Home > On-Demand Archives > Talks >

Securing the IoT from Chip to Cloud:An Application Guide to Applying Platform Security Architecture (PSA) Principles

Jacob Beningo - Watch Now - EOC 2020 - Duration: 01:05:49

With the explosive growth in the Internet of Things (IoT) and the number of devices soaring, security is critical maintain device integrity and protect user privacy.However, designing consistent security across connected devices can be a minefield to navigate and implementation can be costly.Using a smart door lock as an example, in this webinar, attendees will learn how to design security from the ground up using PSA principles and guidelines with a PSoC® 64 secure MCU from Cypress Semiconductor.

Attendees will walk away with the best practices to develop their own security solutions.In addition, the importance of secure device management throughout the IoT products lifecycle will also be reviewed.

Topics Covered in this Webinar Include:

  • Developing a threat model and Defining security counter measures
  • Maintaining asset security through hardware architecture and security IP
  • Implementing trusted boot and Secure application partitioning
  • Using Trusted Firmware-M to isolate security critical functionality from non-secure code
  • Leveraging the Arm Pelion Secure IoT Device Management Platform for full device lifecycle management (design, onboard, provision, secure, update, manage, etc.)
italicssurround text with
boldsurround text with
**two asterisks**
or just a bare URL
surround text with
strikethroughsurround text with
~~two tilde characters~~
prefix with

Score: 0 | 4 years ago | 1 reply

Loved every bit of it :)
amtrak train tracker

Score: 0 | 4 years ago | no reply


Score: 0 | 4 years ago | no reply

Thank you very much for the great presentation!

Score: -1 | 4 years ago | 2 replies

Where would we find the whitepaper on the example model described in presentation?

Score: 0 | 4 years ago | no reply

Seems that ARM link is down... It should be https://pages.arm.com/psa-application-guide-smart-door-lock.html, as referenced on both ARM and Cypress websites. Once you go to it, you are redirected to ARM PSA website, but no whitepaper is available for download.
Even checking the Internet Archive I could find the original website, but it doesn't provide you any reply.

Score: 0 | 4 years ago | no reply

You can find the analysis paper at https://www.cypress.com/file/447056/download

Score: 0 | 4 years ago | 1 reply

Your presentation was awesome!

Score: 0 | 4 years ago | no reply

Thanks! I'm glad to hear that you enjoyed it.

Score: 0 | 4 years ago | 1 reply

Very informative session. Thank you!

Score: 0 | 4 years ago | no reply

You are welcome!

Score: 2 | 4 years ago | 2 replies

What's your feel on how realistic PSA's hardware threats are - there's a huge gap between the basic hardware hacker & the advanced attacker that is "out of scope" in PSA. Say someone at university level ('grad student who needs publications' threat) with moderate resources?

Score: 1 | 4 years ago | 1 reply

Colin makes a great point. Colin's company, NewAE, sells the ChipWhisper which makes hardware-base crypto attacks affordable and easy. The ChipWhisper-Lite is only $250, and yes, that keeps me up at night ;) Hopefully, these secure elements have reasonable protections against differential power analysis. Colin, do you have any sense for how secure these Cypress and newer Cortex-M33 chips, such as the LPC55S6, are?

Score: 1 | 4 years ago | no reply

Secure elements (should) be good as are tested against these attacks! If you haven't seen the talk TrustZone-M(eh): Breaking ARMv8-M's security you're missing a chance to further worry yourself ;) I'm curious on the SiLabs newer EFR32MG21 as they are claiming a lot of countermeasures on a mostly public part (i.e., no NDA required) but need more time to look at it...

Score: 1 | 4 years ago | 1 reply

I think that in general, PSA provides a good set of basic threats and considerations for developers. There are a lot of teams out there that give zero consideration to security. PSA as you mention isn't a one size fits all solution, but it at least gets the average developer thinking about security.

There are certainly areas where PSA could go further such as in furthering isolated execution environments for trusted applications and reaching secure element functionality.

I hope that answers your question, if not please feel free to clarify and I'm happy to answer.

Score: 0 | 4 years ago | no reply

Makes sense - the "zero security consideration" means PSA will help a lot for those! As well as stopping easy issues like key re-use etc. I just hadn't seen as much detail on the "in-between attacker level" in PSA yet so always trying to get a feel from others working with it.

Score: 0 | 4 years ago | no reply

Hello Everyone! Welcome to my session! If you have any questions or comments please feel free to enter them into the question area!