Introduction to Secure Embedded Systems

Abstract

Security is increasingly widespread in many embedded systems. Embedded systems requiring security range from the smallest RFID tag to satellites orbiting the earth. This widespread need for security is expected to continue for many more decades. Future growth services include identify control (e-passport, e-VISA), public services (e-administration, e-commerce, e-banking, transportation), communication (SIM card, PDAs), retail business (inventory systems), health care (patient monitoring, RFID, pharmaceuticals supply chain), and entertainment (games, movie industry). For example, the global shipment of smart cards exceeded five billion units in 2008. This is expected to increase by 11% through 2012 (RNCOS 2009). In 2008, 70% of the shipment was attributable to mobile subscribers. The use of contactless smart cards is expected to grow by 30% through 2012 (RNCOS 2009). This section will briefly introduce some types of security attacks on embedded systems and then overview some interesting embedded systems describing their security requirements.

Embedding security into devices is not a straightforward process. First the type of security functionality to embed into the device must be determined. This is often a challenge since specifying security requirements largely depends upon attack or threat models, which may not be fully known at the time. Designers must also ensure that their implementations are secure, since this is typically the focus of attacks. Unlike other embedded constraints such as energy, performance, and cost, which can be verified and quantified, the verification of security is often not possible (apart from functionality). In general, the security cannot be quantified nor can it be readily verified due to the possibility of unforeseen future attacks. From a security point of view, a complete understanding of the device from the process level and up is necessary in order to verify that the security and its implementation are sound. This section will discuss attacks and the need for security in some interesting embedded systems.