Joint solution provides a cost-effective option for provisioning unique, certified device identities rooted in hardware that can be adapted to any existing manufacturing workflow

Low cost, embedded security solution enables manufacturers to retrofit and enhance security of existing products with just software

Oct 29, 2016 - GMO  GlobalSign ( www.globalsign.com), a leading provider of identity and security solutions for the Internet of Everything (IoE), and  Intrinsic-ID, the leader in embedded authentication based on Physical Unclonable Functions (PUFs) announced today that they are partnering to provide original equipment manufacturers (OEMs) scalable, flexible and affordable security for the Internet of Things (IoT). The GlobalSign and Intrinsic-ID solution provides a cost-effective option for provisioning unique, certified device identities rooted in hardware that can be adapted to any existing manufacturing workflow. The joint technology provides distinctive identities for microchips embedded in IoT devices, which are then certified so that they will be trusted in a customer’s IoT ecosystem.

IoT environments, whether automotive, industrial control systems, critical infrastructure, medical equipment or smart manufacturing floors, require strong security systems to prevent unauthorized control of devices, protect against advanced threats and detect counterfeit attempts. Traditionally, augmenting security into IoT environments has been difficult and cumbersome. Now a software-based SRAM PUF can be retrofitted into any existing microcontroller, enhancing present security or providing security where there once was none at all, even for constrained devices.

“Smart devices have a unique fingerprint hidden in their SRAM cells,” says Pim Tuyls, CEO of Intrinsic-ID. “We leverage these unclonable identities to derive and protect cryptographic keys. By integrating PUF security with GlobalSign’s proven PKI solutions we offer a scalable and universally compatible solution that builds an unbroken chain of trust from chip to cloud.”

Intrinsic-ID’s key management solution software-based identity algorithms leverage existing SRAM capabilities to create unique, unspoofable device fingerprints which prevent the cloning of systems. GlobalSign’s cloud-based, high-volume certificate service certifies these fingerprints and adds public key infrastructure (PKI) capabilities, resulting in strong device identities and protection against untrusted applications and advanced attacks. Cryptographic operations and keys are never stored, so they are not present on the device when it is powered off. They are only created when needed using device-dependent PUFs.

The Integrated Solution Simplifies Design and Lowers Costs

The one-chip security solution offers flexibility and overall decreased costs, since it doesn’t require on-site support, and there is no need for an external cryptographic chip. Integrating identity provisioning into existing workflows allows for maximum throughput and simplified logistics. IoT cloud enrollment tasks, including device registration, integration with legacy inventory systems and role/permission policy assignment are automated.

Cloud-based certificate provisioning lowers costs by eliminating the need for an appliance-based solution. Delegating device identity enrollment to contract manufacturers can further reduce costs. GlobalSign’s high-volume certificate issuance service is built to meet the speed and production demands of the IoT and is able to issue thousands of certificates per second. In addition, GlobalSign’s certificate revocation service allows manufacturers to mitigate supply chain risks such as overproduction.

“IoT security depends on the ability to trust the integrity and identity of connected devices. PKI certified identities from GlobalSign and SRAM-PUF security from Intrinsic-ID are complementary technologies that attest to and protect the identity of these devices. SRAM-PUF is an attractive technology because it can be incorporated into a wide range of devices providing security for new and existing designs at low cost,” said Zachary Short, Principal Software Architect. “PKI certificates are the standard when it comes to authentication. They provide a secure foundation for trusted communication in a multitude of IoT protocols. GlobalSign’s high-volume certificate enrollment services provide the credentials your devices need delivered at scale.”

Overview of Key Benefits:

• The solution can be retrofitted to existing microcontrollers; no additional hardware needed
• Uncloneable, short-lived cryptographic keys protect against spoofed devices and even the most advanced invasive hardware attacks
• PKI-based credentials support device authentication for most IoT protocols
• Lightweight cryptographic support capabilities for constrained devices with ECC algorithms and streamlined certificate request formats
• High-volume enrollment service capable of issuing thousands of device IDs per second
• Provisioning process is automated and can be added into existing manufacturing flows

Learn More at the Intrinsic-ID Security Summit in Mountain View – Oct 24, 2016

Nisarg Desai, Product Manager of IoT Solutions, GlobalSign will demonstrate strong device identity for trust and security in IoT at Intrinsic-ID’s Security Summit. Attendees of the event will gain insights on the security needs of the Silicon-to-Cloud ecosystem. For more information and registration details, please visit: https://www.intrinsic-id.com/intrinsic-id-security-summit/.

Visit GlobalSign at IoT Solutions World Congress in Barcelona – Oct. 25-27, 2016

GlobalSign will be at Booth D541 in the Industrial Internet Consortium (IIC) Pavillon. The GlobalSign and Intrinsic-ID solution will be demoed at the booth, in addition to GlobalSign’s full range of IoT solutions.