Название: Engineering Secure Devices: A Practical Guide for Embedded System Architects and Developers
Автор: Dominik Merli
Издательство: No Starch Press
Год: 2024
Страниц: 288
Язык: английский
Формат: epub
Размер: 20.2 MB

This practical guide to building embedded and IoT devices securely is an essential resource for current and future developers tasked with protecting users from the potential threats of these ubiquitous devices.

As an engineer, you know that countless devices—from industrial components to smart household appliances—rely on embedded computer systems. But how do you balance the need for robust security with performance and innovative product design?

Engineering Secure Devices will guide you through crafting secure devices—from protecting crucial assets to the nature of attackers and the risks they pose. You’ll explore the technical intricacies and pros and cons of symmetric and asymmetric cryptography and learn how to use and analyze random number generators and cryptographic algorithms. You’ll learn how to ensure confidential data storage and secure memory, and devise secure device identity solutions and communication protocols to reinforce system architecture against potential threats. And finally, you’ll learn how to properly design secure boot and secure update processes, manage access control, and perform system monitoring to secure IoT devices.

Real-world case studies throughout highlight practical applications, solutions, and obstacles, such as firmware updates with SWUpdate, secure communication with MQTT, and advanced access control with AppArmor.

The application domains of embedded systems are extremely wide. They’re used in controllers, sensors, and actuators in industrial automation, transportation, and critical infrastructure systems. Communication and network hardware like routers, switches, and base stations are based on them too. In the consumer market, typical products with embedded systems include smart washing machines, intelligent heating systems, and gaming consoles. Even the plastic cards we use for banking and building access control can be considered a type of embedded system.

Compared to personal computers (PCs) and server systems, these devices often face constraints, like the need to keep down manufacturing costs or run on hardware with low to moderate computational power, in addition to the rather limited options for input and output capabilities. Embedded systems are used in very specific, sometimes critical areas, and they usually operate with few user interactions, if any. Further, these devices are built from a wide range of hardware, firmware, and operating systems in use across different products, manufacturers, and industries.

On top of those limitations, adding security requirements to the equation doesn’t make the life of an embedded systems engineer easier. The development of security measures for these devices, their specific application environments, and their constrained resources lead to challenging tasks for architects and developers. As if all these things weren’t enough, in many cases, embedded systems also face physical attackers, which are a more powerful attack model in comparison to remote access on cloud or web services, for example.

You’ll also dig into topics like:

Analyzing the performance of cryptographic implementations in both hardware and software
Considerations for secure boot and software update processes to ensure ongoing firmware integrity
Designing robust device architectures that withstand attacks while maintaining critical operations
Developing strategies to detect and respond to anomalies or security breaches in embedded systems

Whether you’re an IoT developer or an embedded system architect, Engineering Secure Devices equips you with the indispensable knowledge to design, secure, and support the next generation of smart devices—from webcams to four-legged robots.