PSA Certified – building trust in IoT - presentation by Rob Coombs,  Arm at the IoT Thames Valley Meetup on 19th June, 2019. https://www.meetup.com/Internet-of-Things-Thames-Valley/

1. Rob Coombs, Arm Limited
13/06/19
PSA Certified:
building trust in IoT
A security certification scheme for IoT

2. 2 © 2019 Arm Limited
Agenda
• Platform Security Architecture recap
• PSA Certified – building trust in IoT

3. 3 © 2019 Arm Limited
Trust is essential for digital transformation
Security
Trust devices Trust their data
Make
impactful decisions
Trust brings value
Trusted
devices
Connecting
and Managing
devices
Harnessing
Data
Insights &
Actions

4. 4 © 2019 Arm Limited
IoT security is fragmented
100’s of chip vendors with different Roots of
Trust of variable robustness, assurance,
quality
Many RTOS and software platforms
struggling to make use of the RoT
10’000’s OEMs building products without a
threat model or lab based evaluation
PSA has been designed to make it easier and
quicker for the value chain to build solutions
on a standardised RoT that can scale to low
cost microcontrollers SILICON
PARTNER
B
OEM 1 OEM 2 OEM 3
SILICON
PARTNER
A
SILICON
PARTNER
D
SILICON
PARTNER
C

5. 5 © 2019 Arm Limited
Trust starts with a Root of Trust (PSA-RoT)
Source of integrity and confidentiality
Arm has defined a PSA-RoT and provided an open
source reference implementation
Separates critical security functions in a Secure
Processing Environment (SPE) from rest of system
Typically used for secure boot, storing secrets,
crypto, attestation, audit logs…
Developed by Chip vendors
(e.g. by porting Trusted Firmware-M Open source
software to secure hardware)
PSA RoT
Crypto Attestation
Trusted
boot
Secure
Storage
CPU
Memory
Peripherals
PSA Dev-API
Microcontroller

6. 6 © 2019 Arm Limited
Making security easier to use
(API Compliance)
PSA Dev APIs
Trusted
boot
Crypto Attestation
Secure
Storage
Any RTOS/
SW Platform
Any
architecture
PSA RoT
Example security functions

7. 7 © 2019 Arm Limited
4 parts to Platform Security Architecture
Certify
A complete security offering – Openly published. Independently tested.

8. 8 © 2019 Arm Limited
PSA next steps
• Microcontroller with RTOS has been our first focus for PSA & TF-M
• Building a standard RoT and API Compliance program
• Creating a security certification program (next topic)
• PSA for Application processor with Rich OS (e.g. Linux) based systems is planned
• Making TEE easier to use with PSA Security Functions

9. 9 © 2019 Arm Limited
9
PSA Certified
Building trust in IoT

10. 10 © 2019 Arm Limited
PSA Certified – An overview
Building trust through independent testing
Dedicated to PSA-RoT enabled chips, devices and platforms
Builds on IoT threat models, PSA Security Model & PSA-RoT Protection Profile
Simple 3 level scheme
Scalable to IoT ecosystem
Backed by reputed experts
Supporting complementary vertical evaluations

11. 11 © 2019 Arm Limited
Who developed PSA Certified?
Six PSA Joint Stakeholder Members

12. 12 © 2019 Arm Limited
How it works
PSA Certified provides 3 progressive levels of
security assurance / robustness:
PSA Certified Level 1, 2 & 3
PSA Functional API Certified enables ecosystem
through a consistent high level interface to the PSA-
RoT
Robustness
Depthoftesting
PSA certified levels

13. 13 © 2019 Arm Limited
PSA Certified Levels
Three assurance Levels
Level 1: Document & Declare with lab check
• Security Model goals
• IoT Threat models – SFRs
• Aligning with governments code of practice
Level 2: Mid Level assurance/robustness
• Time-limited white box testing (CSPN style)
• PP, eval methodology & attack methods
Level 3: Substantial – MCU PP Under development
• More extensive attacks (AP similar to TEE)
• Higher assurance
• PP planned donation to GlobalPlatform
PSA
Certification
Level
Silicon
RoT
OS OEM
L3
Months
ü
3rd party evaluation
schemes e.g. SESIP,
UL2900L2
1 month ü
L1
1 day
ü ü ü

14. 14 © 2019 Arm Limited
www.psacertified.org now live
Thank you to our lead partners!
Great momentum for support PSA Certified
Additional certified products online:
Express logic
Keil RTX
Lierda

15. 15 © 2019 Arm Limited
Summary
PSA Certified™ builds trust in devices and data
Two components:
f u n c t i o n a l A P I
Security certification
A multi-level scheme testing the
security assurance/robustness of IoT
chips, platforms & devices designed for
systems that contain a PSA-RoT
Functional API certification (API
Compliance)
Uses test kits to prove that PSA based
solutions have a consistent set of APIs
for essential security functions,
ensuring a consistent developer
experience

16. 16 © 2019 Arm Limited
16
Questions?
Get started with PSA Certified™ and visit
www.psacertified.org

17. The Arm trademarks featured in this presentation are registered
trademarks or trademarks of Arm Limited (or its subsidiaries) in
the US and/or elsewhere. All rights reserved. All other marks
featured may be trademarks of their respective owners.
www.arm.com/company/policies/trademarks