 Okay, so good morning. Welcome to our booth in that embedded world 2020. We've been coming here for five years now and this is an important show for us because we have a lot of customers coming in and also partners. So this year it's a little bit special because the conditions are a little bit special but we are there and we have had good attendance and so my name is Christophe Pagesy. I am the co-CEO of Proven Run. Proven Run specialized in cybersecurity. So we are doing two things to make it simple. We have a leg where we are doing security consulting services. We help companies to understand what is about cybersecurity, what is at stake, what they need to do about it, how they need to protect themselves so that they can take the right measures. So this is pure consulting and that will do with the number of players in the field. The second thing is that we have developed key technologies so that you can protect your devices, usually connected devices from hackers and you have a number of issues related to connected devices and we are working in close relationship with a number of silicon vendors because we pre-integrate our technology on their devices. So one of our key technology partners as a silicon vendor is STM-Microelectronics. So we have been working with them on two sides. First we have been working with them on their well-known STM32 microcontrollers product lines. And here this is an example of the new generation of microcontrollers. It's called Cortex-M33 and ST has been one of the first silicon vendors to come on the market with this new version of microcontrollers. So we have developed a demonstration here. This is very special. This is for the technical people. You have a security zone and we equip that security zone with our proprietary and very secure operating system. And this is a demonstration where we see that in action. So this has been the result of several years of cooperation with STM-Microelectronics and this chip is soon to come on the market on a commercial version. It's a big deal, the ARM Cortex-8M, right? Yeah, this is the Cortex-MV8, exactly, or M33. By the way, we won the price of the best software with that thing two years ago at Unbedded World. And that was a big thing. We were the first to come on the market having that it was a very early version of the software at that time. Now this is fully commercial and working with ST on this platform. So I often ask people if it's possible to do something that's 100% secure and everybody says it's kind of not possible, but with the hardware security, this trust zone, the hardware in the chip, it's going to help a lot. It is helping a lot. So I confirm there is nothing that is 100% secure. It's like in your house, okay? Do you believe that your house is 100% secure? It's just a question of how much security measures you are going to have and what are the means for the people that want to enter into your house. You are not going to resist against an atomic bomb probably in your house, okay? So it's always a question of you need to analyze whether the threats and you adapt your security level to the threat that you believe are probable. So but on this one, yes, at the end of the day, what are you going to achieve with this kind of architecture? You are going to achieve a substantially higher security at a less of a cost, okay? Because that's what we want in security. You want to have more security at less of a cost or that you can achieve that level of security in an easier manner than just, you know, trying to do things with bit and pieces and this kind of new architecture changes the game a little bit in terms of the ratio on how you get to the higher security at a given cost, okay? And we think this is a very promising future that for the microcontroller world, that starts to be deployed in large numbers in the IoT, okay? You want to have sensors or actuators that are going to be connected and you want to be sure that they are not going to be taken control of remotely by hackers. You will need to have such kind of architecture. So yes, this is going one step beyond what was existing so far. There is no point trying to be 100% secure because it's not achievable but you change the level of the bar in terms of security and this is what is done with that kind of architecture. Can you describe some more what's different now with this M33 compared to what people were doing before or what we were doing before? Before people were, they were trying to have on the same chip like this one, okay? They were using an operating system here and incorporate security within that operating system. Now, it is extremely hard to have a secure operating system and the security measures that you have are going to be as strong as the weakest point in the chain and the weakest point here is software and the software coming from the operating system. So in this new architecture, what it allows is that you can continue to use your general purpose operating system like an RTOS, free RTOS, whatever, okay, that you prefer to use and next to this one that is fairly vulnerable you have a dedicated security zone with a security specialized software stack that is dedicated to security and this one you can achieve to have the security specialized software on one side of the chip and the other side of the chip, you do the same thing that you have been doing for developing your software. You don't have to take about security so you leave the very specialized part of your software stack on a special zone and you isolate that from the rest, okay? And that allows you to have a much higher security here without having to bother into your software development. You leave that to a certain piece of your project and that's what is enabled by this kind of architecture. So ARM has been talking about trust zone for many years but now this kind of trust zone is different, right? This is a new version of trust zone on microcontrollers. You had trust zone on micro processes and that has been successfully deployed in large scale in the mobile telephony for instance and it's now also coming up on the market on the more industrial side for automotive, for the energy, for the communication. People start now to use trust zone and I can come to another example where this is getting real with the ST micro electronics but trust zone was not existing in the microcontroller world and that's really something that is getting now on the market and I will change the picture of how to secure stuff that are relying on microcontrollers. So probably I can move to another place with ST and this is an example where we have been working on the new STM32 MP1 which is another product from ST. This is now, this is no longer microcontroller, this is a micro processor and this is, it's called the STM32 MP1 and here we are demonstrating it's against relying on trust zone. We have a demonstration on how to do secure firmware updates using our technology on this chip. Up to now people tend to leave all what is related to firmware updates in what is called the rich OS, the normal environment, typically a Linux or something like that that is very, that cannot be secured enough for the industrial use case and so when you are confronted to industrial use case if you leave your firmware updates in the linux side you take the risk of having your linux being hacked and then the hackers taking control of the firmware update with all the consequences that you can imagine. So we advise to our customers to use the trust zone with our technology and we can have, that is, that has been certified by the way common criteria EL7 so it is at the highest level in terms of security and hosts there the security functions like firmware updates like establishing a secure communication so I cannot go into all the details but this demonstration which is a bit techie and goes into the detail shows how that can be implemented on the ST32 MP1 and we have been partnering again with ST Microelectronics on all the development of the chip and how that can be made secure with our technology. So the MP1 is a bigger chip, the Cortex-A now. How does the trust zone differ from one to the other? In terms of product range and I'm probably not the best person to talk about the product range of ST but you start from the low end microcontrollers and that are Cortex-M0 and you go up to Cortex-M7 and that are the higher grade of the microcontrollers but you have the benefit and the limitation of microcontrollers when you want to have a bit more processing power a bit more memory and hosting things like Linux you need to move to the world of microprocessors and the MP1 is sort of bridging that gap and that's the entry point on microprocessors so it is going a little bit above the microcontrollers in terms of performance and for customers that have more processing power or needs to host Linux ST has come up with that product that's called and I guess they are going to continue on that line. And this is like a development kit they have? That's a development kit, yeah it's probably not the last version that's the one that we've been using for the demo for industrial deployment you probably are going to use. And if you look just over here so Proven Core, that's our flagship product that's your product that's the key product that we have because we believe that if you want to secure a device and you need to host some security-sensitive functions like firmware update, like VPN connection like crypto algorithm, like secure storage like authentication, all those security-sensitive functions they cannot be executed by a non-secure operating environment because they are going to be as vulnerable than the OS that you are using so we have developed a secure operating system that key technologies for hosting those security-sensitive specialized functions and we have a version for Cortex-A we also have a version of this product is called Proven Core we have a version for Cortex-A microprocessors we also have a version for RISC-5 by the way and we have a version for Cortex-M microcontrollers the Cortex-A version has been certified Common Crateria EEL7 this is the world first we are the only company that have reached that level of certification by the way we have been with that Common Crateria certification we have been nominated at the embedded world and we got in the safety and security category and we are very proud to have won this award this is really a world first we are the only team that has reached that level of security for Secure OS and that's why I'm mentioning that this is really our flagship product So the ARM Trust Zone environment of the Cortex-M33 for example, provides you this space for you to create the Proven Core in there absolutely, what we do with Proven Core in that space so if you want to write a security application theoretically you could write your application on the bare metal but then when you start to write an application on bare metal you have to face all the complexity of the hardware what is doing an operating system it is making it simple for you to write applications so with our operating system we enable the guys that need to write their software applications our security applications with an operating system that is making it simple but without creating vulnerabilities and also delivering a certain number of properties so that even if you write your application with vulnerabilities and bugs you are not going to create something a big security issue so one of the key properties that you have in a security system you need to ensure that you have isolation between one application to the other so that even if you have a rogue application it cannot create a security risk for your whole platform this is a key property, it's called separation so we have that kind of properties that is delivered and guaranteed with our technology we also have key properties like confidentiality, integrity that are guaranteed by our software so without going to all the details we offer something that sort of makes its security much more easier to get for the application developers that's why I'm telling this is giving making security available at a high level at less of a cost because you don't need to have the highly specialized security engineers for delivering a high security level because all the complexity is being embedded and delivered within our operating system and you were talking about level 7, that's for the Cortex A do you have any level 7 on the Cortex M33 or is that possible to achieve and how did you achieve this how is possible your team was the first so right now we could achieve this level for Cortex M probably there is not yet sufficient demand for that level of security in the microcontroller world so this is not something that we will start this year in terms of certification we are confident that we can achieve that with the version that we have but this is not something that we will do this year there are more issues related to enhancing some of the properties in our product, customer demand on some of the properties that are higher on the list in our roadmap today but we think that with what we have achieved in the world of the macro processor it gives sort of confidence to the market that we can get them to whatever security level they need whatever the requirement in the long term and even in an evolving world where the level of threat is evolving the level of requirement in terms of certification is evolving and so with our technology we will be able to help them to get to their market requirements whatever are the requirements that's the beauty of having achieved the highest level when you can do the highest level you can always do the lower levels because you have it for free and what are some of the other things in the roadmap that maybe or is that a little bit secret what you're working on next? I don't want to go too much into our R&D roadmap we work that on a priority basis with our customers so I would rather keep that a little bit on our side so a lot of interesting things happening in the better world with more security everybody is talking about that I think there are a lot of things happening in security OK, a number of domains have to move very fast on security in particular the automotive sector where there is still a big gap on what would need to be done and what is actually done and that's evolving fast on the right path but there is still a long way to go so we see a lot of demand on the automotive sector in general in the transport by the way and you know in security it's always a bit of a race between the people hacking and the people implementing or integrating the security measures into their product I think the people now do realize that they have to do something at the design level and that's the right thing to be done there is still a bit of concern in some sectors on how to do that given that they have also a number of legacy systems around they have some you know you can't change everything just in the day but this is progressing the level of attacks and the sophistication of attacks is also progressing very fast so this is kind of a race and you know we'll see how it goes and we'll see how that evolves and yes this is something that has to be done for sure and a lot of hot things coming up in the near future on that front