IoT Security: Hardware Root of Trust

PB 25 Rockwell newlogo 400

November 22, 2022

By  Rob Lodesky, Key Account Manager, HMS Networks

IoT has steadily gained popularity in recent years with more users migrating to digitalized products and smart gadgets. As an increasing amount of IoT equipment comes online, many unsecured items will be vulnerable to remote software assaults. Inadequate security gives hackers the opportunity to brick and commandeer a device to help build botnets. These malware networks introduce unauthorized code, steal data, or exploit their hosts through some other means. Because device manufacturers want to safeguard their reputations, their IoT devices must be secure. With more laws, regulations, and standards being created in this vein, security cannot be imposed as an afterthought. This is where Hardware Root of Trust comes into play.

What is Hardware Root of Trust?

Root of trust establishes the secure process boot up chain, called Chain of Trust, used to validate software and hardware used on the device. If the credentials used to implement the initial piece of code are verified, each successive piece of code executed is trusted. A strong root of trust consists of identity and cryptographic keys rooted in the hardware of a device. This establishes a unique, immutable, and unclonable identity to authorize a device in a network. It enables a secure boot process using keys for cryptographic operations, ensuring the authenticity of firmware and software until the OS (Operating System) is loaded.

How is Hardware Root of Trust Implemented?

Hardware root of trust can help with a range of security issues that are primarily divided into pre-boot and post-boot. Pre-boot can use a computer chip called a Trusted Platform Module (TPM) to verify/measure integrity and secure the boot process from low-level malware. TPM assists with various activities during post-boot, including root of trust for authentication. Systems that deploy hardware root of trust will use unified extensible firmware interface (UEFI), which offers options such as “Secure Boot” that help prevent attacks or infection from malware.

How does the Root of Trust process start inside a processor?

There are essentially two methods: the battery backed storage of secret keys and Physical Unclonable function (PUF). PUF is widely held as the industry standard for FPGAs and ASIC processors. PUF starts with a physical microstructure. These microstructures can be random imprints of some substance, such as foam, plastic, or even silicon. The processor then uses challenge response authentication to measure this random structure. (Most people know challenge response authentication as username/password – ask for a username, type a username.) These random measurements work in the same way: the processor measures something withing the microstructure, and the microstructure is measured and validated. The problem with cloning, or making the process unclonable, is ensuring the manufacturing process could not replicate the microstructure.

What are some of the other phases of Hardware Root of Trust?

Typically, solutions start with an Immutable Boot Loader (sometimes using a PUF), which then starts the BIOS (Basic input/output System) or UEFI validation process. The Phase 1 process uses RSA or ECC private key encryption, sometimes using a TPM to build the keys necessary for the RSA and ECC cipher suites. If an OS is used, the loader is validated using the same private key encryption, then finally the OS, and application (if used).

What other hardware might be necessary for Hardware root of Trust?

If startup speed is a factor in your design, SSL accelerators can offload some of the algorithmic horsepower typically done by the main processor. There are now chipsets built for this specific purpose. Entropy generating hardware can be used to achieve proper random Key generation, although a PUF can also be used, to some degree.


Related Articles

Changing Scene

  • Tri-Mach Announces the Purchase of an Additional 45,000 sq ft. Facility

    Tri-Mach Announces the Purchase of an Additional 45,000 sq ft. Facility

    Recently, Tri-Mach Inc. was thrilled to announce the addition of a new 45,000 sq ft. facility. Located at 285 Union St., Elmira, ON, this facility expands Tri-Mach’s capabilities, allowing them to better serve the growing needs of their customers. Positioning for growth, this additional facility will allow Tri-Mach to continue taking on large-scale projects, enhance product performance testing, and provide equipment storage for their customers. Read More…

  • HELUKABEL Group Builds New Facility for Automation Cable Solutions

    HELUKABEL Group Builds New Facility for Automation Cable Solutions

    The HELUKABEL Group recently announced it is going to build a new facility in Haan, Germany that will house its robotic dress pack and drag chain system subsidiaries under one roof. The new building will also serve as the headquarters of HELUKABEL’s Rhine-Ruhr sales branch, and is planned to be completed by 2025. Robotec Systems’ core business is robotic dress pack solutions and has been a HELUKABEL subsidiary since 2012 operating out of Duisburg, a suburb of Duesseldorf in northwest Germany. Read More…

Sponsored Content
Fire Protection for Lithium-ion Battery Energy Storage Systems

Lithium-ion storage facilities contain high-energy batteries combined with highly flammable electrolytes. In addition, they are prone to quick ignition and explosion in a worst-case scenario. Such fires can have a significant financial impact on organizations. Rapid detection of electrolyte gas particles and extinguishing are the key to a successful fire protection concept. Since December 2019, Siemens has been offering a VdS-certified fire protection concept for stationary Li-ion battery storage systems.

Click HERE to learn more.

For a Multiplied Value Unified


During the last few years, the Excelpro Group has welcomed AIA Automation, Envitech Automation and Conrad Lavoie Electrical, all of which have become ‘Member of the Excelpro Group’.

It was with great excitement that in November of 2022, Excelpro announced that these three companies officially became Excelpro. This decision is part of a strategy to enhance the Excelpro Group’s brand in its market.

These companies already collaborate on various client projects. This merger brings together the complementary strengths of the employees and ensures a global synergy of the activities throughout the Group.

Read More

Service Wire Co. Announces New Titles for Key Executives

Bruce Kesler and Mark Gatewood have been given new titles and responsibilities for Service Wire Co.

Bruce Kesler has assumed the role of Senior Director – Business Development. Bruce will be responsible for Service Wire’s largest strategic accounts and our growing Strategic Accounts Team.

Mark Gatewood has been promoted to the role of Vice President – Sales & Marketing. In this role, Gatewood will lead the efforts of Service Wire Company’s entire sales and marketing organization in all market verticals.

Read More

Modern Niagara Partners with Global Sustainability Platform Worldfavor

Worldfavor is a global sustainability platform, digitizing and automating the collection, calculation, aggregation and visualization for analysis and reporting of ESG data. Now, Worldfavor is proud to welcome Modern Niagara as a new customer. Modern Niagara is the first Canadian construction company to partner with Worldfavor.

“Worldfavor was founded to be the best platform for sharing, accessing and gaining insights from corporate ESG information. Worldfavor’s mission is to make sustainability mainstream and with that we offer solutions to accelerate sustainability through the value chain. Modern Niagara is the first Canadian construction company to partner with Worldfavor. 

Read More

JMP Parent Company, CONVERGIX Acquires AGR Automation, Expanding Global Reach

Convergix Automation Solutions has completed the acquisition of AGR Automation (“AGR”), a UK-based provider of custom, high-performance automation design and systems integration primarily to the life sciences industry.

Following Convergix’s acquisitions of JMP Solutions in August 2021 and Classic Design in February 2022, AGR marks the third investment in Crestview’s strategy to build Convergix into a diversified automation solutions provider targeting the global $500+ billion market, with a particular focus on the $70 billion global systems integration and connectivity segments. Financial terms of the transaction were not disclosed.

Read More

Latest Articles