as business information systems and internet-connected devices. Based on these data, enterprises can develop ML systems that exhibit better performance than ever before.Introducing edge machine learning (EdgeML)Until recently, most ML systems and applications were deployed within cloud computing infrastructures. This provided the means for managing large volumes of data while easing access to the computing capacity needed for training and executing ML models. In recent years there has been a shift of data from remote cloud data centers to local edge clusters and devices, i.e., a shift to the edge computing paradigm. This shift is motivated by the need to support real-time and power-efficient applications that operate close to the field instead of transferring large volumes of data to the cloud. The advent of edge computing has given rise to EdgeML, a novel paradigm for developing and deploying ML applications. Rather than moving data over wide area networks and running ML models inside the cloud, EdgeML applications execute models within various edge computers and devices. This includes edge clusters, gateways, embedded devices, Internet of Things (IoT) devices, and microcontrollers.ML designers leverage edge computing and edge ML to achieve the following benefits for their applications:<ul><li>Low-Latency Operations for Mission Critical Tasks: Edge processing can be much faster than cloud processing, as it does not incur the latency of transferring data from the source to the cloud. This makes EdgeML suitable for low-latency applications such as real-time identification of abnormal human behaviors in surveillance applications and real-time defect detection in manufacturing processes.&nbsp;</li></ul>EdgeML applications can also benefit from the capacity of cloud computing when required. Specifically, it is possible to collect, aggregate, and process data points from multiple edge devices in the cloud. This enables cloud/edge designs and deployments to leverage many data points toward building, training, and executing accurate data models.<h3>EdgeML security challenges</h3>ML designers are commonly resorting to EdgeML configurations to enhance the privacy and data protection advantages of their applications when compared to the respective cloud applications. This is because edge configurations reduce data transfers, which limits the attack surface of the ML applications. EdgeML applications keep sensitive data at their source, which reduces the number of potential data breaches.Despite these benefits, EdgeML deployments create new security challenges for EdgeML designers, notably challenges associated with the peculiarities of their data sources and edge devices (e.g., IoT devices). This is because edge devices cannot benefit from the security protection functionalities of the cloud data center. Rather they reside at the edge of the network where fewer protective measures are deployed. This renders sensitive information and the devices themselves vulnerable to a variety of security threats. &nbsp;Therefore, EdgeML designers must consider and remedy prominent vulnerabilities of edge ML devices, including:<ul><li>Malware attacks: In EdgeML deployments, there are always opportunities for adversaries to use malicious code to hijack devices.&nbsp;For example, an attacker may maliciously install older firmware with known security vulnerabilities.</li><li>Data theft: &nbsp;Edge devices are vulnerable to breaches that lead to data theft. For instance, cybercriminals can bypass encryption to steal sensitive data.</li><li>IP theft: There are also cases where malicious parties attempt to steal Intellectual Property (IP) such as software code, ML models, and algorithms. One of the best ways to do this is to breach the memory protection of the device.</li><li>Rollbacks to Vulnerable Firmware:&nbsp;Adversaries can also replace a device&rsquo;s firmware with an older version that has known security weaknesses. In this case, they can compromise the device without getting easily noticed.</li><li>Device Cloning: It is also possible to copy the identity code of the device to manufacture illegal copies of it. This can occur in several ways, such as leveraging software vulnerabilities in different systems that share source code or libraries . Illegal copies with the counterfeit identity code then look like legitimate devices. This is another way to compromise an enterprise&rsquo;s IP and reduce its product revenue.</li><li>Network Breaches: Internet-connected devices are also vulnerable to networking attacks. For example, hackers are likely to spoof the device&rsquo;s authentication to gain access and commit hostile actions.&nbsp;</li><li>Attacks against ML models: EdgeML deployments are also vulnerable to attacks that compromise the operation of ML models. For example, hackers can poison the training data to compromise the proper operation of an ML model. Malicious parties can also compromise the operation of deep neural networks by means of adversarial inputs that cannot be correctly classified. This is commonly known as an evasion attack.&nbsp;</li></ul>In a world with billions of IoT devices, these challenges can lead to large-scale problems and security attacks. Back in 2016, <a href="https://en.wikipedia.org/wiki/Mirai_(malware)" target="_blank">the Mirai malware</a> was used to compromise thousands of IoT devices, which formed a botnet and launched Distributed Denial of Service (DDoS) attacks. This had severe consequences for major internet service providers and made popular sites (e.g., Twitter, Amazon, Spotify, Netflix, Reddit) unreachable to some users. As these types of attacks become more frequent, it is important that edge ML designers devise effective solutions to the unique security challenges of EdgeML applications.<h3>Popular security solutions for edge applications</h3>To alleviate the security vulnerabilities of non-trivial EdgeML systems, EdgeML designers can implement various security solutions and controls. These solutions address security at different levels (e.g., operating system, application, network) towards remedying vulnerabilities and threats of different natures. A representative set of such solutions and controls follows:<ul><li>Data Encryption: Data encryption is key to safeguarding data at rest. Effective encryption solutions partition data according to their type (e.g., IoT data, device logs, ML models) and provide support for multiple integrity checks. Moreover, they decrypt data only for authenticated users from a small set of origins and trust domains.&nbsp;</li><li>Distributed Key Management: To strengthen the effectiveness of the encryption mechanisms, there are security solutions that split unique random keys into parts that reside in different locations. The different pieces of the keys are integrated in memory for short amounts of time only, which makes it very hard for adversarial parties to tamper with them and gain access to the encryption and decryption operations.</li><li>Operating System (OS) Security Solutions: OS level solutions ensure that the device runs the most secure version of its operating system. In this direction, IoT and security vendors design and implement secure &ldquo;hardened&rdquo; configurations of the OS. This entails tasks like removing packages that are not needed, creating and configuring encrypted partitions, configuring stringent data access policies for OS functionalities, and embedding advanced monitoring and logging features within the OS.</li><li>Application-Level Security Solutions: These solutions protect ML applications against different forms of tampering. For instance, they implement multi-factor authentication that makes it very difficult for hackers to gain access to ML models and applications. Multi-factor authentication requires users to supply multiple authentication credentials (e.g., passwords, PIN codes), beyond physical access to the device. As another example, application-level security ensures the use of secure components (e.g., libraries) for the application at hand, as well as support for the secure downloading of components (e.g., ML models) to prevent data and IP theft.</li><li>Network-Level Security Solutions: At this level, solutions aim at ensuring secure communications between edge devices and other applications. In this direction, measures like mutual authentication of applications or devices, Transport Level Security (TLS) over Virtual Private networks (VPN), and encryption of sensitive data exchanged over the network are usually implemented. Moreover, special provisions for secure communications that perform firmware updates are made to alleviate malicious changes to the device firmware.</li><li>ML-Level Security Solutions: Solutions at this level safeguard the model training process. In this direction, they can use unique encryption keys to safeguard the security and confidentiality of the device&rsquo;s communication with the backend computer where the training takes place. This is important for alleviating poisoning attacks. Moreover, the parameters of the ML models are encrypted and obfuscated, which renders any interception attempt useless. &nbsp;</li></ul><h3>Putting the solutions to work in practical use cases</h3>A balanced combination of the above-listed multi-level security solutions is required for every practical ML design and deployment. Consider, for example, the design and deployment of ML-based security and surveillance solutions in smart city environments. These solutions leverage edge computing and edge devices (e.g., cameras) to provide real-time detection of events. For instance, camera feeds are typically processed at the edge to identify license plates and abnormal behaviors of vehicles and citizens. To this end, ML-based computer vision algorithms are deployed within the edge devices.Such deployments are susceptible to a variety of attacks. For instance, an adversary could gain access and deploy malware on the cameras to change their functionality. Strong authentication measures and network-level security are therefore required.&nbsp;As another example, hackers could attempt to steal sensitive data, such as license plates of vehicles in a specific crossing or even the ML models used for detecting abnormalities. The risk of such attacks can be minimized based on secure configurations of the device and proper encryption measures. Similarly, network security and OS-level measures can significantly reduce the risk of malicious firmware updates. Furthermore, ML-level measures can avoid changes to the operation of the ML models and eventually to the proper operation of the security and surveillance applications.<img src="https://images.wevolver.com/eyJidWNrZXQiOiJ3ZXZvbHZlci1wcm9qZWN0LWltYWdlcyIsImtleSI6ImZyb2FsYS8xNjc1ODgyODk0MzMxLUZpZ3VyZS1zaG93cy1zb21lLXJlc3VsdHMtb2Ytb3VyLWVuZC10by1lbmQtbGljZW5zZS1wbGF0ZS1kZXRlY3Rpb24tYW5kLXJlY29nbml0aW9uICgxKS5wbmciLCJlZGl0cyI6eyJyZXNpemUiOnsid2lkdGgiOjk1MCwiZml0IjoiY292ZXIifX19" style="width: 725px;" class="fr-fic fr-dib">License plate detection requires rigorous security. Image credit:&nbsp;<a href="https://www.researchgate.net/profile/Zain-Masood-4" rel="noopener noreferrer" target="_blank">Zain Masood.</a><h3>Alif semiconductor security solutions&nbsp;</h3>Alif provides world-class, scalable, and integrated security solutions for state-of-the-art EdgeML deployments. The company&rsquo;s solutions alleviate the earlier presented challenges based on a rich set of security features and functionalities:<ul><li>Secure boot against malware attacks: In Alif&rsquo;s EdgeML deployments, all code images are signed prior to their deployment and use in edge devices. Moreover, granular firewalls are configured and used to protect assets like the device&rsquo;s memory and Central Processing Units (CPUs). &nbsp;Also, the entire security process employs granular controls for each asset in isolation.</li><li>Data encryption to prevent data theft: Alif&rsquo;s provides strong encryption for both data within the device and data transmitted over the device&rsquo;s network. Hence, it is pointless for a hacker to access the data without the required private key. Alif provides TLS security and uses Public Key Infrastructure (PKI) certificates to protect the payloads of sensitive data.</li><li>Code encryption to prevent IP theft: Similar to the data theft case, in Alif&rsquo;s solutions IP theft is avoided thanks to code encryption. The company&rsquo;s security solutions provide proper in-memory interfaces in support of code decryption in real time. Hence, the solution does not impose any performance penalty on the EdgeML application performance.&nbsp;</li><li>Secure network communications:&nbsp;Alif minimizes the risk of network breaches based on support for bi-directional cloud-network authentication. The authentication process leverage certificates verified with a proper Certificate Authority. Moreover, signatures of trusted servers are stored to ensure that all network communications originate from and terminate at trusted computers and devices.</li><li>Hardware Unique Key (HUK) prevents device Cloning: Alif programs all devices based on a HUK. The HUK is generated at the factory and its authenticity is verified by a special security subsystem of the device. This makes it impossible to clone the device.</li><li>Authenticated and signed software versions: Alif&rsquo;s security solutions do not permit the downgrading of a device&rsquo;s firmware. They only allow the loading of equal or later versions of the firmware. In this direction, Alif provides mechanisms for authenticating (&ldquo;signed&rdquo;) software versions by means of a proper signature.</li></ul>The above-listed measures enable EdgeML designers to implement a holistic, end-to-end approach to safeguarding the operation of large-scale EdgeML applications, even in the light of stringent security requirements.For more information about Alif&rsquo;s products and services for state-of-the-art cloud/edge computing deployments, visit <a href="https://alifsemi.com/ensemble/" rel="noopener noreferrer" target="_blank">Alif&#39;s website.</a>This is the third article in a&nbsp;<a href="https://www.wevolver.com/article/iot-needs-trust-the-current-state-of-iot-security" rel="noopener noreferrer" target="_blank">three-part series</a>&nbsp;examining IoT security problems and solutions as of today.&nbsp;<a href="https://www.wevolver.com/article/iot-needs-trust-the-current-state-of-iot-security" rel="noopener noreferrer" target="_blank">The first article</a> provided an overview of the current state of IoT security.&nbsp;<a href="https://www.wevolver.com/article/how-cutting-edge-microcontrollers-build-security-from-the-ground-up" rel="noopener noreferrer" target="_blank">The second article</a> introduced Alif&#39;s latest product.&nbsp;<h2>About the sponsor: Alif Semiconductor</h2>Alif Semiconductor is the industry-leading supplier of the next-generation Ensemble family of 32-bit microcontrollers and fusion processors. Ensemble scales from single core microcontrollers to a new class of multi-core devices, fusion processors, that combine up to two Cortex-M55 MCU cores, up to two Cortex-A32 microprocessor cores capable of running high-level operating systems, and up to two Ethos-U55 microNPUs for AI/ML acceleration. The Alif Ensemble family delivers increased AI/ML efficiency, lowers power consumption, and provides multi-layered security to keep your data safe, all while offering a scalable processor continuum.<img src="https://images.wevolver.com/eyJidWNrZXQiOiJ3ZXZvbHZlci1wcm9qZWN0LWltYWdlcyIsImtleSI6ImZyb2FsYS8xNjc1ODgxOTU1MjEyLTE2NzU4ODE5NTUyMTIucG5nIiwiZWRpdHMiOnsicmVzaXplIjp7IndpZHRoIjo5NTAsImZpdCI6ImNvdmVyIn19fQ==" class="fr-fic fr-dii"><div id="_com_5" language="JavaScript"> </div>

With more IoT devices performing mission-critical tasks - security is essential. To achieve the potential of smart devices that implement ML and AI in their applications, we must protect the critical intellectual property that represents the majority of the solution’s value. 

Security Guide for Edge ML Designers

Alif Semiconductor’s™ microcontrollers meet the market need for low-power, AI-enabled embedded solutions with unmatched levels of multi-layered security, and a fully integrated secure element.

How cutting-edge microcontrollers build security from the ground up

Our love affair with smart devices has led to an explosive growth in the number of devices we surround ourselves with. But whereas they allow us to keep an eye on our homes when we are away or help us track the expiry date of items stored in our fridges, they also leave us vulnerable to intruders, who can use them to hack their way into our homes.For instance, if we choose weak passwords for our internet-connected smart devices or fail to update their security systems, we risk creating access points for hackers.Once a malicious mind has entered your network via devices such as security cameras or fridges, they can try to exploit you by taking charge of your computer and encrypting files until you pay a ransom to have them decrypted. Or they could use your network as a gateway to harm others by orchestrating attacks from hundreds of thousands of hacked devices simultaneously.<h2>Identifying digital ghost ships</h2>In a new project, DTU Associate Professor Emmanouil Vasilomanolakis aims to develop a method that can detect such &lsquo;digital ghost ships&rsquo;&mdash;devices in the sea of smart electronics that have been neglected and pose a security threat. As he explains: Knowing where they are is crucial to alerting the owner so they can either make them safe to use or disable them.&ldquo;We believe that digital ghost ships are a real security threat,&rdquo; he says.Emmanouil Vasilomanolakis coined the term digital ghost ship, which references the ghost ships of the seas&mdash;vessels that have no crew on board to safely steer them.It&rsquo;s not just in people&rsquo;s homes that gadgets with poorly maintained security features pose a problem. In fact, the stakes are often much higher for businesses and organizations that use and rely on smart devices if an intruder gets through and creates havoc.Emmanouil Vasilomanolakis points out that the healthcare industry is a good example: &ldquo;Hospitals use more and more devices that need internet connectivity. If these devices are hacked and stop functioning, we may have a life and death situation.&rdquo;He explains that even cheap devices such as surveillance cameras for your home that can&rsquo;t do much can be powerful tools for hackers &ndash; especially if they gain access to a large number of devices at the same time and use them to stage an attack on another target:&ldquo;If you can access only one device, it&rsquo;s not a very powerful attack. But of course, if you can use one million devices, that creates a serious security threat.&rdquo;Such attacks can be used to e.g., force authorities&rsquo; websites offline, as was seen when Chinese hackers &nbsp;managed to temporarily force Taiwanese government websites offline during the visit of US speaker of the House of Representatives, Nancy Pelosi, to Taiwan in August. Hackers can also use it to cause significant disruption to commercial sites, effectively blocking actual customers from purchasing goods for periods of time.<h2>A more finely meshed safety net</h2>Commercial services are already available that allow users to scan the internet and identify internet-connected devices. Emmanouil Vasilomanolakis aims to create a much more finely meshed safety net that scans and detects only actual digital ghost ships while omitting properly maintained gadgets.The system will also be trained to avoid so-called honeypots and other false positives. A honeypot is a detection system that developers create to attract attackers to a secure system to study their behaviour.The researchers will investigate novel ways of creating network signatures of digital ghost ships. A network signature is a footprint that has been left following unauthorized access. The aim is to enrich these signatures with device fingerprinting capabilities. Collecting such fingerprints provides information about the software and hardware of the device in question, making it easier to identify its type.DTU will collaborate with the University of Cambridge for this part of the project.

Researchers at DTU have set out to create novel tools to identify internet-of-things gadgets that leave the door open to hacker attacks. Knowing where these devices are and making them secure is a powerful weapon in the fight against attackers.

Setting out to sink the internet's digital ghost ships

Most of us are aware that large tech companies such as Google, Facebook, Apple, Microsoft, Twitter, Netflix and Spotify have massive amounts of data about our online behaviour, so they almost know us better than we do. But who else has access to your personal information? It&rsquo;s almost impossible to know, and a new EU-supported project in which DTU is involved wants to change that.&ldquo;The problem is that our data is everywhere, and it is difficult to find out which companies have access to it and have sold it on. We want to make it all more transparent,&quot; says Weizhi Meng, associate professor in cyber security at DTU Compute.DataVaults can be seen as a digital safe where you can store your personal data and control who has access and when. You are notified when companies, authorities or others access your information, and the platform can assess the risks associated with sharing your information in various contexts.Personal data such as your age, gender and address may seem entirely innocent, but if all those details fall into the wrong hands, it can have serious consequences.&quot;In a digitalized world, personal data is the most important asset. If your data has been leaked, hackers can use it to create a false identity of you. They can potentially create fake passports or credit cards in your name or send you targeted phishing emails based on what they already know. That is why it is so important to protect our personal data,&rdquo; says Weizhi Meng.<h2>Businesses&nbsp;are still challenged by GDPR</h2>It&rsquo;s impossible to discuss data privacy without mentioning GDPR. The EU&#39;s legislation on the protection of personal data shook the IT world when it was introduced in 2018 and is still a cause of confusion to many companies. DataVaults can help not only individuals but also companies that can use the platform to collect information in a secure and legal manner about everything from employees to customers and business partners.&quot;It&rsquo;s a big challenge for many companies to comply with GDPR. They don&#39;t know how to implement the GDPR guidelines because it&#39;s very complicated,&rdquo; says Weizhi Meng.A survey by the Council for Digital Security has shown that almost half of all small and medium-sized companies are challenged by the legal requirements for personal data protection, and 67% believe it is difficult to assess how data can be used ethically.&quot;There is no doubt that it has been an uphill battle for the vast majority of companies,&quot; says Henning Mortensen, chairman of the Council for Digital Security.Most recently, the so-called Schrems II ruling in the EU has created uncertainty. In practice, it makes it problematic for businesses to use American cloud services and platforms, such as Google Analytics, because they may transfer personal data to their parent company in the US which is against GDPR regulations.&quot;It&rsquo;s a huge problem for all companies and also authorities, which can make GDPR regulations a major barrier for them. At best, it is unclear what to do when using international services, especially cloud services, and at worst, they cannot use them at all,&quot; says Henning Mortensen.That&rsquo;s why he welcomes an initiative like DataVaults.&quot;There is clearly a need for solutions that can collect data in a way that protects our personal data. It could help create a greater willingness to make one&#39;s data available for public benefit,&quot; says Henning Mortensen.&nbsp;<h2 id="isPasted">Privacy-friendly big data</h2>In essence, DataVaults wants to build up our trust so we can confidently share data without fear of it being misused. There is great potential in big data, where large data sets are used to see new connections, but it must be done responsibly. One of the project&#39;s partners is the French healthcare platform Andaman7, which uses DataVaults to collect data on patients that they use for clinical research.&quot;If you want to look at how many people suffer from a certain disease, we can collect the results but anonymize the individuals,&quot; says Weizhi Meng.Similarly, a Spanish solar cell manufacturer participates in the project and uses DataVaults to obtain data on users&#39; electricity consumption to predict the demand for electricity at different times of the day.But DataVaults also wants to give back the financial incentives to us. Whereas Google and Facebook bring in billions of ad dollars from harvesting our data, users of DataVaults can be rewarded for sharing their data. It could be monetary, but also as the Italian municipality of Prato is doing by rewarding residents who share their cultural preferences and habits with tickets to a performance for instance.However, DataVaults cannot do anything about the information we have already freely given away.&quot;We can protect the data in the DataVaults, but if Google and Facebook already have it, then there is not much we can do,&quot; says Weizhi Meng.<h2>Future solution</h2>After three years, the DataVaults project is coming to an end, and the platform&rsquo;s beta version is now ready. Long term the hope is that the EU or another authority will be interested in taking ownership of the platform, as it requires consumer trust and resources to handle the personal data of potentially millions of people.&ldquo;The more people using DataVaults, the better it will be. When it comes to big data, it obviously works best with as many users as possible,&quot; says Weizhi Meng.In the future, the pressure on our personal data will only increase, and the DTU associate professor believes that, although GDPR is a good start, there is a need to continue to improve the rules and solutions within the protection of personal data.&ldquo;It will only become more important in the future. Suppose we enter the era of the metaverse (virtual worlds in 3D), then personal data becomes the top priority. When everything becomes digitalized, those who have data can control everything,&rdquo; says Weizhi Meng.

We need better control over our personal data if we are to keep hackers and commercial interests from knowing our every move. DTU plays an important role in a large EU-funded research project developing a digital vault that lets you manage who has access to your personal data.

Taking back privacy control

Trustworthy and reliable applications are fueling the worldwide IoT success story. This article explains why protecting IoT edge devices is crucial in an environment with threats on the rise.  


IoT needs trust: The current state of IoT security

You&rsquo;ve probably heard or read about the amazing capabilities of some recent AI models, specifically large-scale language models like <a href="https://openai.com/api/" rel="noopener" target="_blank">GPT</a> (GPT-3 at the time of this writing), <a href="https://www.ai21.com/" rel="noopener" target="_blank">AI21</a>, or <a href="https://huggingface.co/docs/transformers/model_doc/bloom" rel="noopener" target="_blank">BLOOM</a>. Perhaps you&rsquo;ve tried one of these models yourself, either directly or as part of another product. For example, a writing assistant like <a href="https://www.wordtune.com/" rel="noopener" target="_blank">Wordtune</a>, <a href="https://blog.you.com/introducing-youwrite-an-ai-writing-assistant-on-you-com-a9e05080c8ea" rel="noopener" target="_blank">YouWrite</a>, or <a href="https://www.jasper.ai/" rel="noopener" target="_blank">Jasper</a>. Or, more recently, <a href="https://chat.openai.com/chat" rel="noopener" target="_blank">ChatGPT</a>.As their name suggests, large-scale language models (LLMs) were developed and trained with language data. But it turns out that they can be applied to other use cases, outside language. <a href="https://github.com/features/copilot" rel="noopener" target="_blank">GitHub Copilot</a> is probably one of the best-known examples of this. It&rsquo;s a tool that helps you write software. You describe to the model what you want to do, and it suggests code.It&rsquo;s also no big secret anymore that these models are started to get used for <a href="https://mergeflow.net/report?key=16b87a34-a80f-9dc3-0626-407bae0f2938" rel="noopener" target="_blank">drug discovery</a>:<img src="https://images.wevolver.com/eyJidWNrZXQiOiJ3ZXZvbHZlci1wcm9qZWN0LWltYWdlcyIsImtleSI6ImZyb2FsYS8xNjcxMTg4NTY5NjA5LWltYWdlLTEucG5nIiwiZWRpdHMiOnsicmVzaXplIjp7IndpZHRoIjo5NTAsImZpdCI6ImNvdmVyIn19fQ==" style="width: 300px;" class="fr-fic fr-dib"><figure id="isPasted"><figcaption>Mergeflow data on large language models (LLMs) used for drug discovery. <a href="https://mergeflow.net/report?key=16b87a34-a80f-9dc3-0626-407bae0f2938" rel="noopener" target="_blank">Click here</a> to see the report.</figcaption></figure>Probably because of these applications outside language, more and more people refer to these models as <a href="https://mergeflow.net/profiles/fw/search/summary?date=default3&q=gpt-3*%7cgpt3*%7cgpt-j%7cgpt-neo%7cai21%7celeutherai%7cdall-e%7cinstructgpt*%7cwebgpt*%7c%22language+model%22%7c%22language+models%22%7copt-175b%7c%22open+pretrained+transformer%22%7calexatm%7c%22alexa+teacher+model%22%7c%22stable+diffusion%22%7c%22foundation+models%22%7ctext-davinci*%7calphacode%7c%22github+copilot%22%7ccodewhisperer&q=-%22more+explainable+AI%22&fid=10291" rel="noopener" target="_blank">foundation models</a>, rather than language models: They are the foundation for many use cases, not just language-related ones.So, what are some other non-language examples where LLMs, or foundation models, are currently being explored? I used Mergeflow to find out.You&rsquo;ll notice that all my examples below are research papers. This might be an indicator of how nascent the field of &ldquo;doing things with foundation models&rdquo; is. But even if you&rsquo;re a &ldquo;product person&rdquo;, or a &ldquo;company person&rdquo;, I encourage you to take a look: the time it takes to get from research paper to product can be really short when it comes to LLMs.<h2 id="isPasted">Materials discovery</h2>Materials discovery is the process of identifying new materials and understanding their properties. It can help inform decisions about which materials are best suited for particular applications. And it helps accelerate the development process by providing insights into how materials behave under different conditions.I used Mergeflow to research <a href="https://mergeflow.net/profiles/fw/search/summary?date=default3&q=%22Computational+Materials+Discovery%22&q=%22Foundation+Models%22" rel="noopener" target="_blank">foundation models for materials discovery, or computational chemistry</a>, and then zoomed in on research papers that didn&rsquo;t deal with language. For example, I excluded papers on materials-related information extraction from text.This paper, for instance&hellip;<a href="https://arxiv.org/abs/2206.13578" rel="noopener" target="_blank">Materials Transformers Language Models for Generative Materials Design: a benchmark study</a>&hellip;used data from material databases (<a href="https://icsd.products.fiz-karlsruhe.de/" rel="noopener" target="_blank">ICSD</a>, <a href="https://oqmd.org/" rel="noopener" target="_blank">OQMD</a>, and <a href="https://materialsproject.org/" rel="noopener" target="_blank">Materials Project</a>) to predict new materials. The authors verified the materials using <a href="https://mergeflow.net/profiles/fw/search/summary?q=%22DFT+calculations%22%7C%22DFT+calculation%22&date=default3" rel="noopener" target="_blank">DFT calculations</a>. DFT (Density Functional Theory) calculations are used to determine the energy and electronic properties of a molecule (I&rsquo;m not a materials scientist but I assume that this is basically like doing a plausibility check for a hypothesized material).And this paper&hellip;<a href="https://arxiv.org/abs/2211.15895" rel="noopener" target="_blank">Composition based oxidation state prediction of materials using deep learning</a>&hellip;uses LLMs to predict <a href="https://mergeflow.net/profiles/fw/search/summary?q=%22oxidation+state%22%7C%22oxidation+states%22&date=default3" rel="noopener" target="_blank">oxidation states</a> of inorganic materials. The oxidation state of an atom is a measure of its electron-accepting or electron-donating ability. Atoms with a positive oxidation state are electron-donating, while atoms with a negative oxidation state are electron-accepting. According to Mergeflow&rsquo;s data and analytics, oxidation states play a role in battery and fuel cell technology, and in catalyst design:<img src="https://images.wevolver.com/eyJidWNrZXQiOiJ3ZXZvbHZlci1wcm9qZWN0LWltYWdlcyIsImtleSI6ImZyb2FsYS8xNjcxMTg4NjU4ODMxLWltYWdlLTIucG5nIiwiZWRpdHMiOnsicmVzaXplIjp7IndpZHRoIjo5NTAsImZpdCI6ImNvdmVyIn19fQ==" style="width: 300px;" class="fr-fic fr-dib"><figure id="isPasted"><figcaption><a href="https://mergeflow.net/profiles/fw/search/summary?date=default3&q=%22oxidation+state%22%7c%22oxidation+states%22" rel="noopener" target="_blank">Oxidation states</a> play a role in battery or fuel cell technology, as well as for&nbsp;<a href="https://mergeflow.net/profiles/fw/search/summary?date=default3&q=%22oxidation+state%22%7C%22oxidation+states%22&q=catalys%2A" rel="noopener" target="_blank">catalyst design</a>. Screenshot from Mergeflow.</figcaption></figure> <h2 id="isPasted">Cybersecurity</h2>In cybersecurity, an <a href="https://mergeflow.net/profiles/fw/search/summary?date=default3&q=%22attack+packet%22%7C%22attack+packets%22" rel="noopener" target="_blank">attack packet</a> is a piece of data that is used to attack a computer or network. Attack packets can be used to perform a variety of attacks, including <a href="https://mergeflow.net/profiles/fw/search/summary?q=%22denial+of+service%22%7Cdenial-of-service%2A&date=default3" rel="noopener" target="_blank">denial of service</a>, <a href="https://mergeflow.net/profiles/fw/search/summary?q=man-in-the-middle%2A&date=default3" rel="noopener" target="_blank">man-in-the-middle</a>, <a href="https://mergeflow.net/profiles/fw/search/summary?q=phishing%2A&date=default3" rel="noopener" target="_blank">phishing</a>, <a href="https://mergeflow.net/profiles/fw/search/summary?date=default3&q=cyber%2A&q=%22buffer+overflow%22%7Cbuffer-overflow%2A" rel="noopener" target="_blank">buffer overflow</a>, <a href="https://mergeflow.net/profiles/fw/search/summary?q=%22SQL+injection%22&date=default3" rel="noopener" target="_blank">SQL injection</a>, and <a href="https://mergeflow.net/profiles/fw/search/summary?q=spoofing%2A&date=default3" rel="noopener" target="_blank">spoofing</a>.Imagine you&rsquo;re in charge of the security of a system, and you see attack packets hitting your system. And based on what kinds of attack packets you see, you have to infer what kind of attack you might be dealing with.When you do this, chances are you&rsquo;ll see lots of such packets every day. For example, the authors of this paper&hellip;<a href="https://arxiv.org/abs/2209.00263" rel="noopener" target="_blank">Attack Tactic Identification by Transfer Learning of Language Model</a>&hellip;used data from a <a href="https://mergeflow.net/profiles/fw/search/summary?date=default3&q=honeypot&q=-A23%2A%5Bipc%5D%7Cinsect%2A%7Cdisease%7Cfood" rel="noopener" target="_blank">honeypot</a> (= a system that aims to attract attackers and learn more about their tactics and tools) with 227,000 packets per day. Obviously, you need some kind of analytics to help you interpret such volumes of data.And this is where foundation models come in: They used LLMs to learn attack patterns from (text) descriptions of known attacks, and then used the model to classify previously-unseen attack packets. (so this is a &ldquo;borderline case&rdquo; &mdash; yes, the model uses language to train but then is used to classify data that&rsquo;s not language, i.e. the attack packets).<h2 id="isPasted">Building management</h2><a href="https://mergeflow.net/profiles/fw/search/summary?date=default3&q=%22building+management%22&q=-%22building%2C+management+and+communication%22" rel="noopener" target="_blank">Building management</a> refers to the process of overseeing the day-to-day operations of a building. It involves managing the maintenance of the building systems, such as heating, ventilation and air conditioning (HVAC), electrical systems, plumbing, and fire suppression systems. It also includes other aspects, such as tenant lease management, but the focus here is on the infrastructure aspects.Building management is quite an active area of technology, as you can see in the <a href="https://mergeflow.net/report?key=605a0240-4733-54b2-6afe-e479731e41fd" rel="noopener" target="_blank">report from Mergeflow</a> below (click on the screenshot below to get to the report):<img src="https://images.wevolver.com/eyJidWNrZXQiOiJ3ZXZvbHZlci1wcm9qZWN0LWltYWdlcyIsImtleSI6ImZyb2FsYS8xNjcxMTg4NzE2NTQxLWltYWdlLTMucG5nIiwiZWRpdHMiOnsicmVzaXplIjp7IndpZHRoIjo5NTAsImZpdCI6ImNvdmVyIn19fQ==" style="width: 300px;" class="fr-fic fr-dib"><figure id="isPasted"><figcaption>A&nbsp;<a href="https://mergeflow.net/report?key=605a0240-4733-54b2-6afe-e479731e41fd" rel="noopener" target="_blank">&ldquo;building management&rdquo;</a> report from Mergeflow.</figcaption></figure>Perhaps a bit similar to the cybersecurity example above, building management systems produce large amounts, or streams, of data. The challenge then is to interpret the data. For example, given data streams from all kinds of building systems, how do you know where you could optimize energy consumption?The problem is, you need labeled data. In other words, you need to know what certain kinds of data mean (e.g. what do certain combinations of weather and other sensor data mean with respect to energy consumption?). And in order to substantially reduce the amount of hand-labeled data needed for a good model, this paper&hellip;<a href="https://www.mdpi.com/1996-1073/15/23/8894" rel="noopener" target="_blank">Semantic-Similarity-Based Schema Matching for Management of Building Energy Data</a>&hellip;uses a combination of foundation models and&nbsp;<a href="https://mergeflow.net/profiles/fw/search/summary?q=%22active+learning%22&q=%22machine+learning%22&date=default3" rel="noopener" target="_blank">active learning</a>. Active learning is a machine learning technique that focuses on selecting the best samples to query from a dataset, in order to get the most accurate answer with the fewest queries. It involves selecting a small subset of data points and querying them for their values, then using the results to choose the next set of samples to query. This allows the machine learning algorithm to quickly home in on the correct answer without having to query all of the data points initially.

Language models outside language. Image generated by Stable Diffusion.

You've probably heard about the amazing capabilities of some recent AI models, such as GPT, AI21, or BLOOM. Perhaps you use one of these models yourself. Either directly, or through another product like Wordtune, YouWrite, Jasper – or ChatGPT.

It turns out that while these models are trained on language data, they can be used for other applications as well.

In my latest article, you can read more about applications in materials discovery, cybersecurity, and even building management.

Applying large-scale language models outside language: Examples from materials discovery, cybersecurity, and building management

This article is based on a Renesas webinar which you can&nbsp;<a href="https://info.renesas.com/en-securing-your-ip-webinar?utm_campaign=mcu_ra&utm_source=wevolver&utm_medium=article&utm_content=secure_IP_sensitive_data_webinar" rel="noopener noreferrer" target="_blank">access here.</a>&nbsp;<hr><style type="text/css" id="isPasted">
p.p1 {margin: 0.0px 0.0px 20.0px 0.0px; font: 11.0px Arial; color: #000000; background-color: #ffffff} p.p2 {margin: 0.0px 0.0px 6.0px 0.0px; font: 20.0px Arial; color: #000000; background-color: #ffffff} p.p3 {margin: 0.0px 0.0px 12.0px 0.0px; font: 11.0px Arial; color: #000000; background-color: #ffffff} p.p6 {margin: 0.0px 0.0px 18.0px 0.0px; font: 11.0px Arial; color: #000000; background-color: #ffffff} p.p7 {margin: 0.0px 0.0px 6.0px 0.0px; font: 16.0px Arial; color: #000000; background-color: #ffffff} li.li4 {margin: 0.0px 0.0px 12.0px 0.0px; font: 11.0px Arial; color: #000000} li.li5 {margin: 0.0px 0.0px 20.0px 0.0px; font: 11.0px Arial; color: #000000} li.li8 {margin: 0.0px 0.0px 12.0px 0.0px; font: 11.0px Arial; color: #103cc0} span.s1 {font: 7.3px Arial} span.s2 {font: 11.0px Helvetica} span.s3 {color: #0d0d14} span.s4 {background-color: #ffffff} span.s5 {text-decoration: underline ; color: #0000ff} span.s6 {font: 10.0px Arial; color: #18376a} span.s7 {text-decoration: underline ; color: #103cc0} span.s8 {color: #000000} span.s9 {color: #000000; background-color: #ffffff} ol.ol1 {list-style-type: decimal} ul.ul1 {list-style-type: disc}
</style>The Internet of Things (IoT) is no longer a buzzword. Instead, it has become an integral part of our lives. Every sector, from healthcare to manufacturing, uses IoT devices. However, while the total number of devices has been forecasted to reach 83 billion by 2024 [1], the security of these devices remains a significant concern. Without proper security measures, any connected IoT device is vulnerable to a breach, function loss, or hacking to steal user data or manipulate the system. This article examines how IoT security can be addressed with embedded microcontroller units (MCUs).<h2>IoT Security Issues</h2>A core part of the IoT is the connectivity to a network. Through this link, some 1.51 billion breaches of IoT devices took place from January to June 2020 [4]. To combat this, researchers of embedded systems are investigating how to address vulnerabilities of network links. These efforts have resulted in recent security advancements in embedded MCUs.With improved processing on the edge (locally), embedded cryptography, and internet protocol (IP) security, embedded IoT security is helping to protect cloud processing through a network link. This is how IoT security issues are being tackled with embedded MCUs.<h2>Need for IoT Security</h2>As the number of connected IoT devices (nodes) increases, network vulnerability escalates because every node can be a potential entry point for a cyber-attack. Once a vulnerable node is compromised, it can be a link to other nodes,&nbsp;leading to ruinous effects, ranging from minor data breaches to catastrophic information leaks. Infrastructure damage can also occur, resulting in network disruptions and loss of valuable services.Unfortunately, IoT devices do not have a one-size-fits-all solution to their security problems because of the wide variety of hardware and operating systems, and hackers continue exploiting connected devices.However, to understand why IoT security has become paramount, we need a brief overview of possible IoT flaws and their devastating effects. One example we can all relate to is a fitness tracker. Fitness trackers are designed to measure body parameters to assess the user&rsquo;s health and fitness via cloud-based services. This sensitive information could be misused by third parties not at all interested in health improvement. In fact, users are increasingly concerned about their personal data, and, as a result, this kind of data is protected by privacy protection laws worldwide. Security-focused MCUs can help to protect data transmission against eavesdropping by unauthorized parties.<h2>Challenges Addressed by MCUs</h2>To tackle IoT security threats, specific features can be included in embedded MCUs. In particular, embedded MCUs need to address the following challenges for a secure IoT device:<ul><li>Protection of confidential software and data, such as intellectual property and device identity</li><li>Protection of data integrity to safeguard reliable data transmission</li><li>Provision of a robust foundation (root-of-trust) and a local cryptographic toolkit</li><li>Secured end-to-end communication channels</li></ul><h2>How can Microcontrollers Solve IoT Security Problems?</h2>To achieve IoT device security, MCUs comprise both hardware-based security and software mechanisms. Security-focused MCUs need to provide a cryptographic toolkit for the complete chain of security, including a hardware-based root-of-trust, true random number generation functionality in hardware, and user-code authentication.Descriptions of processes that can be implemented on MCUs to improve IoT security are as follows:<h3>Hardware-based security</h3>For secure IoT applications, a hardware-based approach is preferred as it offers an immutable root-of-trust for the IoT device and integrated storage. In addition, it consumes less power than its software equivalent. Hardware-based security uses integrated circuitry to secure the IP and protect the system. For this reason, MCUs for IoT applications have sophisticated integrated hardware security features, such as cryptography blocks, code protection IP, and other hardware-based mechanisms.<h3>Secure key storage</h3>By nature, external memory is vulnerable to attackers wanting to exploit internal functions and confidential data. As a result, plaintext keys require protection from physical and logical attacks. A security-focused MCU offers an integrated flash memory that encrypts data within a secure processing environment, binding the key to only this MCU. In other words, immutable device identity and cryptographic keys are used for device authentication and data encryption. In particular, integrated secure memory is an effective countermeasure against identity spoofing and device cloning.<h3>True random number generation</h3>A true random number generation block obtains a number that is statistically random and based on some physical random variation that cannot be duplicated by rerunning the process. It is an essential cryptographic function required for many security mechanisms and protocols.<h3>Symmetric key encryption and decryption</h3>For a symmetric key cryptographic algorithm, such as the AES (Advanced Encryption Standard), the same key is used for encryption and decryption, called a secret, or private, key[6]. Compared to the asymmetric approach, symmetric ciphers are faster because their keys are significantly shorter and only one is required for the process. However, secure key management is a problem since the secret key is necessary for deciphering, creating vulnerabilities whenever the key is shared.<h3>Asymmetric cryptography</h3>To better secure the management of cryptographic keys, an asymmetric cipher scheme uses a pair of keys instead of one secret key for both sides &ndash; a public key and a private key. The public key used for encryption can be openly distributed without compromising security, and the private key is kept secret by the recipient needing to decrypt a confidential message. This way, key distribution and storage are easier to handle securely than with symmetric ciphers. While asymmetric ciphers are much slower, security-focused MCUs outperform software-only solutions by integrating various technologies, including crypto accelerators, secure key storage, and unique, immutable chip identifiers.<h3>Hash algorithms</h3>A secure hash algorithm (SHA) uses cryptographic functions to condense a dataset to render it unreadable by others. Essentially, a hash is a fingerprint of the original data. An SHA is not reversible, unlike encryption. In addition to this security, if the data are compromised, the hash value will change at the recipient&rsquo;s end, providing evidence of an attack. As an example, hash algorithms are often used for digital signatures.<h3>Digital signatures</h3>Public-key cryptography and hash algorithms are the main ingredients for digital signatures, which authenticate online communication among partners and maintain data integrity, e.g., when confidential messages are transmitted via public networks. Digital signatures are built on certificates for user public keys issued by a trusted third party, i.e., a public-key infrastructure (PKI) offered as a cloud service.<h2>Renesas Microcontrollers</h2>One company contributing to the secure embedded microcontroller revolution is <a href="https://www.renesas.com/us/en" target="_blank">Renesas</a>. Renesas offers a multi-tiered development infrastructure that provides security protection for various embedded products at multiple levels&nbsp;[2].With deep insights and an understanding of the need for improved security, Renesas has doubled down on privacy through advanced MCU technologies, including cryptography. Each Renesas Advanced (RA) Family MCU contains a Secure Crypto Engine (SCE), an integrated crypto subsystem&nbsp;that provides hardware acceleration for the most prevalently used cryptographic algorithms, key generation, and a true random number generator. Renesas binds encrypted keys to a specific MCU, so they are accessible only within the SCE module on the individual MCU that performed key-wrapping. The SCE contains dedicated RAM, which enforces the privacy of plaintext keys by not exposing them to any CPU-accessible bus.Renesas&rsquo;s RA Family MCUs provide a flexible platform combining Arm Cortex-M cores with the company&rsquo;s embedded system peripheral IP. In addition, the RA Family&rsquo;s Flexible Software Package provides optimized HAL (hardware abstraction layer) drivers and a baseline software platform built on FreeRTOS and associated middleware. This option gives designers the flexibility to integrate their middleware and libraries of choice.These new developments have expanded Renesas&rsquo;s portfolio, providing state-of-the-art technology, including MCUs and system-on-chip (SoC) products [5], for a more secure world.Recommended reading:&nbsp;<a href="https://www.wevolver.com/article/securing-your-ip-and-protecting-sensitive-data" rel="noopener noreferrer" target="_blank">Securing Your IP and Protecting Sensitive Data</a><h2>Conclusion</h2>With IoT devices flooding the market faster than their vulnerabilities can be identified, security-focused MCUs offer a viable path for confronting cyber threats on multiple fronts. They present a simplified solution with a security design ecosystem to facilitate point-and-click development environments. These specialized MCUs also reduce the cost overhead and power consumption, two primary considerations in the highly constrained IoT designs.Trusted and reliable data exchange are prerequisites for most IoT use cases. Hence, this calls for improved security in technology as new products are constantly being rolled out every day, especially in the IoT and embedded microcontroller industry.<a href="http://Security from Concept to Production" rel="noopener noreferrer" target="_blank">Read more about IoT security from concept to production here.</a>This article was written with contributions from <a href="https://www.wevolver.com/profile/kersten.heins" rel="noopener noreferrer" target="_blank">Kersten Heins</a>.<h2 dir="ltr" id="isPasted">About the sponsor: Renesas</h2>At Renesas we continuously strive to drive innovation with a comprehensive portfolio of microcontrollers, analog and power devices. Our mission is to develop a safer, healthier, greener, and smarter world by providing intelligence to our four focus growth segments: Automotive, Industrial, Infrastructure, and IoT that are all vital to our daily lives, meaning our products and solutions are embedded everywhere.&nbsp; <img src="https://images.wevolver.com/eyJidWNrZXQiOiJ3ZXZvbHZlci1wcm9qZWN0LWltYWdlcyIsImtleSI6ImZyb2FsYS8xNjY2NTIzMjYyMzUyLXJlbmVzYXMgc3BvbnNvci5wbmciLCJlZGl0cyI6eyJyZXNpemUiOnsid2lkdGgiOjk1MCwiZml0IjoiY292ZXIifX19" style="width: 300px;" class="fr-fic fr-dib"> <h2>References</h2>1. Smith Sam. IoT Connections to reach 83 billion by 2024 driven by maturing industrial use cases [Internet]. 2020 [cited 2022, April 17]. Available from: <a href="https://www.juniperresearch.com/press/iot-connections-to-reach-83-bn-by-2024" target="_blank">https://www.juniperresearch.com/press/iot-connections-to-reach-83-bn-by-2024</a>2. Renesas. How to solve the 6 top security challenges of embedded IoT design. [Internet]. 2019 [cited 2022, April 17]. Available from: <a href="https://www.renesas.com/us/en/document/whp/how-solve-6-top-security-challenges-embedded-iot-design?language=en#:~:text=In%2520Renesas%2520MCUs%252C%2520a%2520flexible,devices%2520in%2520remote%2520manufacturing%2520facilities" target="_blank">https://www.renesas.com/us/en/document/whp/how-solve-6-top-security-challenges-embedded-iot-design?language=en#:~:text=In%20Renesas%20MCUs%2C%20a%20flexible,devices%20in%20remote%20manufacturing%20facilities</a>3. Shea Sharon. IoT security (internet of things security). [Internet]. 2022 [ cited 2022, April 17]. Available from: <a href="https://www.techtarget.com/iotagenda/definition/IoT-security-Internet-of-Things-security" target="_blank">https://www.techtarget.com/iotagenda/definition/IoT-security-Internet-of-Things-security</a>4. IoT Cyberattacks Escalate in 2021, According to Kaspersky [Internet]. 2021 [cited 2022, May 1]. Available from: <a href="https://www.iotworldtoday.com/2021/09/17/iot-cyberattacks-escalate-in-2021-according-to-kaspersky/" target="_blank">https://www.iotworldtoday.com/2021/09/17/iot-cyberattacks-escalate-in-2021-according-to-kaspersky/</a>5. Renesas &amp; dialog semiconductors join forces to advance global leadership in embedded solutions. [Internet]. 2021 [cited 2022, May 2]. <a href="https://www.gsaglobal.org/renesas-dialog-semiconductor-join-forces-to-advance-global-leadership-in-embedded-solutions/" target="_blank">https://www.gsaglobal.org/renesas-dialog-semiconductor-join-forces-to-advance-global-leadership-in-embedded-solutions/</a>6. Secret Key. [Internet]. [cited 2022, September 19]. Available from: <a href="https://www.techopedia.com/definition/24865/secret-key" rel="noopener noreferrer" target="_blank">https://www.techopedia.com/definition/24865/secret-key</a>

IoT security can be addressed with embedded microcontroller units (MCUs).


Solving IoT Security Issues with Embedded Microcontrollers

This is the fifth article of a&nbsp;<a href="https://www.wevolver.com/article/building-electronic-products-with-resilience/" rel="noopener noreferrer" target="_blank">6-part series</a>&nbsp;looking at innovation in the electronics industry.&nbsp; &nbsp;The Internet of Things (IoT) is growing rapidly. According to Statista, there are 42.62 billion IoT devices, sensors, and actuators worldwide as of 2022 &ndash; up from 35.82 billion in 2021 and 30.73 billion in 2020, respectively &ndash; and projected to grow to 75.44 billion by 2025.&nbsp;<style type="text/css" id="isPasted">
p.p1 {margin: 0.0px 0.0px 0.0px 0.0px; font: 11.0px Arial; color: #000000} p.p2 {margin: 0.0px 0.0px 0.0px 0.0px; font: 11.0px Arial; color: #000000; min-height: 12.0px} p.p3 {margin: 0.0px 0.0px 16.0px 0.0px; font: 11.0px Arial; color: #000000} p.p4 {margin: 0.0px 0.0px 4.0px 0.0px; font: 14.0px Arial; color: #333333} span.s1 {text-decoration: underline ; color: #103cc0}
</style>With this massive adoption also comes an increase in security vulnerabilities, as well as cyberattacks targeting IoT devices, which are growing in number and sophistication. According to a Kaspersky analysis shared with <a href="https://threatpost.com/iot-attacks-doubling/169224/" target="_blank">Threatpost</a>, the firm detected more than twice the volume of cyberattacks in 2021 compared to 2020. Notorious high-profile attacks from the Stuxnet worm to the Mirai botnet have led to a growing awareness of the need for more developed IoT security practices.&nbsp;Why are IoT devices so vulnerable? Whose responsibility is IoT security? And what can manufacturers do to design more secure connected devices? &nbsp;In this article we examine these questions and offer some guidance for understanding the complexities of IoT security.&nbsp;<h2>The Importance of IoT Security&nbsp;</h2>IoT devices are both smart and connected, gathering and sharing mass amounts of data on a near constant basis. This makes them a valuable target for bad actors who want to access devices and their data or as a potential back door into their organization&rsquo;s network. The rise in connected devices increases the size of the network, which also increases the attack surface and potential entry points to that network. The growth in data captured and transmitted also grows the amount of data that is stored, processed, and shared, creating more data that can be compromised. These small devices represent a massive increase in potential targets for malicious third parties.Compromises to IoT by threat actors can create a wide array of negative impacts, such as IP theft, damage to brand image, regulatory non-compliance and legal consequences, alteration of proprietary data, sensitive and personal data leaks, total ecosystem unavailability, and more. Furthermore, IoT security differs from traditional data breaches in that the IoT provides a bridge between digital and physical, making it possible for hackers to wreak havoc in the physical world&mdash;such as <a href="https://www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/" target="_blank">taking control of a vehicle</a> or <a href="https://www.csoonline.com/article/3218104/stuxnet-explained-the-first-known-cyberweapon.html" target="_blank">causing a nuclear power plant to melt down</a>. As stated by the <a href="https://reports.weforum.org/global-risks-2015/part-1-global-risks-2015/technological-risks-back-to-the-future/%23view/fn-23" target="_blank">World Economic Forum</a>, &ldquo;hacking the location data on a car is merely an invasion of privacy, whereas hacking the control system of a car would be a threat to a life.&rdquo;<h2>Why Manufacturers Can Mishandle Security for Connected Devices</h2>Manufacturers are creating IoT-connected devices at a rapid pace, but in the process are leaving gaping security holes such as weak passwords and unidentified backdoors. As products are designed to be deployed quickly and win the race to market, security often takes a backseat. According to a <a href="https://www.forrester.com/report/Predictions-2017-Cybersecurity-Risks-Intensify/RES127867" target="_blank">Forrester cybersecurity report</a>, &ldquo;Firms are developing IoT firmware with open source components in a rush to market. Unfortunately, many are delivering these IoT solutions without good plans for updates, leaving them open to not only vulnerabilities but vulnerabilities security teams cannot remediate quickly.&rdquo;It&rsquo;s not just the rush to market that allows vulnerabilities to go undetected in the product design phase. In a competitive market, competitive advantage is often sought through adding more smart features and connecting products to the Internet and/or local networks. However, as new features and connections are added, security is usually downgraded as the attack surface expands.&nbsp;Also, IoT-enabled devices and systems consist of various elements that span different hardware, network types, collected data, software features, and user experiences. Manufacturers often lack the security expertise to plan ahead for such a diverse set of components and potential vulnerabilities. Compared to enterprise IT, IoT is still in its infancy, lacking the same developed and widespread industry best practices.Furthermore, IoT solutions are often deployed in large numbers, sometimes in hard-to-reach physical locations. These factors make it all the more challenging for IT security teams at end user companies to manage potential vulnerabilities, especially as they are often stretched to the limit as it is, and non-IT employees may lack the education to follow security practices for new IoT deployments. Default configurations or an inability to update from manufacturers can lead to security problems for the end user.<h2>Who&rsquo;s Responsible for IoT Security?</h2>When it comes to ensuring the security of IoT devices, where does the responsibility lie? Is it with the consumer or end user? The enterprise or systems integrator? The government?While the responsibility must be shared among all parties, device manufacturers bear much of the responsibility. Manufacturers must ensure that affordability concerns and the rush to market don&rsquo;t override security concerns, integrating a focus on security from early in the design process. The decisions made during the design phase set the horizons for the decisions and capabilities available after deployment.&nbsp;Manufacturers have been collaborating to establish standards for IoT security, and IoT security standards are making their way into law. In 2018, California passed SB 327, an IoT security law which requires manufacturers to provide &lsquo;reasonable&rsquo; security features such as unique passwords. As IoT devices become more widely integrated into everyday life, so will regulations targeting manufacturers to ensure basic security measures.&nbsp;However, manufacturers can go further to design devices with security from the very beginning of the design process. Security-by-design is an approach designers can take to build security into the product from the ground up, making decisions about product development using cybersecurity best practices. This includes minimizing the potential attack surface area, which is composed of all entry and communication points in the software, hardware, and network integrations. The more sensitive an IoT device is, the more security features it should have. Protection mechanisms should be in place in all entry points, by taking steps such as making sure there is no excess code, encrypting traffic, and encrypting binaries.&nbsp;Despite protections delivered in the design process, security can always be diminished by actions of the organization or end user. That&rsquo;s why it&rsquo;s critical for manufacturers to survey any potential risks and effectively communicate them to the integrator or end user. This includes best practices for organizations (such as documentation, firmware updates, and vulnerability testing), and for end users (such as disabling default credentials, using strong passwords, and staying alert for suspicious activity). Working together, manufacturers and users can ensure a more stable and secure system.&nbsp;<h2>Design with Security in Mind</h2>The threat landscape is always changing. For manufacturers and product designers, staying aware of the latest security trends and incorporating them into the design process is key. The best way to stay attuned to these developments and maximize product security is to have the right advisors and trusted industry support. Designers need to be able to rely on good, up-to-date advice from component suppliers and consultants in order to stay ahead of the curve and make good choices when designing new products. By utilizing cutting-edge industry experience, manufacturers can ensure their products are designed with the latest security measures from the beginning.&nbsp;The choices made during the manufacturing phases are crucial, as they determine the characteristics and capacities of the device. Some of these will be immutable throughout the life of the device and will impose strong constraints for the lifecycle of the device. Planning for security from the requirements phase through to the design and architecture phase will enable a strong basis for security to development, integration, deployment, and beyond.Designing a secure connected IoT product requires extensive thought and planning. Security implementation draws upon a multitude of factors, including the type of data being stored and transmitted, the regulatory requirements of the device, the hardware and design limitations, the manufacturing location, expected lifecycle of the device, and more. There is no &lsquo;one-size-fits-all&rsquo; solution; however, designers can draw on support to integrate the latest best practices and developments.&nbsp;<style type="text/css" id="isPasted">
p.p1 {margin: 0.0px 0.0px 4.0px 0.0px; font: 14.0px Arial; color: #333333} p.p2 {margin: 0.0px 0.0px 0.0px 0.0px; font: 11.0px Arial; color: #000000; min-height: 12.0px} p.p3 {margin: 0.0px 0.0px 0.0px 0.0px; font: 11.0px Arial; color: #000000} li.li3 {margin: 0.0px 0.0px 0.0px 0.0px; font: 11.0px Arial; color: #000000} span.s1 {color: #1a1a1a; background-color: #ffffff} span.s2 {text-decoration: underline ; color: #0000ff} ol.ol1 {list-style-type: decimal}
</style><h2>Design in collaboration: Thoughts from &nbsp;Okdo Applications Engineer Raul Hernandez Fernandez&nbsp;</h2>I still remember the spring of 2018, when the news of a careless deployment of a Raspberry Pi created a portal through which a hacker was able to steal files from the Jet Propulsion Laboratory (JPL), probably the most recognizable of NASA&rsquo;s labs. The hacker was able to easily expand their access through the JPL network due to the fact that the Raspberry Pi was already connected to it.According to the <a href="https://www.bbc.co.uk/news/technology-48743043" target="_blank">BBC</a>, the hacker was able to steal restricted information in relation to international traffic in arms regulation and the Mars science laboratory mission, and temporarily to disconnect several space flight related systems from the JPL network. Consequently, one might think that if NASA was hacked what would be my chances of deploying a secure IoT device? At OKdo we recommend the following steps to have better protection than JPL had:<ol><li>Keep your system updated</li><li>Do not auto-login or use empty passwords in your IoT devices</li><li>Change the default password. At OKdo, as responsible manufacturer and distributer, we only distribute sd cards with software images with a unique password procedure</li><li>Disable the default user. At OKdo, as responsible manufacturer and distributer, we only distribute sd cards with software images without a default user</li><li>Stop unnecessary services</li><li>Make sudo required password</li><li>When using SSH prevent root login</li><li>When using SSH change the default port</li><li>Use SSH keys rather than passwords</li><li>Install brute-force attacks detectors like Fail2ban</li><li>Install a firewall like ufw</li><li>Back up your system</li></ol>Learn more about the services and products of Okdo&nbsp;<a href="https://www.okdo.com/" rel="noopener noreferrer" target="_blank">here.</a>&nbsp; <img src="https://images.wevolver.com/eyJidWNrZXQiOiJ3ZXZvbHZlci1wcm9qZWN0LWltYWdlcyIsImtleSI6ImZyb2FsYS8xNjY3MjM4MjI0MjE4LVVudGl0bGVkIGRlc2lnbi0zICgxKS5qcGciLCJlZGl0cyI6eyJyZXNpemUiOnsid2lkdGgiOjk1MCwiZml0IjoiY292ZXIifX19" style="width: 300px;" class="fr-fic fr-dib">

Article #5 Electronics Innovation Series. IoT security is a shared responsibility between chip manufacturers, hardware designers, and the consumer. 

Design With Security in Mind: Why Manufacturers Need to Plan for IoT Device Security from the Beginning

ETH Zurich researchers have discovered a serious security vulnerability in computer hardware. The vulnerability, called &quot;Retbleed,&quot; affects microprocessors from market leaders Intel and AMD. All commercially available operating systems worldwide that use these processors are affected. When computers execute special calculation steps to compute faster, they leave traces that hackers could abuse.&nbsp;Sometimes a computer bleeds from its heart and reveals droplets of private information. That&#39;s the case with the &quot;Retbleed&quot; hardware vulnerability made public today: This vulnerability occurs in the microprocessors that execute the instructions of a computer program and perform the corresponding calculations. In some cases, the processors - namely the central processing units (CPU) - also perform special calculations that shorten the computing time and speed up the overall computing process. In the process, they leave traces in the memory that hackers could exploit to gain unauthorized access to any information in the system - for example, they could steal encryption keys or security-relevant passwords. This is especially risky in cloud environments where multiple companies share computer systems. The National Center for Cyber Security in Bern, Switzerland considers the vulnerability serious because the affected processors are in use worldwide. However, the manufacturers have already taken initial measures to close the vulnerability.The vulnerability was discovered by the doctoral student Johannes Wikner and Kaveh Razavi, ETH Zurich professor for computer security. The name &quot;Retbleed&quot; refers to a certain type of program instructions, called returns. A computer program consists of sequences of instructions or commands organised into functions with which the processors execute the desired calculations. Once a function has executed, a return instruction causes the processor to return to the point in the computer program immediately after the original instruction that used the function.&nbsp;<h2>Speculative computing makes computers faster</h2>You can think of the flow of a computer program as a river with various branches. At the branches, computer programs often make decisions about which branch to choose. Sometimes these decisions take a long time and may slow down execution. What is needed, however, are fast computational processes. Traditionally, a computer program executes instructions sequentially and in the program order - that is, one computational step-at-a-time.<img src="https://s3-us-west-1.amazonaws.com/wevolver-project-images/froala%2F1657807034874-image.imageformat.fullwidthwidepage.1016580014.jpg" style="width: 766px;" class="fr-fic fr-dib">During their tests, ETH cyber security researchers discovered a serious vulnerability in microprocessors. &nbsp; (Photo: ETH Zurich / Computer Security Group)&nbsp;Today&#39;s CPU processor architectures, however, allow computations to be brought forward and executed simultaneously. &quot;A CPU can execute instructions in a different order than the program order to improve computational performance,&quot; says Razavi. In computing circles, this is referred to as &quot;out-of-order execution.&quot; Since January 2018, it has been known that there can be security vulnerabilities with this type of execution. During instruction execution, unauthorized access to the CPU&#39;s cache could occur, allowing hackers to steal sensitive information from the operating system. This vulnerability is known as &quot;Meltdown&quot; and affects specific issues in Intel CPUs.Closely related to out-of-order execution is &quot;speculative execution,&quot; for which similar security issues have also been known since 2018. &quot;&#39;Retbleed&#39; is a speculative execution problem,&quot; says Johannes Wikner. Such speculative execution is used to avoid slowing down computations by bringing forward certain computational steps before it is clear whether they are actually needed. Speculative calculations take place, for example, when a processor tries to guess which path the chain of instructions will take at a branch before this is known. &quot;In this process, CPUs &#39;guess&#39; which direction to take at a branch and speculatively execute instructions based on their guess,&quot; Razavi explains.<h2>Vulnerable return instructions</h2>With the help of such speculations, the flow of the instruction chain is improved and the computing power of the processors is increased. If the speculative calculations are not needed, they are undone. These speculations also leave traces in the cache, which open a backdoor for hackers. This vulnerability was also made public in January 2018 under the name &quot;Spectre&quot; and affects processors from the manufacturers Intel and AMD. Since then, Intel and AMD, as well as major software manufacturers such as Microsoft, have taken mitigation measures. However, the vulnerabilities of the speculative executions have not been conclusively researched or remedied to date.<blockquote>&nbsp;&#39;We have shown that with speculative execution, a particularly large number of return statements are vulnerable and can be hijacked.&#39; &nbsp;- <cite>Johannes Wikner</cite>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;</blockquote>As Wikner and Razavi have now discovered, there is indeed a security problem that has not yet been resolved, &quot;We have shown that with speculative execution, a particularly large number of return statements are vulnerable and can be hijacked,&quot; says Wikner. In principle, &quot;Retbleed&quot; works like variant 2 of &quot;Spectre&quot; and affects Intel and AMD microprocessors. &quot;Since the mitigation measures taken so far did not take the return instructions into account, most existing microprocessor computer systems are vulnerable to &#39;Retbleed&#39;,&quot; Razavi adds. &quot;However, it takes some computer expertise to gain memory access and steal information,&quot; Wikner says.&nbsp;<h2>Solution approach for mitigation measures</h2>In February, Wikner and Razavi provided a proof of concept that &ldquo;Retbleed&rdquo; is a serious problem. They have since published their findings in a scientific paper that has been accepted as <a href="https://www.usenix.org/conference/usenixsecurity22/presentation/wikenr" target="_blank">a USENIX Security 2022 conference papercall_made</a>. In this article, Wikner and Razavi have evaluated Intel and AMD&rsquo;s first approach to solve the problem. This starts from the fact that when the microprocessor speculates at a branch, the instructions are sometimes executed incorrectly. Then the computation does not lead to the correct destination and opens a leak through which hackers might gain access to the information in the memory. The current solution is to prevent hackers from influencing the microprocessors&rsquo; decision on return destinations. Unfortunately, this comes with a substantial performance cost that makes computer 12 to 28 percent slower.As is usual in such cases, the security researchers first informed the affected manufacturers AMD and Intel before the vulnerability was published. Since the specific security risks also depend on the company-specific processor architecture, the manufacturers got their time to take more in-depth mitigation measures. Since then, Microsoft, Oracle, Google, Linux, Intel, AMD, ARM, among others, have worked on protective measures before &quot;Retbleed&quot; was made public today. An Intel microprocessor that is 3 to 6 years old, or an AMD processor that is 1 to 11 years old, is likely to be affected.<hr><h2 id="isPasted">CVE identification number for Retbleed</h2>The National Cyber Security Center (NCSC) in Bern, Switzerland has today assigned the CVE numbers CVE-2022-29900 (for processors from the manufacturer AMD) and CVE-2022-29901 (for processors from the manufacturer Intel) for the security vulnerability &quot;Retbleed&quot; in cooperation and in consultation with researchers from ETH Zurich. The assignment of a CVE (Common Vulnerabilities and Exposure) enables a globally unique identification of vulnerabilities. Since September 2021, the NCSC has been recognized as the Swiss approval authority that assigns CVE numbers.For more information, see the report posted on the NSCS website under the <a href="https://www.ncsc.admin.ch/ncsc/en/home/infos-fuer/infos-it-spezialisten/themen/schwachstelle-melden/advisories.html" target="_blank">&quot;Advisories&quot; sectioncall_made</a>.

When microprocessors perform special calculations - called return instructions - they leave traces in memory that hackers could exploit to gain unauthorized access.   (Photo: Adobe Stock)

ETH Zurich researchers have discovered a serious security vulnerability in computer hardware. The vulnerability, called "Retbleed," affects microprocessors from market leaders Intel and AMD. All commercially available operating systems worldwide that use these processors are affected.