Secure Embedded Systems: Digging for the Roots of Trust

by Ron Wilson - Altera, Jul. 22, 2015 – 

Many embedded designs absolutely have to work right. A malfunction could do unacceptable harm to persons or property. Until recently, this requirement has been addressed through careful design and hardware reliability: if the software and the logic are right and there are no hardware failures, the system will work.

But today we live in the age of undeclared cyber warfare. If your system must work, you must assume that everyone from bored hackers to criminal gangs to lavishly funded government laboratories will attack it. In order to defend your system, you must determine what -- and, eventually, whom -- you can trust. This is not an easy, or, some argue, even an achievable quest. But undertake it you must.

Defining a Hierarchy

By itself, the question "Can I trust my system?" is all but imponderable. To get a grip on it, we need to partition the fundamental huge question into a number of smaller, merely difficult questions. This is commonly done by breaking the system apart at well-defined boundaries: most often, the pieces we use are application software; operating systems, boot code, and firmware; and hardware. In general, if we can define the interfaces between these levels -- thereby defining what it is we are trusting each level to do -- and if we can trust each level of the design individually, we can trust the system.

Trust can only be inclusive. If your object software is perfect, you must still trust the operating system (OS) to respond correctly to its application-program interfaces and to not corrupt your code. To do that, you must trust that there is no pernicious code in the boot loader that could have corrupted the OS, and no Trojan horse in the hardware that could have taken control of the system. Some architects describe this recursive questioning as finding the root of trust. But perhaps this metaphor is too optimistic. In a panel on secure systems at June?s Design Automation Conference (DAC), Intel senior principle engineer Vincent Zimmer summoned the apocryphal story of the speaker who claimed the earth was a disk on the back of a turtle. Asked what the turtle stood on, the speaker replied "It?s turtles; all the way down."

Eventually -- if indeed the recursion ends somewhere -- you end up trusting not a design nor a methodology, but a specific group of engineers -- human beings. At least so some experts argue.

 Back