Cyber Resilience Act Implementing Cybersecurity in IIoT in Compliance with CRA

Related Vendors

Microchip LTD

FAULHABER Drive Systems

Wuxi InfiMotion Technology Co., Ltd.

Cybersecurity regulations such as the Cyber Resilience Act are changing the IoT landscape. It is becoming all the more important for device manufacturers to implement functioning cryptographic measures from the outset and maintain them throughout the entire product lifecycle. An authentication chip such as the TrustMANAGER ECC608 can help here.

The rise of the IoT and its industrial counterpart, the Industrial IoT (IIoT), shows no signs of slowing down. IoT-connected sensors, actuators and other smart nodes are ubiquitous in our homes, offices and factories. The variety of these applications is impressive, ranging from simple environmental sensors to large-scale use of door locks in hotel rooms. In our homes, the use of IoT is increasing every day. The average household has smart heating and ventilation controls, remote control doorbells, smart speakers and immersive audio systems.

There is no doubt that any IoT/IIoT deployment, large or small, brings significant benefits, from greater convenience for the user to more efficient manufacturing. However, the operational architecture of IoT tends to be complex and involves many layers, service providers and hardware environments. In addition to increasing security concerns and the growing regulatory environment, device manufacturers and service providers face numerous challenges.

There are many aspects to consider when it comes to cyber security, especially because IoT devices can be vulnerable to malicious attacks. These attempt to access sensitive personal data such as passwords or take control of an industrial process and lock users out of systems. Every aspect of an IoT/IIoT implementation requires careful security precautions - from hardware to software to communication.

Current legislation such as the EU Cyber Resilience Act (CRA) places the responsibility on IoT device manufacturers to certify the security features of their devices and provide a mechanism for users to update and manage a device throughout its lifecycle, from production to end of life. The CRA is harmonized with other internationally recognized safety standards, such as the European Telecommunications Standards Institute (ETSI) standard EN 303 645 and the International Society of Automation (ISA)/International Electrotechnical Commission (IEC) standard 62443 on the safety of industrial automation and control systems.

Challenges in the Provision

New cybersecurity laws are ushering in a new era for the IoT/IIoT and require a comprehensive approach to lifecycle management to protect users, data and computing infrastructure. Until now, connected devices, whether at home or for industrial purposes, were mostly installed and then forgotten. They rarely received firmware updates, and even when these were available, they could be time-consuming to perform or, worse still, the microcontroller architecture (MCU) no longer supported the security functions to patch the identified vulnerability. As a result, companies stopped production, leading to frustration among customers. Implementing security patches to protect the device and the associated network environment from new cyberattacks and malware was extremely difficult. Shipping products with the same password was also widespread, leading to several serious security breaches. Such attacks exposed sensitive user data and damaged the brand's reputation.

The ability to manage an IoT device throughout its lifecycle offers significant operational benefits to manufacturers and service providers. New software features can be added at any stage - from important bug fixes to paid add-ons. For users, this ability to perform software security updates on demand means operational flexibility and cost efficiency. For large-scale deployments, the ability to deploy security patches to a wide range of devices without the need for lengthy, time-consuming and costly on-site visits provides an unprecedented level of customer service.

Another challenge with large-scale deployments is the change of ownership within the life cycle of IoT devices. An example is a hotel with 500 rooms where the door locks need to be updated with security certificates and digital signatures for each new guest. A similar challenge occurs in office buildings when all door locks for multiple tenants need to be updated with security codes that meet the requirements of the respective owner/tenant cybersecurity teams. Updating each lock individually - or worse, replacing each one - would be a daunting task. However, if each lock is equipped with a remote management function, security authorizations and user-specific options can be provided on site. This makes it easy to control the management of locks and access rights for each lock.

This also applies to serviced offices, where customers have access to specific floors, rooms and facilities depending on the rental package selected. Here too, the ability to change the security access data required for each facility quickly and remotely ensures high customer satisfaction and operational efficiency.

Provide Support Throughout the Entire Service Life

With the ability to provide on-site security credentials, over-the-air firmware updates (FOTA) and dynamic lifecycle management, the Software-as-a-Service/SaaS platform "Microchip TrustMANAGER with Kudelski keySTREAM" offers a comprehensive and efficient approach to meeting cybersecurity requirements such as those of the CRA.

Microchip's TrustMANAGER ECC608 crypto-authentication IC with keySTREAM SaaS enables a digital chain of trust for IoT/IIoT deployments across the entire product lifecycle - from initial design concept through production and deployment to end-of-life. A root certification authority (CA) is an important top-level entity in any public key infrastructure (PKI). Issuing a self-signed certificate creates the first anchor of trust.

An ECC608-TMNGTLS is a variant of the ECC608 crypto-authentication IC equipped with pre-configured cryptographic keys for connection to the keySTREAM SaaS platform. Once deployed, the IoT device connects to the ECC608-TMNGTLS plus keySTREAM SaaS and transfers ownership of the IoT device on-site to the intended owner. This is done through its custom PKI and enables an elegant zero-touch approach without the need to manually configure the key exchange. The cryptographic keys can be remotely managed within the physical boundaries of the secure authentication IC throughout its lifecycle.

The TrustMANAGER platform includes functions for radio-based firmware updates, secure code signing and remote management of cryptographic keys. The integration of remote management into the device design is becoming increasingly important for device manufacturers, alongside the requirements for security updates, as it offers service agility and flexibility.

Regulations Require Greater Focus on Safety

The IoT landscape is changing. An increased focus on cybersecurity regulations and more responsibility for device manufacturers is driving change. The European CRA, an example of a regional cybersecurity initiative, requires manufacturers to maintain a device's security features for the first five years of a product's life. Although the CRA is initially aimed at consumer IoT devices, the European regulation is likely to be just the tip of the iceberg as more and more states follow the EU's lead and begin to publish and mandate their own cybersecurity strategy. It is very likely that the CRA will also form the basis for cybersecurity standards in other markets and industries.

Cybersecurity regulations have far-reaching effects. They strengthen consumer confidence in a manufacturer's product range and its market credibility. This factor is crucial for building business relationships, partnerships and demonstrating market leadership. (sg)

*Xavier Bignalet is Product Marketing Manager in the Security Computing Group at Microchip.