Consider IoT TPM security to augment existing protection

Understand TPM's role in IoT authentication

TPM technology is a hardware-based security microcontroller for the device it's installed on and securely stores artifacts used to authenticate the device on the network. The artifacts include passwords, certificates or encryption keys. Many vendors include TPMs in their IoT hubs, such as Microsoft Azure and Ibase, while other vendors upgrade their firmware to accept integrated or firmware TPM modules, such as the Intel Platform Trust Technology component. TPMs are hardware-based and made tamper-resistant from physical attacks and software hacks through RSA keys burned into the chips.

4 types of TPM security offer different pros and cons

Organizations have four main types of TPM security available to them. Each offers different trade-offs between cost, features and security.

Discrete TPM provides the highest security level and only works as a security piece of hardware. It acts as a yes or no security protocol. When any tampering or breach is detected within the device or connected network, the TPM will close all device access to isolate it from the attack.

Integrated TPM hardware-based security uses a chip that provides functions other than just security. It is primarily resistant to software attacks, but it is not designed to be tamper-resistant.

Organizations implement firmware TPM as protected software runs on the device's main CPU, rather than installed via a separate TPM chip. The TPM runs like any other code on the device in a trusted execution environment (TEE) that separates it from the rest of the CPU's programs. Firmware TPM is not tamper-resistant and depends on other security aspects within the device and network to keep it safe, such as the TEE OS or the application code running the TEE.

TPMs make other processes, such as certificate-based security or digital signing processes, more secure.

Software TPM is a software emulator for the TPM. Organizations should only use this TPM to test or prototype IoT devices because it's vulnerable to breaches through the OS, network connections and malicious code.

While TPMs can increase the security of an IoT device, organizations can't use them as the single line of defense for devices. TPMs make other processes, such as certificate-based security or digital signing processes, more secure.

Consider IoT TPM advantages and disadvantages

Organizations that want to boost their IoT deployment security with TPMs should consider its advantages and disadvantages.

1. TPMs are passive security devices

TPMs don't control anything on the host system they're embedded on. They serve as part of the overall security and may have their own storage and processing capabilities used for protected operations on its internal resources. Organizations must use TPMs in conjunction with other security processes and protocols such as firewalls, antivirus software or certificates.

2. TPM doesn't offer secure booting of IoT devices

By their very nature, TPMs don't offer secure boot because the device engages them after booting up. Any running software can use the TPM to authenticate connections or decrypt the next piece of software before it loads, but TPM does not protect the device if a hacker gets access to an early boot code.

3. TPM isn't used in many IoT devices

TPM has a long history in technology but is newer to IoT devices as part of the ISO/IEC 11889:2015 standard. Devices produced under this standard have TPM available to manufacturers and consumers, but devices produced before it may not. The TPM 2.0 specification developed by the Trusted Computing Group included IoT capabilities, and the ISO/IEC 11889:2015 standard incorporates the specification.

4. TPMs can be expensive

Organizations may incur costs to implement TPMs based on the type. A discrete or integrated TPM is expensive because a piece of hardware must be installed on the device motherboard. Unless a TPM already comes preinstalled in the IoT device, the organization may incur higher costs to integrate it on a custom device.

If an older device doesn't use the newly developed TPM 2.0 specification that's better suited for IoT devices, IT admins may spend more to replace all of those devices in the fleet. For the typical organization today, a small cost for smaller implementations might mean replacing thousands of devices at once and put modern IoT security out of reach.

5. TPMs can boost IoT security

TPMs can increase an organization's security posture immediately because they make device integrity verifiable and authentication more secure. TPMs bring a higher security level to commercially available devices by adding a hardware-based security mechanism that offers a scalable way to keep track of device authentication and security. For any organization with a large IoT footprint, TPMs can save time.

6. TPMs make device maintenance easier

IT admins can't manage an IoT device properly if they don't know whether the device has been compromised. When IT admins can verifiably track IoT device integrity, they can use TPMs to protect the device's software and firmware updates. TPMs verify all updates were installed and that the device functions correctly and securely.

7. TPMs suit security-based tasks better

TPMs are well suited to being used in IoT with their long history and flexibility for handling multiple security-based tasks. They can be customized for any IoT device and implemented in the best way for each device while offering the highest level of security possible.