1. Information Security of Embedded Systems 28.10.2009: Embedded Systems – Terms and Definitions Prof. Dr. Holger Schlingloff Institut für Informatik und Fraunhofer FIRST

2. 28.10.2009Embedded Security © Prof. Dr. H. Schlingloff 20092 Structure 1. Introductory example 2. Embedded systems engineering 1.definitions and terms 2.design principles 3. Foundations of security 1.threats, attacks, measures 2.construction of safe systems 4. Design of secure systems 1.design challenges 2.safety modelling and assessment 3.cryptographic algorithms 5. Communication of embedded systems 1.remote access 2.sensor networks 6. Algorithms and measures 1.digital signatures 2.key management 3.authentification 4.authorization 7. Formal methods for security 1.protocol verification 2.logics and proof methods

3. 28.10.2009Embedded Security © Prof. Dr. H. Schlingloff 20093 2. Embedded Systems Engineering Material WorldIdeal World ThingsMatter, EnergyInformation Represen -tation ShapeForm Transfor- mation convert (split & splice, cut & assemble, mould & cast, …) process (code & recode, calculate & compute, …) Transfermove, transmitcommunicate

4. 28.10.2009Embedded Security © Prof. Dr. H. Schlingloff 20094 Technical and Computational System Matter / energy = undefined basic term Technical system = machine/mechanism for the conversion or relocation of matter and/or energy  wheel, car, motor, gears, steel mill, power plant, light bulb, … Information = undefined basic term Information processing = transformation or transfer of information System = “something composite”, usually: composed by humans (“artefact”) Computational system = Information processing system = artefact for the transformation or transfer of information  “computer”, “calculator”, “processor”

5. 28.10.2009Embedded Security © Prof. Dr. H. Schlingloff 20095 Embedded System Embedded system = computational system within a technical system (information processing component of technical syst.)  designed, built and operated as a fixed component  special purpose, in contrast to general-purpose  interaction with physical environment via designated interfaces  reactivity and real-time behaviour Characteristic attributes  often for control tasks  often mass-produced, consumer goods, cheap commodity  mostly hard to maintain or extend  sometimes safety-relevant or safety-critical  communicating, connected, ubiquitous, pervasive, ambient, …

6. 28.10.2009Embedded Security © Prof. Dr. H. Schlingloff 20096 Examples How many embedded systems are in this room? How many embedded systems did you encounter today?

7. 28.10.2009Embedded Security © Prof. Dr. H. Schlingloff 20097 Embedded System or Not? Phone Watch Robot Assembly line Factory SAP-System in factory

8. 28.10.2009Embedded Security © Prof. Dr. H. Schlingloff 20098 Market Areas (cf. [Fränzle]) Transport technologies  motor/gear control, X-by-wire, position and dynamics stabilisation, ABS, passenger comfort, …  traffic guidance, signal lights, radar localisation, … Communication technologies  cell phone, dect-phone, DSL- modem, router, switch, … Office equipment  fax machine, copier, printer, pointer, … Household appliances  watch, microwave, toaster, gas burner, washing machine, audio/video-equipment, remote control unit, gaming, … Trade and Services  ticket machine, sales automaton, taxometer, cash machine, … Building automation and control  heating, lighting, elevators, locking and sentry services, security functions Production- and environmental technology  power and production plants, emission control, robotics Medical technology  ambient devices, hospital equipment, diagnosis and treatment instruments

9. 28.10.2009Embedded Security © Prof. Dr. H. Schlingloff 20099 Market Relevance over 10 billion embedded processor unit shipments in 2008 99.6 % of all processors are used in embedded systems 87,6% of all produced microcontrollers are „pre-Win98-CPUs“ (DSPs, FPGAs, and MCUs), of which 57,6% are 8-Bit-processors W. Schröder-Preikschat, http://www4.informatik.uni-erlangen.de/~wosch/Talks/040108HUB.pdf, zitiert Quelle: D. Tennenhouse. Proactive Computing. Communications of the ACM, 43(5):43–50, May 2000 http://www.embeddedstar.com/weblog/2009/02/19/embedded-systems-practice/

10. 28.10.2009Embedded Security © Prof. Dr. H. Schlingloff 200910 Predictable Future The trend will continue  more new embedded processors than humans per year  elektronics as consumable goods (e.g. RFID, post cards) Ubiquitous computing, ambient assisted living  smart clothing (CeBIT `08)  glasses with hearing aids, augmented reality  watch with UMTS  talking neckties? SoC, „System-on-Chip“ „Smart Dust“, sensor networks Intelligent agents, autonomous systems …

11. 28.10.2009Embedded Security © Prof. Dr. H. Schlingloff 200911 Specific Problems of Embedded Systems Designed, built and operated as a fixed component of a technical system  physical and mechanical constraints, assembly near the controlled process (e.g. inside jet engine or inside tyre)  physical stress Special purpose, fixed tasks  efficiency, minimal resource consumption  predefined interfaces Interaction with physical environment  sensor and actuator design  mechanical impreciseness  feedback effects  unreliability of sensors and actuators Reactivity and real-time behaviour  operating systems requirements  verification problems

12. 28.10.2009Embedded Security © Prof. Dr. H. Schlingloff 200912 Announcement

13. 28.10.2009Embedded Security © Prof. Dr. H. Schlingloff 200913 Further Design Challenges Often for control tasks  interaction of civil engineers and software engineers Often mass-produced, consumer goods, cheap commodity  cost pressure for production (optimisation within cents)  resource limitation (e.g. bandwidth, energy) Mostly hard to maintain or extend  maintainance costs vs. development costs vs. production costs  no „service packs“, everything must be correct at first launch  callback or guarantee replacement can be desastrous Sometimes safety-relevant or safety-critical  reliability, availability, maintainability (RAM)  fault tolerance Communicating, connected, ubiquitous, ambient, …  synchronization, multi-core deployment, feature interaction

14. 28.10.2009Embedded Security © Prof. Dr. H. Schlingloff 200914 Embedded Systems Design Waterfall or V-Model  small to medium design groups  civil engineers, electrical engineers  software often not valued Model-based design  Matlab/Simulink, UML  code generation Product lines  no real system is developed “from scratch”  look-and-feel, component reuse