® Industrial IoT workshop Security for industrial platforms

Gopi K. Agrawal Security Architect IOTG Technical Sales & Marketing Intel Corporation Legal © 2018 Intel Corporation No license (express or implied, by estoppel or otherwise) to any intellectual property rights is granted by this document. Intel disclaims all express and implied warranties, including without limitation, the implied warranties of merchantability, fitness for a particular purpose, and non-infringement, as well as any warranty arising from course of performance, course of dealing, or usage in trade. This document contains information on products, services and/or processes in development. All information provided here is subject to change without notice. Contact your Intel representative to obtain the latest Intel product specifications and roadmaps.

Intel technologies' features and benefits depend on system configuration and may require enabled hardware, software or service activation. Performance varies depending on system configuration. No computer system can be absolutely secure. Check with your system manufacturer or retailer or learn more at www.intel.com.

Intel, the Intel logo, are trademarks of Intel Corporation in the U.S. and/or other countries. *Other names and brands may be claimed as the property of others. All information provided here is subject to change without notice. Contact your Intel representative to obtain the latest Intel product specifications and roadmaps

No license (express or implied, by estoppel or otherwise) to any intellectual property rights is granted by this document. Intel technologies’ features and benefits depend on system configuration and may require enabled hardware, software or service activation. Performance varies depending on system configuration. No computer system can be absolutely secure.

Check with your system manufacturer or retailer or learn more at intel.com.

Intel, the Intel logo, Intel® ®, Intel® Core™, Intel ®, ®, ®, Intel. Experience What's Inside™, Intel® Firmware Support Package (Intel® FSP), Intel® System Studio, Intel® Media SDK, Intel® SDK for OpenCL™ Applications, Intel® OpenVINO™ toolkit, Intel® Context Sensing SDK, Intel® MAX®, Intel® Cyclone®, Intel® Arria®, Intel® XMM™, Intel® EPID, Intel® SGX are trademarks of Intel Corporation or its subsidiaries in the U.S. and/or other countries. *Other names and brands may be claimed as the property of others.

2 Agenda

• Learn more about the prevailing Threat environment & top market concerns, Security Capabilities-HW Root of Trust capabilities & technologies, IoT Security Lifecycle, and use-cases. • Overview of hardware-based solutions to address the increasing need for security and manageability as Industrial IOT is evolving into new and more demanding uses that challenge existing practices.

Intel® Industrial IoT workshop 3 HW Security is a Key Element to Scale IoT Deployments

= receptive selling environment

Source - Gartner Intel® Industrial IoT workshop 4 Uniqueness of IoT Device Lifecycle

Plan

• IoT Device usage mode implies Decommission Development 10+ years life time, longer than Retire / Client & traditional Replace Testing products Repair Technology Updates Debugging

User Business • Security is intrinsic to each Optimize/ Experience Strategy Sustain stage of device lifecycle Deploy Repair

Update Provisioning • Intel has assets to help protect Diagnose Configuration customer’s assets in all phases Monitor Control Manage

Intel® Industrial IoT workshop 5 HW Instruments Software with Added Protections

Trusted Device Stack DeviceIntel Attack Security Surface Technologies Protections

Data Data Protected Encrypt Crypto Accel/RNG Storage ID Memory Applications Apps

OS Hardening Execution Control VM Isolation Operating System/VMM OS/VMM

OS Hardening Execution Control VM Isolation Transitive Transitive Trust Chain

Threats BIOS/FW BIOS/FW Targeted Technologies Targeted Protected Boot Root of Trust Recovery

Hardware Hardware

Hardware Security Makes Entire Hardware Technologies Designed to System More Secure Harden Specific Attack Surfaces

Intel® Industrial IoT workshop 6 Consistent Security Foundation

What is it?

• Set of foundational security capabilities that must be supported at platform level. • Recommended set of technologies for each capability.

Why?

• Enable common security posture on all platforms. • Promote reuse and consistency in Intel security solutions.

Enables for the evolving IoT markets

Intel® Industrial IoT workshop 7 Portfolio Definitions

Core Capability Value Prop Achieved Industry Technologies Map to Intel Technologies

Encryption /Decryption AES-NI, Quick Assist Crypto Hardware-assisted crypto acceleration and secure key generation Random Keys Secure Key Acceleration

OS/VMM Hardening OS Guard, VT-d/x

Device Identification PTT (TPM, measured Platform Protected and verified boot process with boot, RSA/EDCSA Key Integrity hardware attestation of the platform Support) Baseline Software Identification

Protected Boot Boot Guard, OS Guard)

Protected Data & Encryption and storage for sensitive data, keys, or Keys, & Identity credentials, at rest and in transport Protected Storage PTT, TME (future)

Isolated enclaves to help protect sensitive data, processes, Trusted Trusted Execution and keys at runtime and create a trusted application SGX, DAL, VT -x Environment (TEE) Execution environment

Intel® Industrial IoT workshop 8 Security & Management Technologies1 - Hardware

CPU Platform Integrity (Access) CPU Intel® OS Guard Intel® Memory Protection Extension MPX OS GUARD Trusted Execution MPX OS GUARD Environment (TEE) Intel® Software Guard Trusted Execution Extension(SGX) SGX VT –x/io VT –x/io AES-NI / Environment (TEE) SHA Intel® Virtualization Technology AES-NI / SHA / RAND AES-NI / SHA / RAND Protect Data & Keys SEC Coprocessor*** Intel® Platform Trust Technology (TPM) SEC Coprocessor*** / PCH Crypto Acceleration PTT (TPM) Intel® AES-NI / Quick Assist* / HW & SW Identity Secure Key PTT (TPM) Intel® Secure Device Onboard / EPID

Platform Integrity (Trust Crypto Acceleration EPID AES / SHA AES / SHA EPID Intel® AES-NI / Secure Key & Attestation) Intel® Trusted Execution Technology Platform Integrity (Protected BOOT BIOS BIOS GUARD Device Management TXT** Boot) GUARD Intel® BIOS Guard Intel® Active Management GUARD Intel® Boot Guard Technology AMT BOOT GUARD X-platform HW Security Capabilities

1 Subset of intel security technologies * Intel® Quick Assist Xeon only ***Intel® CSME / TXE / CSE/ SPS 9 Intel® Industrial IoT workshop Specific to Industrial & Energy **Intel® TXT vPro and Xeon only Securing Devices & Communication

Threats Solutions

Sensitive Data Protection Intel® Software Guard Extension(SGX)* Unauthorized access of app data due to Trusted Execution Environment (TEE) for Embedded week OS security Applications Applications, app run time protection Credential / Provisioning Intel® Secure Device Onboard / EPID Attacker can gain unauthorized Provides service that uses HW key to access to the device with little effort secure the rendezvous of device to its owner

Escalation of Privilege / Ransom Ware Other Drivers Intel® OS GUARD / MPX / VT-x Using device vulnerable known Prevent escalation of privilege, boundary software exploit protection, utilize VT / containers Insecure Key Storage Intel® Platform Trust Technology (TPM) cryptographic keys used to protect platform and Enable secure PKI keys storage owner secrets easily recovered by hacker Operating System (Window & ) Insecure Data-in-Transit Intel® AES-NI/Quick Assist / Secure Key Sending data in clear increases Enable TLS/SSL ops without compromising eavesdropping risks performance

Unsigned Firmware / Rootkit Intel® Boot Guard / Intel® TXT* Modification Of Firmware By Boot Drivers Malware Allows only trusted & untampered firmware to execute Unauthorized BIOS Write Intel® BIOS Guard Unprotected BIOS leaves device vulnerable to BIOS Signed OEM Secure update known exploit Hardware limitations Hardware Limited security options availability Intel® Industrial IoT workshop *SGX & TXT supported only on Xeon & Core 10 Customer

Ecosystem Security Products Delivery Model Intel

Customer Ready Security Solutions

5 Ecosystem OEM, OSV, ISV, CSP Partner Products

3 2 2 4 Trust Enabling Services SolutionsSolutions Tools Enabling Solutions & Tools Platform Products & References System SW & SDKs

1 Silicon Foundation Capabilities & Technologies Root of Trust Capabilities Platform Assurance Security Technologies

Industry Security Use Cases & Threats Models

Intel provides comprehensive edge to cloud security solutions rooted in HW security that the ecosystem turns into customer ready solutions

Intel® Industrial IoT workshop 11 Security Products Delivery Model

5 Ecosystem OEM, OSV, ISV, CSP • Intel vPro Platform • Intel Cloud Integrity Technology 3 2 2 4 • Intel Transparent Supply Chain • Hyperledger Sawtooth Trust Enabling (Blockchain) SolutionsSolutions • Tianocore.org • Intel Secure Device Services Tools Onboard Platform Products & References System SW & SDKs • Intel SGX & EPID • Open Source – EPID Attestation • SDKs - SGX • CA, Key Gen, & Recovery • UEFI Developer Kit 1 Silicon Foundation • IDE - System Studio

Baseline Capabilities Platform Assurance Security Technologies

• Baseline Capabilities:- SGX, • Side Channel • Intel TXT PTT, Boot & OS Guard, AES-NI, Resistance • Intel BIOS Guard Secure Key, VT-x/d, TME • Intel 10 FPGA • Anti-tamper Yellow – are products supported by Non Protection • Download and Execute (DnX) IOTG groups • FIPS 140-2 • Control Flow Enforcement Red- roadmap future Compliance Technology • Keylocker

Intel® Industrial IoT workshop 12 IoT Security Spans Edge to Cloud

Intel has cross-BU security portfolio to Security Solutions | Vertical Solutions Ecosystem protect complete e-to-e workflow

Device Remote Trusted Image Secure Identity IP & Data Telemetry & • Intel IoTG Group - IoT workstations, Security Usage Onboarding & Attestation Update Workloads Management Protection Anti-malware intelligent devices at endpoint, edge Models: Management gateways, device onboarding

IoT Device Edge Network • Intel Server Group - Edge compute Applications Endpoint Management Data Center & Cloud servers & confidential compute in cloud (support via server group)

Security Constrained & Gateways & Secure IT & OT Device Confidential Development Intelligent Edge Compute Communication Management Compute & Devices System Analytics

Intel® Industrial IoT workshop 13 Sample: Industrial Cloud/Edge Compute

Yellow* – are products supported by non- IOTG Intel division

• Intel® CIT & TxT IoT Cloud & Device • Intel® SGX enabled Blockchain Management Platforms • Intel® Secure Device Onboard

Workstation & Industrial Apps – MEC • Baseline Capabilities Control (Multi-Access Connectivity Control - Intel® AES-NI/ Quick Assist /Secure Key-TLS/SSL Point Edge Compute) • Intel® Active Management Technology (AMT)*

VM: VM: Edge Predictive Condition Monitoring Appliances Maintenance • Intel® CIT & TxT Servers • Baseline Capabilities - Intel® OS GUARD / VT-x - Intel® Software Guard Extension (SGX)* GatewaysDevice

Multi-function PLC Controllers & Apps HMI MOTION VISION

• Baseline Capabilities Devices - Intel® Boot Guard - Intel® Platform Trust Technology

Intel® Industrial IoT workshop *Non- IOTG division may be limited to long life support Security in Lifecycle Terms

Manufacture Configure Onboard Provision Operate Decommission

Develop, Onboard, Attest Operational Security Management

. MCU - FPGA Crypto Accelerators . IT- Remote Attestation SDKs (SGX TEE & TPM platform) Ecosystem . ODM - BIOS/FW tools, Intel SDO SDKs . OT/CSPs - Intel SDO DMS SDK (provisioning integration) Enabling . OEM - Boot Guard, SDO SDKs . SI - Crypto Accelerators, HWTPM for Credentials & SW Attestation, SGX SDK & attestation services ONBOARD

ATTEST Baseline Trust Capabilities Platform Trust Services Edge Security Device Management

. Intel® Secure Device . HW Enhanced Security . Intel SDO Provisioning Protected Crypto Trusted Platform Onboard (Intel® SDO) for Gateways & Edge for DMS vendors Data/Keys Execution Integrity /ID Compute Servers . In-band (Intel® AMT) and Out of band (Intel® vPro) Workstation Manageability

Intel® Industrial IoT workshop 15 Secure Lifecycle Management

Lifecycle OT/IT Challenges / Intel Secure Device Onboard Stage Tasks Pain Points (SDO) Deployment • Provisioning • Manual effort • Zero-touch onboarding service • Lower deployment • Onboarding • Lacks privacy • Takes seconds at power on cost • Unique privacy preserving • Protect privacy Operation • System • Lack of visibility hardware security model monitoring & • Security risk • One-to-many enablement control caused by patch • Software failure updates • Downtime • Security caused by patching delayed Out Of Band Manageability • Inventory detection of enabled by Intel Active • Troubleshoot & device problems Management Technology (AMT) remediation and delayed • Remote power control • Minimize system resolution due to • Remote BIOS access downtime distance • Hardware KVM • Lower OT/IT cost • Hardware alarm clock and Retirement • De-commission • Inaccurate • Dispose inventory alerting • Third party data store

Intel® Industrial IoT workshop 16 Case Studies

Intel Intel Secure Device Onboard Intel Software Guard Extensions Baseline capabilities Smart Building Provisioning Virtualized Network Edge Compute ZERO TOUCH PROVISIONING

On-premise Edge Compute platform Intel Corp Services SR4 Smart Application protection for Edge for workload orchestration Building Implementation Computing

• Instrumented server for core • Advantech gateway onboarding via • Ensures virtual functions and capabilities: Intel VT-x-VM isolation, Intel SDO service for scale and to applications residing in edge Intel PTT- measured boot & cred pass IT security audit compute network slices are storage, Intel AES-NI- crypto protected and isolated using Intel acceleration SGX enclaves

Intel® Industrial IoT workshop 17 Summary

• Intel Architecture (IA) has rich security features spanning CPU and Security Engine • The feature set will be enhanced in future atom CPU / SoCs • Defense in depth must be organic and is required across the whole stack

We love to get your feedback and follow up! • Tell us about your security objectives and use-cases • We are ready to engage in Architect-2-Architect to help designing secure IOT platform Thank you!

Intel® Industrial IoT workshop 18 Notices and Disclaimers

Intel provides these materials as-is, with no express or implied warranties All products, dates, and figures specified are preliminary based on current expectations, and are subject to change without notice.

Intel, processors, , and desktop boards may contain design defects or errors known as errata, which may cause the product to deviate from published specifications. Current characterized errata are available on request.

Intel technologies’ features and benefits depend on system configuration and may require enabled hardware, software or service activation. Performance varies depending on system configuration. No computer system can be absolutely secure. Check with your system manufacturer or retailer or learn more at http://intel.com.

Some results have been estimated or simulated using internal Intel analysis or architecture simulation or modeling, and provided to you for informational purposes. Any differences in your system hardware, software or configuration may affect your actual performance.

Intel and the Intel logo are trademarks of Intel Corporation in the United States and other countries. Copyright © Intel Corporation 2018

Intel® Industrial IoT workshop 19 Intel® PlaceholderIndustrial Footer Copy IoT / workshopBU Logo or Name Goes Here