Smart, connected devices are making our lives more convenient. But on the other hand, the proliferation of these devices also means that more of our data—including personal and/or sensitive information—is vulnerable to security breaches. Protecting data that is in transit and at rest has never been more critical.

The Transport Layer Security (TLS) protocol, the successor to Secure Sockets Layer (SSL), prevents eavesdropping or tampering of data in transit as internet of things (IoT) devices communicate over the internet. It essentially creates a secure communication channel between a client and a server. Hypertext Transfer Protocol Secure (HTTPS), which we see when we visit a website secured by an SSL certificate, brings together HTTP with SSL/TLS to deliver encrypted communication with, along with secure identification of, a Web server.

TLS involves a “handshake phase” that uses asymmetric keys to agree on a symmetric key pair, which is used only for that session and enables efficient and fast data encryption and decryption. A secure IC can handle this handshake phase, storing the private session keys and performing the encryption/decryption in a separate device with countermeasures against known methods of hacking and attacks. If the private keys and certificates aren’t stored securely and protected from improper modification, these assets can be exposed to attacks. There are invasive attacks where the attacker attempts to open the device’s enclosure to manipulate the memory content, replace the firmware, or probe the PCB traces. And there are non-invasive attacks, where logical bugs in the device’s firmware are targeted.

Fortunately, there is a low-cost, low-complexity solution that can secure the implementation of the TLS protocol in a connected, embedded system while also reducing the burden on the device’s application processor.

Secure companion ICs can protect a TLS implementation for your IoT design.

Pitfalls of TLS Integration in Embedded Devices

One of the advantages of the TLS protocol is that it can be integrated fairly easily into any application using off-the-shelf software libraries. However, even if you have a bug-free TLS stack, the integration and use of the TLS library in your software may still be flawed. Common weaknesses of a TLS integration in an embedded device include:

• Skipped certificate verification
• Weak cipher suites
• Insufficient protection of certification authority certificates
• Exposure of session keys
• Compromised client authentication keys
• Use of poor cryptographic implementations and low-quality random numbers

There are a set of minimum rules to follow in order to have a truly secure TLS scheme and avoid the pitfalls we’ve discussed. Protecting session keys while in use, utilizing secure cryptographic algorithms, and safely storing the client’s private authentication keys are among the rules. What’s also effective is using a companion secure IC to secure the TLS implementation. Without placing any additional burden on your design’s application processor, a secure IC can inherently prevent many of the vulnerabilities of a TLS implementation. Read my application note, "Using Secure Companion ICs to Protect a TLS Implementation" for an in-depth understanding of TLS implementation pitfalls and how a secure IC such as the MAXQ1061 can help you avoid these pitfalls. The MAXQ1061 enables TLS even in resource-constrained embedded systems. The secure IC also reinforces the intrinsic security of the TLS protocol by protecting the critical steps of authentication during the handshake, session key computation, and package encryption/decryption.