 So we're here at the ARM TechCon and who are you? I'm Miloš Meryak and I'm working on security in the IoT unit and yeah So we're trying to solve problems that people don't know they have currently but they will have soon So you work at ARM on the security of IoT? Yes So we are building components that ensure that if devices get compromised we have a story on how to uncompromise them and return to a trusted state and avoid having people walking around with USB cables and Refleshing let's say thousands of light bulbs in the Building that happen to be infected by malware. This is a big very important job, right? It's really important to get it to work. Yes, because there's only one chance to get it right, no No, the point is that we believe that okay like people are imperfect and Weird things happen. So we need to have an answer how to recover from problems and ideally recover before the attacker essentially Happens to get a chance to roll out an attack on a larger scale So the idea is to make it easy and reliable to for example update firmware and in that way We can guarantee that recovery is possible from these kinds of threats. So it's a essentially two Stage process or a obviously want to avoid that you get the problem in first place. So We invest a lot in like ensuring the quality of our software But once basically which is the second stage of the solution once an attacker can in fact the device Imagine let's say a faulty Bluetooth stack We ensure that the reach of the attacker is limited in a system I think it's not rocket science people do that since ages in browsers and in operating systems But it happened to be that fire T devices currently we still have flat security models and that's what we are trying to fix here So how is that possible? So does I mean? every arm cortex I Mean what it's gonna be like the V8 dash M the future of arm cortex M We'll have some kind of standardization in the design So you can you can remotely update all of the light bulbs or how does it work? So the story is this so you need essentially security from a ground up So you need to start with hardware measures to ensure that the compartmentalization between for example Let's say mutual distressful code So we built not only solutions for our Vietnam, but also backwards multiple solution for MV7M But for MV7M we use a memory protection unit for MV8M We added way more advanced features essentially a secure accelerator that Simplifies these operation a combined metalization and massively accelerates that and every moves Let's say delays by security Features and that allows them to build software on top of that that can guarantee Security compartments between software and the third step is obviously to put something into these boxes that executes on its guarantees for example manages keys performs firmware updates and We make sure through the compartmentalization that for example Let's say just the code block that requires access to the flash controller has access to the firmware flash controller But if I happen to get a malware in the Bluetooth tag the Bluetooth tag wouldn't have access the same controller And that security is then also extended to the bus level which is also a big part of the story for trust on for V8M So does that means V8M is kind of like a big change There's a lot of new things happening with that. Yes, so it's also a change in culture like it's not just about like throwing Essentially hardware out that fixes these problems, but it's also about giving people same example Implementation. Okay, this is how believe it's a good way to use these architectures and giving people's reference implementations Is a different story than just like throwing white papers out this is how we believe stuff should be done So that's I think you a paradigm shift that we are now prescriptive beyond just specification But also provide same example mutations and that of course includes firmware updates because the firmware update again needs to be Protected in the same way. So for example, you don't want to depend on the security of your card provider But you want to have end-to-end security. You don't want to reinvent the wheel for every firmware update method let's say method a for securing Ethernet based update method B for Securing, let's say ZigBee based update another method for USB based update You don't want that you want to have like one concept of reasoning about the validity of a firmware and that is something which we'd like to Provide again as an example mutation to our customers and if it catches on the benefit would be a less fragmented ecosystem and a common way to reason about security Does that increase the price of the Soc of the of the chip no quite the opposite is the way so our strategy is you have to solve the chicken and egg problem so security is something which Deserves to be used even in very very low-end devices. So we're talking about let's say Bluetooth energy M0 plus kind of style. Yes, which could still benefit for example from secure firmware updates, but if I using let's say hashing of firmware of updated firmware for example verifying signatures and Deciding if let's say an attacker tries to downgrade a firmware to a previous firmware Which happens to have known exploits. So it wouldn't benefit from internal security But the language of interactive device and when a security is the same. So there's hardware security added to the Smallest arm processor to the cheapest arm processors and it doesn't increase the cost It's hardware security, but it keeps the cost low. Yes So it's essentially just the next version of the controller But the interesting realization is you can have the same security just with more computing overhead on all the devices as well, right? so In many cases like let's say the execution time of a firmware update Is way longer because of the cost of writing to flash but the time of verifying the update is Negligible because like how often do you update the firmware? Maybe every few months in the worst case Maybe just once in the lifetime of the device. So it's not something which is like speed critical So you might as well implement completing software, but the interesting bit is by adding this Sophisticated security features you can extend its security to bus level So you suddenly don't have to trust even peripherals on the bus anymore and you can get Real-time security which is also an interesting feature to have so imagine like a wireless stack Would benefit from that security Functioning under real-time condition where as you can have a similar of security with existing course without additional cost Just a software feature But it would come at the cost of latency and maybe higher battery consumption So all this security is it an embed OS or where is it in the solution? So in a refer that our defense implementation currently lives in embedded OS embedded OS Most of this component including the second component are available on github. So the important feature is we develop security open essentially to essentially demonstrate We develop a trustworthy environment for protecting Future applications. Is this something that could be inside of a linear or could support this also like Open-source collaboration with all the SSC can collaborate and making Security in the open so this is exactly what we do with your partners So our partners basically we traditionally create like their friends implementation Okay, this is how we believe it should be implemented then basically our partners take that information and port that to a huge range of Supported cortex and platforms the narrow is traditionally more a-class Course and it's more Linux based system as the name Indicates so the the challenge we have there is arm is to make sure that even though you have like Structurally complete different devices. Let's say this high and Linux based devices Which might end up let's say as backbone routers in an IOT environment Or let's say like fat IOT devices with for example screens and 3d graphics and whatnot But you have in the same ecosystem devices on cortex M and very consent devices But they need to be addressed in a common language. So the The Challenge here is to define a language that is compatible to very consent devices also the high end devices So you don't You have like a very smooth ecosystem with essentially very constrained to very high end devices Does it work or you still have a lot of work to do to make it real? Does this mean that arm is going to make firmwares for everybody and what is what is going on? No, so that basically the plan of arm is to create basically the plumbing The the base components the firmware update the the network stacks a lot of that work is done by our partners and Available for example on the corresponding platforms We also create reference implementation of cloud services because you can shift for example power consumption to a cloud service by having a smart Handling of protocol you end up using way less power By using for example, let's say the TLS protocol more intelligently then you would use in a let's say this situation Is this embed connector? Yes, exactly. So that's what it's going to provide security updates to light bulbs and everything So yeah, my connector would be more basically data and like control the light bulb or provision your keys But it would for example you would be also used as a notification channel for firmwares. All right, so What's what's next so what are you doing like in next few weeks and months and what's the plan so yeah The plan is to essentially we created this reference implementation and the next month We will roll it out to our partners and we will help our partners implementing that importing like this few platforms We created our service reference to hundreds and thousands of reference implementations. So things are moving very fast. Yes, and So what's your background? Are you hacker? Yes, I have a colorful security background. Let's leave it at that So is your plan to make a system for the hackers to not be able to do any hacking? No again quite opposite. So we want to create a very open ecosystem So even as a hacker, I appreciate a possibility to protect my code against for example badly programmed Code by potentially the vendor of the system. So it works actually my favor So I can suddenly trust a system because I only have to verify the components I'm actually interested in. So let's say if I would have a component that's essentially In a large RT device that unlocks my front door I don't care so much about the quality of the code in rest of the system because I know it's an open system I can reason about that security and I create can create a secure compartment, which is not only Is protected from the rest of the system, but also in case I do basically Bad security it wouldn't hurt the rest of the system. So it works both ways That's the interesting part here. So one of the things you're enabling is for people to protect their software also Yes, so they can like not have people steal it. What was the what is the objective here is? Imagine You have essentially a function that operates on a cryptographic key So you put basically Effectively a single C function into a secure compartment and that C function can operate on a crypto key So from the rest of the system I can call that API and I can operate on that key But no component in the system can ever get hold of the key. So I get immediate for example the security That that key can't be cloned and so I gain for example Let's say very simple with some very simple means a secure identity service And the other approach would be let's say I have a secure firmware update and I can be sure that only the secure update function has the Possibility to talk the flash controller to perform a firmware update I can be absolutely sure that no other component system can write to the flash and for example make Malware resident and that's something which suddenly becomes much easier to prove the security then let's say if you have a Monolithic blob of 40 kilobytes worth of code where you don't have any defined boundaries So all this Design for the security system. Is it something that's inspired from stuff that it already exists or is it totally new idea? No, and the old ideas It's ideas that are on since like 20 years plus So some people might remember MS-DOS where you had flat security models And it's essentially the last time people ever did that and they restarted that surprisingly again for IoT Where you have very large operating systems which run in a flat memory context and you don't have any Contacts concept of protecting against malicious attacks across this boundary. So it's stuff essentially unix exercise that since ages and I think the last Version that used essentially security model is probably Windows 3.1 So I'm not a hacker, right? But I like to say that it should be possible to make a system that is 100% Secure, is that possible? I can tell you that's never possible. It's never possible It does not make sense zone is not the solution for everything No, because the point is you always make a cost-benefit calculation. So for example, what is an attack? Is an attack having a half a million? essentially ion beam that can erase the top of the chip and essentially Modify individual transistors that would be a valid attack But does it make sense to spend let's say half a million of worth of kids to essentially steal a key? With over device which is only about five bucks. No, it isn't so the point is I need to make it unattractive from attacker to break my device and The reasoning behind that is for example decreasing the benefit of an attack So let's imagine I have a million light bulbs if I put one key in all the light but I have one million Light was the same key the value for an attack of extracting that key out of one device is very high So I can justify for example expanding let's say $20 30,000 on extracting that key So suddenly I have a device which is sold at let's say five dollars But I have to protect it against the attack of thirty thousand dollars It's not going to happen that I can succeed that right in that but what I do instead is I'm smart I make sure that every light bulb has its own key So I break open with my half a million kid this one device and I gained access to a key which is worth five dollars It doesn't make any sense dollars you can control one light exactly not all of them exactly that's for sure It's gonna be like this so the point is it's you see it's basically it's a month essentially It's secured from ground up so you not only have to use the right component from the beginning But you also need to get your security reasoning straight So you can always do silly things and people will do silly things and people will break light bulbs with even much less Investment and thirty thousand bucks, but the point is like if it's designed reasonably the impact of an attack is so unattractive That it's pretty academic to break that device So IOT is a big hype and it's happening, but it's happening even more in the future Yeah, you think it's gonna like if there's some security issues then it's gonna be a big slowdown, right? You think it's gonna be success. Do you think it's gonna work all this stuff? I think it's gonna work. Yes So otherwise it wouldn't be here No, we believe it will work, but I totally agree is it's about building trust So imagine there would be a widespread attack where for example people break essentially a device which is in every household and People would lose trust for a certain time into IOT and it would slow down development So we invest a lot of effort in not Making this happen by educating for example people how to structure the software For example against what threats are you protecting yourself against? So for example, you expect for example different level of security from let's say an IOT light bulb in a residential environment compared let's say to a street light on A city level because obviously can imagine if I can turn on and off as an attacker All the street lights in a city I can blow up a power plant effectively, right? So you don't want to have some Some I will have a different level of security for recently more interesting targets because that's also like an interesting observation Like for an attacker it's about getting credit or making money with an attack. So the more interesting Target is the more likely it will be hacked and I need to have a good answer How to be always one step ahead of an attacker and making his life miserable. I think that's the story At arm are you hiring hackers to come and hack IOT and help you find the Issues you are we are searching for more of them. How do you find them? Oh, we find them