Recently studies* have shown that 70% of companies are unwilling to pay more than a 10% premium for security. Which is pretty surprising when you consider some of the risks involved in creating products. In order to have an effective security solution you need several key parts. Firstly, it requires a high-level of expertise and that comes at a high cost. Secondly, you need a great deal of scrutiny to ensure your security solution is effective. For example, you need to ensure that the security is spread throughout the system and it’s really hard to achieve this without having a proper plan in place.
Figure 1: IoT security is everywhere at DAC 2017
Therefore, it’s no surprise that IoT security has been at the forefront of conversations and presentations at DAC this year. As Mike Eftimakis pointed out in his presentation yesterday, the acceleration of IoT is pushing a large number of devices into the marketplace, which has led to an increased number of threats. Hackers are inspired to infiltrate IoT systems in order to: access user data, spy on user behavior, steal valuable algorithms, pollute analytics and disrupt services. Therefore, we need strong architecture, significant expertise, security reviews and regular updates, to keep the end users safe.
Figure 2: a snapshot from Mike Eftimakis’ DAC presentation, showing some of the potential attack surfaces in IoT devices
Another important thing that Mike demonstrated, is that we have the power to build in security upfront. If security is built in by the chip manufacturers and OEMs, we have the power to protect service providers, final users, communities and governments. We can do this by providing security solutions that help SoC designers. Examples of these could include: a secure architecture, pre-assembled subsystems, system components for security expansion, secure enclaves, secure software and finally, secure services.
By pre-building those solutions and prepackaging them, you can make security simple. If you had the choice between a whole meal tonight, or a just a side portion of chips – which would you choose? Most of us would opt for the whole package! The same can be said for building systems, if you opt for an ARM Cortex-M processor, why not choose the full solution. This is exactly what ARM provide with our new ARM CoreLink System Design Kits, the kits combine world proven system IP, with fully verified subsystems, which allow designers to get up and running quickly. The new CoreLink SDK-100 announced this week offers designers support for ARM Cortex-M0, Cortex-M0+, Cortex-M3 and Cortex-M4. This builds on the support included in the CoreLink SDK-200 which covers Cortex-M23 and Cortex-M33 cores.
Figure 3: the contents of the ARM CoreLink System Design Kits
[CTAToken URL = "https://community.arm.com/processors/designstart/b/blog/posts/meet-corelink-sdk100" target="_blank" text="Learn more about the importance of System Design Kits" class ="green"]
[CTAToken URL = "https://developer.arm.com/products/system-design/system-design-kits" target="_blank" text="Visit the System Design Kits website" class ="green"]
Moving back to the study I mentioned earlier, how can we make security affordable to all the players in the IoT space? This morning ARM announced several enhancements to the ARM DesignStart program, providing the fastest path for evaluating, designing and bringing custom SoCs to market. ARM has added Cortex-M3 and has eliminated the up-front license or evaluation fees, enabling a low-risk, success-based royalty model. The ARM CoreLink SDK-100 is also included in this package, which offers reduced time-to-production, thanks to the proven subsystem and system IP solution. On the security side, DesignStart offers verified support for mbed OS, offering security from the client to the cloud. This further ensures the production of the most managed, scalable and secure IoT products.
Onsite at DAC, Mike Eftimakis was interviewed by Design & Reuse on DesignStart, watch the video here.
[CTAToken URL = "https://community.arm.com/processors/designstart/b/blog/posts/enhanced-arm-designstart-eliminates-upfront-license-fees-for-cortex-m0-and-m3-processors" target="_blank" text="Read the DesignStart launch blog" class ="green"]
[CTAToken URL = "http://designstart.arm.com" target="_blank" text="Visit the DesignStart website" class ="green"]
Elsewhere at DAC we had a great panel on the Mentor Booth which covered some of the challenges in creating custom SoCs. The panel (made up of Jeff Miller – Mentor, Mike Eftimakis – ARM and John Tinson – Sondrel) explored various options and viable solutions to help designers innovate and to provide services. Moderator Ed Sperling (Senior Editor for SemiEngineering) opened the floor with the statement that there are three things driving IoT, which all conflict one another: cost, customization and processing power. John Tinson was quick to point out that most of the players in IoT are startups and their need for 'fast time to money' is crucial for their survival. All panelists agreed that the addition of integrated building blocks (like the ARM CoreLink Subsystems) allow designers to get up and running quickly, whilst ensuring their design is secure. Again the hot topic for the panel was focussed around security - Jeff Miller explored the concept of 'defence in depth' and how it is crucial to plan and test for different kinds of attacks. Citing that it's easy for an accelerometer designer to ignore security, but it's still an incredibly important piece of the puzzle. As Mike Eftimakis pointed out, you really don't know where your IoT device will land and it's hard to predict how attacks will develop. Therefore, it's important that your device can be upgraded whilst it's in the field - design your security in from the start, as it's very hard to go back and fix it later!
[CTAToken URL = "https://community.arm.com/tags/Design%2bAutomation%2bConference%2b_2800_DAC_2900_" target="_blank" text="See more content from DAC" class ="green"]
[CTAToken URL = "http://pages.arm.com/SoC-design-news.html" target="_blank" text="Sign up for SoC Design updates" class ="green"]
*McKinsey/GSA Semiconductor Industry Executive survey