Arm encryption libraries

Cyber security in arm-based embedded systems

Any device connected to a network is a potential target of a cyberattack. This is true even for devices that are not connected to public networks - a private network could be hacked and all devices connected to it could be compromised. As a result, the industry is strongly focused on security. Specialized vulnerability testing allows you to validate your devices throughout the development phase.

GE Digital's Achilles Test Platform offers a stress test that simulates cyberattacks over a TCP/IP network connection. GE Digital also offers a certification service for endpoints.

The Arm Middleware Network Component is verified using Achilles Test Software (ATS) and passes Level 1 testing. Therefore, Arm Cortex-M based microcontrollers using the Network Component should pass Achilles Level 1 certification.

Recommendations for the use of the Arm Middleware Network Component

Nowadays there are a lot of known network attack types, a list would be quite long. Some network security mechanisms have already been implemented, e.g. against spank attack and forged RST packets in TCP sockets. Some attack types are implicitly blocked by the stack's implementation concept, e.g. jumbo packets (Ethernet packets larger than 1514 bytes) are rejected. Fragmented packets are also not supported, making the middleware network stack immune to the ping-of-death attack, etc.

The SSL private key is often simply stored on the server. In an embedded environment where there are multiple servers, there are inherent problems associated with the standard. A secure but costly solution would be to give each server its own private key. With unique, self-signed certificates for each server, there can be delays when the client browser needs to trust the server (it may even require further browser configuration, and even then the client's communication is vulnerable to additional vulnerabilities). With a private key shared by multiple servers, only one server needs to be compromised to gain access to the SSL private key. If one can then read incoming and outgoing packets, one can decrypt traffic from any server using the same key.

For ARMv8-M architectures (including Cortex-M23 and Cortex-M33 cores), we recommend storing an SSL private key in a secure memory area of the device. Users should try to secure this key regardless of architecture; if using an earlier architecture, ask a silicon vendor if they offer alternative secure storage solutions. Protecting the server's private key protects the encryption of server/client communications. Discuss any proposed SSL configurations with a certificate distributor to ensure that their product supports the application's proposed setup.