Embedded Policing and Policy Enforcement Approach for Future Secure IoT Technologies

Abstract

The Internet of Things (IoT) holds great potential for productivity, quality control, supply chain efficiencies and overall business operations. However, with this broader connectivity, new vulnerabilities and attack vectors are being introduced, increasing opportunities for systems to be compromised by hackers and targeted attacks. These vulnerabilities pose severe threats to a myriad of IoT applications within areas such as manufacturing, healthcare, power and energy grids, transportation and commercial building management. While embedded OEMs offer technologies, such as hardware Trusted Platform Module (TPM), that deploy strong chain-of-trust and authentication mechanisms, still they struggle to protect against vulnerabilities introduced by vendors and end users, as well as additional threats posed by potential technical vulnerabilities and zero-day attacks. This paper proposes a pro-active policy-based approach, enforcing the principle of least privilege, through hardware Security Policy Engine (SPE) that actively monitors communication of applications and system resources on the system communication bus (ARM AMBA-AXI4). Upon detecting a policy violation, for example, a malicious application accessing protected storage, it counteracts with predefined mitigations to limit the attack. The proposed SPE approach widely complements existing embedded hardware and software security technologies, targeting the mitigation of risks imposed by unknown vulnerabilities of embedded applications and protocols.

Policy-Based Security Modelling and Enforcement Approach for Emerging Embedded Architectures

“…This paper aims to extend the policy driven approach presented by Tan et al [19], by presenting a policy-based security modelling design flow incorporating its output into the existing application threat modelling practises and design flow. In addition, this proposed approach compliments the work of Akatyev et al [20] and Siddiqui et al [21] by performing detailed threat modelling of a realistic connected car application scenario and proposing ways to enforce driven security policies using hardware and software approaches.…”

“…2) Hardware-based policy engine (HPE) architecture: Siddiqui et al have presented a hardware-based policy engine (HPE), a system architecture that checks the approved list of devices and either grants or restrict access to the device [21].…”

Enforcing Policy-Based Security Models for Embedded SoCs within the Internet of Things

“…The concept of applying access control policy has further been explored within hardware. Siddiqui et al [22] detailed a pro-active, policy based hardware enforcement mechanism known as a Security Policy Engine. This hardware based approach offers independent monitoring of transactions on the system communication bus, providing an additional layer of security that can protect the device when, for example, software based protections have been bypassed or compromised.…”

Enhancing Security and Privacy of Next-Generation Edge Computing Technologies

“…A detailed SoC platform architecture [29], [30] and security modelling approach [31] that realises the proposed characteristics and embedded security requirements has been defined and implemented.…”