Skip to main content

How Hardware Designers Influence Security for Edge Devices

Published Date
Author Cadence PCB Solutions

embedded AI in smartphone

You don't have to pay much attention to notice the massive increase in electronically connected edge devices over the past decade. Everything from your appliances to your watch and your car can all be networked together, typically with your phone or laptop as the controlling intermediary.

More devices at the edge means a larger attack surface, which means more opportunities for an attacker to access a network or compromise a device. While I wouldn't expect a hacker to start attacking your smart washing machine, the increase in connected devices in commercial and industrial settings demands a fresh look at security, and that includes at the hardware level.

Security policies at the edge have to focus on both hardware deployments and the software that runs on them. Most often, we focus on the software side of security, simply because cybersecurity breaches are so frequent and they tend to make the news. But the hardware side of security is equally important, and this is especially true once you look at industrial, military, and infrastructure deployments.

A Holistic Edge Security Approach

Comprehensive security at the edge has to focus on both the hardware and the software implementations of security policies and countermeasures. You can have the best cybersecurity software and monitoring in the industry, but if the physical hardware itself is compromised, then it may be surprisingly easy to infiltrate a secure network. Also, if you make your hardware maximally secure, but network and software security is lax, someone might be able to bypass the hardware countermeasures and avoid the physical device altogether.

When you look at embedded systems and devices deployed at the edge, there are multiple layers where security policies and best practices are implemented:

  • Physical layer, referring to the hardware device itself as well as it's surrounding location

  • Application layer, referring to the embedded firmware software deployed on the device

  • Network layer, referring to a group of devices and the infrastructure that allows them to communicate

In the past, we rarely worried about physical layer security as most deployments were placed under lock and key, so there might not be easy access to attack hardware assets on a network. Devices deployed in the field are a golden opportunity for attackers, both to reverse engineer an application or to gain access to a network via the edge device.

Security in Integrated Circuits

ICs today have security measures built into them that can provide secure data transmission and verification of device authenticity. Three important approaches to edge device security are outlined below.

Device or chip authentication

  • Use chips with unique identifiers (UID) to prevent spoofing

Secure boot

  • Use digital signatures or hashes to verify code booting

Encryption

  • Use processors with high-end cryptographic engines (e.g., SHA-256 or SHA-512)

IoT networks and edge devices require identification and authentication processes to verify the authenticity of a device’s identity and that the data being sent is from an authentic device. Dedicated cryptographic engines provide services like encryption/decryption, key generation, digital signatures, and authentication. This offloads intensive cryptographic workloads while protecting keys and algorithms. 

Next, booting an application presents an opportunity to inject malicious code into a device that allows an attacker to take over the system. Secure booting utilizes a digital signature or cryptographic hash to validate the authenticity of firmware, operating systems, and software components before they execute. This prevents compromised code from loading.

Edge and IoT devices network and interact with the outside world through external interfaces. These must be secured against data theft and spoofing attacks. Wired and wireless network interfaces should encrypt all communications, and mutual authentication using pre-shared keys or digital certificates provides endpoint validation. Exposure of interfaces on an endpoint device drives security implementation on a PCB.

Security on the PCB

Devices at the edge can be exposed to physical tampering by attackers, and some of these attacks can be prevented with some design choices in the PCB layout and enclosure design. Security starts through optimization, obfuscation, and hardening. Attacks are executed through direct access to physical interfaces on the devices, which enables probing of data and injection of malicious commands.

Optimize to eliminate unneeded connectors, test points, and peripherals; only include the features and exposed copper that is absolutely necessary.

Harden the design so that exposed interfaces are inaccessible without destroying the device; this can be done with underfill, blind/buried routing, or encapsulation.

Obfuscate important components by scrubbing identifying details from exposed packages; make sure the main processor or sensors are not obvious.

In short, any option that can hide or conceal access to physical pins, connectors, or interfaces on a device will help prevent an attacker from accessing data on a device. It also prevents the ability to inject data or malicious code via direct connection to the pins or connections on the device.

Companies that build devices for large-scale edge deployments need a suite of design tools to implement best-practices for physical layer security. Multi-disciplined design teams rely on the best set of PCB design features in Allegro PCB Designer from Cadence. Only Cadence offers a comprehensive set of circuit, IC, and PCB design tools for any application and any level of complexity.

Subscribe to our newsletter for the latest updates. If you’re looking to learn more about how Cadence has the solution for you, talk to our team of experts.