We would like to share with you again an interesting blog from Mark Scantlebury, writer for the high tech industry. Original url: http://embedded.communities.intel.com/community/en/blog/2013/11/12/roving-reporter-securing-the-internet-of-pos
Most consumers, myself included, harbor very real fears of our private information getting in the hands of those who could steal our identity and money, as well as damage our credit ratings. Whether it’s using a credit card or virtual wallet or typing in a PIN, there’s always in the back of the mind a concern about where that data is going and who might have access to it.
Obviously, there’s good reason for this fear. As concepts such as the connected store and Internet of Things (IoT) gain speed and spread globally, so does the potential for data, security and privacy breaches. The people who commit these crimes keep right up with the technology trajectory, looking for new opportunities to create havoc and pad their pockets. This makes it imperative for retailers to constantly upgrade their ability to secure the POS systems, interactive kiosks, and any other retail devices that are part of or connected to a retailer’s transactional systems. The consequences of a security breach or failure are too great to ignore, including everything from substantial fines to loss of consumer trust and damage to a company’s brand.
Fortunately, companies like Intel, McAfee, and Microsoft are constantly upgrading security technology and the security features of their products. Equally important, board companies, particularly members of the Intel® Intelligent Systems Alliance, are taking advantage of these security technologies and features to enable developers better ways each year to give retailers transactional products delivering ever higher levels of security.
The Need for End-to-End Security
With the IoT, everything is connected over the Internet and a potential point of attack. In the connected store, vulnerable devices include everything from the POS systems, interactive kiosks, digital signs, and intelligent vending machines and shelf talkers. What’s more, it’s just a few short hops from one of these to an in-store server and from there, a retailer’s data center or cloud services.
To provide protection, each device needs security features. In addition, there should be isolation and containment solutions to protect other devices should these security features somehow be breached. Since there is an end-to-end connection between the processors that power each device in the chain, a logical place to start is platform protection based on the processors themselves.
Intel has thought a lot about this, and in this post I want to take a little deeper look at the hardware-based security technologies of 4th generation Intel® Core processors that I touched on in a previous post. These technologies—focused on the platform, data and identity protection—address the full range of threats in retail devices: malware, content graffiti, identify theft, system compromise or theft, and data theft.
Intel Platform Protection Technology with BIOS Guard. Contained in a privileged space invisible to anti-virus software, a device’s BIOS is a potential weak spot that attackers target to gain access to a device’s operating system (OS) and applications. Malware infecting a BIOS remains persistent, even after a cold boot. What’s more, attackers are now targeting vulnerabilities in System Management Mode (SMM) and System Management Interrupt (SM) handlers. For these reasons, platform security must begin with the BIOS.
BIOS Guard—available in U-series 4th generation Intel Core processors—ensures that updates to system BIOS flash are secure by cryptographically verifying them through the BIOS Guard module (see Figure 1). This module protects the BIOS flash from modification without platform manufacturer authorization, helps defend the platform against low-level DOS (denial of service) attacks, and restores the BIOS to a known good state after an attack.
Figure 1. Intel Platform Protection Technology with BIOS Guard provides comprehensive protection for firmware to prevent malware infections.
BIOS Guard uses a protected agent running in Authenticated Code RAM to perform authentication and updating of flash control software. To secure Embedded Controller (EC) flash updates, BIOS Guard employs early BIOS POST provisioning of a random secret that is shared between the CPU and EC. The EC will reject all protected operations without this identification.
As for SMM vulnerabilities, BIOS Guard addresses these by strengthening the update trust boundary.
Bottom line, with BIOS Guard, only OEM-authorized BIOS and firmware will be updated, regardless of who performs the update.
Intel® Platform Trust Technology (Intel® PTT). This platform technology strengthens the credential storage and key management used by Microsoft Windows 8. Intel PTT supports secure and measured boot and all the Microsoft mandatory commands for Trusted Platform Module (TPM) 2.0 v.0.88. Available, again, in U-series platforms (one of which we’ll discuss in this post), Intel PTT is an integrated solution in the Intel® Management Engine for 4th generation Intel Core processors. Particularly remarkable is what happens when Intel Platform Protection with Boot Guard technology teams up with Intel PTT. The combination reduces the complexity of the Windows 8 boot process and protects against boot block-level malware. Boot Guard adds a level of hardware-based platform security to prevent the repurposing of the platform to run unauthorized software such as keylogging applications. Each time a system boots, Boot Guard ensures only authorized firmware and an authorized OS are running on the system.
Intel® Data Protection Technology with Intel AES New Instructions (Intel® AES-NI). Encryption is a key PCI DSS compliance requirement for protecting data in transit across public networks. Equally important, encrypting hard drives protects data in the event of device theft, like someone stealing a POS system. But encryption/decryption operations come at a cost; they impact performance. Intel® AES-NI provides hardware-accelerated data encryption and decryption, significantly reducing the impact of these operations and delivering better user experiences. What’s more, by running in data-independent time and not using tables, AES instructions help eliminate the major timing and cache-based attacks that can threaten table-based software implementations of AES. Taking this even further, by performing encryption/decryption in hardware without the need for software lookup tables, Intel AES-NI also lowers the risk of side-channel attacks by malware that uses information gained from implementation of cryptosystems to crack encryption.
Intel® Identity Protection Technology (Intel® IPT) with NFC. Originally designed for PCs, this integrated chipset-based security feature is a great technology for retailers looking to install POS systems allowing “Tap-and-Pay” sales via NFC-enabled smartphones or smartcards. Providing a suite of security technologies—One Time Password, Protected Transaction Display, and Embedded Public Key Infrastructure (PKI), Intel IPT enables a “Tap and Interact” use case that allows secure interaction with interactive devices such as a retail kiosk or digital sign.
Current NFC usage models can be vulnerable to malware. Downloaded user identity data from a smartphone is processed by an OS-based application running on the retail device, opening a door to hacking. Intel IPT closes this door by isolating the data received by NFC from the operating system. Not letting the OS “know” the transaction data used in a transaction prevents potential malware from gaining access to it.
Hardening Security Software Against Crime
In addition to Intel’s hardware-based security features, retailers need anti-malware, anti-spyware, and anti-virus software solutions to ensure a comprehensive retail defense plan. One benefit of choosing boards with 4th generation Intel Core processors is that Intel works closely with McAfee, a wholly owned subsidiary, to provide hardware enhancements to McAfee security software solutions that make them even better.
By deploying McAfee® solutions with retail devices based on 4th generation Intel Core processors, retailers achieve a greater degree of security than either offers alone. For example, when Intel® vPro™ technology is enabled, it provides hardware-based mechanisms based in Intel® Active Management Technology, Intel® Virtualization Technology, and Intel® Trusted Execution Technology (Intel® TXT) that work with McAfee solutions like McAfee® Deep Defender, ePO Deep Command, and McAfee Endpoint Encryption to improve their operation and effectiveness across a full range of system threats.
Intel TXT is particularly important because if a device with Intel TXT-enabled has been tampered with, the system launch sequence will be halted to prevent the malicious code from executing. This isolates the device and infection, keeping it from spreading to other devices. Rapid remediation can then be performed using McAfee ePO Deep Command. (For more on this synergy, see this animation.)
So What Board Enables All This Protection?
The greatest source of boards for developing POS and other intelligent retail devices with these security capabilities is the Intel® Intelligent Systems Alliance. With early access to Intel roadmaps, test platforms, and design support, these manufacturers are able to innovate with the latest technologies to deliver first-in-market solutions that developers can use to stay ahead of their competition.
A good example comes from Advantech, a Premier member of the Alliance. Their MIO-5271 3.5” MI/O-Compact SBC (Figure 2) uses a 4th generation Intel® Core™ i5/i3 U processor to deliver a fanless solution for POS systems and other retail devices that can provide all the mentioned Intel platform protection solutions and the hardware enhancements for McAfee software. The result is true Internet of POS security at a level that few retailers have achieved.
Figure 2. Advantech MIO-5271 3.5” Compact SBC
Leveraging the integrated graphics of its processor, this SBC can run three independent displays, making it a great choice for POS, self-checkout stations, and kiosks. The board supports VGA, LVDS, and HDMI/Displayport*, plus DirectX11.1, OpenGL 4.0, OpenCL 1.3. The SBC’s flexible design includes integrated 2 GbE ports, HD Audio, and a rich I/O interface with 4 COM, 2 SATA, SMBus/I2C, GPIO, half-size Mini PCIe, full-size Mini PCIe, mSATA and 2 USB 3.0 ports. In addition, the MIO-5271 includes Advantech’s MIOe interface, enabling additional I/O through an Advantech MIO module or a custom one.
The board supports Intel vPro technology, as well as Novell iManager, Advantech’s own SUSIAccess (which adds additional synergy with various McAfee security products), and Advantech’s Embedded Software APIs for enhancing cloud services and use with Microsoft Windows Embedded OS products.
Advantech also makes it easy to add displays. Their IDK-1115P series is a 15″ industrial grade LCD display with projected capacitive touch supporting 2-point touch (Figure 3). Their IDK-1115R series is a 15″ industrial grade LCD display with 5-wire resistive touch and options for anti-reflective surface treatment and optical bonding for greater performance and durability. Both displays feature a low maximum power consumption of 10.8W and provide developers with maximum flexibility for their designs.
Figure 3. Advantech IDK-1115P Display
Secure the Connected Store
Granted, the benefits of being able to connect all the digital devices in a store to the back end or cloud through the Internet also create a compelling need to bolster platform, data, and privacy protections to protect store and customer information. While no one solution provides complete protection, developers basing their solutions on boards like the Advantech MIO-5271 using a 4th generation Intel Core processor will provide retailers and system integrators with a comprehensive foundation for securing the Internet of POS.
|Solutions in this blog:
Roving Reporter (Intel Contractor), Intel® Intelligent Systems Alliance
Associate Editior, Embedded Innovator magazine