IoT Root of Trust

Root of Trust is the building block for securing IoT devices, and the foundation for creating an environment of embedded trust. The Root of Trust is a device’s DNA, and is the critical anchor for authenticating a device’s identity. Incorporating immutable Root of Trust in IoT devices is a critical key element to protect them from cloning, counterfeiting, and reverse engineering.

The characteristics of Root of Trust are:

• Immutable – cannot be changed
• Injected during the manufacturing process – usually embedded in the device’s hardware
• A certificate that contains at least one cryptography key – typically part of a Key Public Infrastructure (KPI) architecture

How to Implement IoT Root of Trust

There is no single method for implementing Root of Trust across all IoT devices because of the myriad of applications and processor types across the IoT spectrum.

In general terms, Root of Trust consists of identity and cryptographic keys built into a device’s hardware contained in a secure boot environment. Root of Trust can also be embedded in software, but this is much less common.

Root of Trust is the first step in creating a chain of trust since it is virtually impossible for a “bad actor” to inject themselves into the manufacturing process.

There are various approaches for implementing Root of Trust:

Trust Zones
Zones within MPU/CPU/microcontrollers that have a One Time Programmable (OTP) capability for the insertion of a key or certificate during the manufacturing process. This allows for the injection of the Root of Trust “DNA” that is unique to the specific device.

Trusted Platform Module (TPM)/Hardware Secure Modules (HSM)

TPM’s are single purpose chips incorporated into processor boards that are used to store keys. Some Trusted Platform Modules are capable of cryptography. TPM’s are included in all personal computers that are manufactured today.

Hardware Secure Modules (HSM) can store keys as well as rapidly generate them.

Third Party Solutions
Another way to implement Root of Trust is by using a third party technology partner. Allegro has developed a strategic relationship with Intrinsic ID, a security technology provider with hardware Root of Trust  solutions that generate unique keys based on their patented SRAM PUF or Physical Unclonable Function.