printer friendly version

Trusted Platform Module explained

As security systems have transitioned into network devices over the last few decades, system vulnerabilities have transitioned as well. This shift in network utilisation brings with it far more vulnerabilities than compared to older analogue systems, and due to the very nature of networking the outer boundary of the surveillance system can be vulnerable to attack.

The ‘arteries’ of an IP system, the physical network connections, need to reach the edge components, namely the cameras, which are often mounted in exposed locations. Thus, these arteries and edge components need intensified protection.

Trusted Platform Module

In this document we focus on the ‘key vault’ inside a device which stores, amongst other private data, the most secret data for authentication and authenticity of a device: the Trusted Platform Module.

For years, Bosch IP cameras, encoders and selected storage systems have come with an onboard security chip – actually a system-on-a-chip which we call our Trusted Platform Module (TPM) – that provides functionality similar to crypto smartcards, like credit or debit cards. Such a Trusted Platform Module secures authenticity and acts like a safe for critical data, protecting certificates, keys, licences, etc. against unauthorised access even when the device is physically opened to gain access.

We consider it a necessity and expect state-of-the art technology to take care of security when referring to our financial transactions in everyday life. Why then should video surveillance equipment and assets be secured less?

The following description applies to all devices equipped with a Trusted Platform Module. For simplicity and according to the highest vulnerability level, we will refer to the device as being a camera.

What a Trusted Platform Module is

A Trusted Platform Module is a self-contained system that acts as a cryptographic co-processor to the camera system, connected to it via a serial interface. The Trusted Platform Module runs its own firmware which is continuously maintained to provide optimal protection against possible threats known from the market. Its firmware is only loaded in a secure production environment, not remotely like firmware for cameras. New Trusted Platform Module versions thus are only deployed with new produced cameras.

Communication between the camera firmware and the Trusted Platform Module chip happens via ‘Secure Apps’ inside the Trusted Platform Module. These provide the interfaces and commands for certain functionalities. There is no possibility for the firmware or operating system to modify anything inside the Trusted Platform Module directly.

The Certificate Store as a functional block in the camera stores less critical data, like certificate bodies and public keys, in a dedicated memory, but outside the Trusted Platform Module. All critical cryptographic activities are handled by specific functions, called Secure Apps, which make use of the Trusted Platform Module’s internal resources.

What a Trusted Platform Module does

As mentioned before, a Trusted Platform Module acts like a co-processor to the camera system. The key vault resembles some volatile and non-volatile memory to store keys and other relevant data during runtime or over power cycles, according to operational requirements.

Private keys, if loaded with a certificate, are stored inside the Trusted Platform Module and then are no longer retrievable. They can then only be used through cryptographic operations provided by the Trusted Platform Module, respectively its Secure Apps. It is recommended to password-protect the private key to keep it a secret until safe storage within the Trusted Platform Module, e.g. using PKCS #12 file format.

Private keys that result from certificate signing requests (CSR) are created internally, kept secret and never revealed to outside the Trusted Platform Module, making certificate enrolment via certificate signing requests the highest level of security.

Its encryption engine provides key handling support for symmetrical encryption like Triple DES or AES with up to 256 bits key length by calculating and producing the encryption key. Once the key is delivered, the Triple DES or AES encryption or decryption itself for video or other payload is then done by the encryption engine (hardware accelerator) in the main CPU.

The PKI engine supports in certificate validation and authentication, handling key lengths of up to 2048 bits, while the Secure CPU helps with any other cryptographic functionality like creating signed hashes for e.g. video authentication.

What a Trusted Platform Module’s benefits are

A camera as the most exposed component of an IP video surveillance system faces the most threats. Besides the many cyber threats, it can also be stolen and hacked. Such might happen as the ultimate attempt by an attacker to retrieve certificate and key to later-on simulate a camera by his/her own equipment, trying to hack deeper into the surveillance system, maybe even beyond.

A device, be it a camera or any other system, without a Trusted Platform Module must store private keys in its file system, where it might reside in an especially encrypted file, but the key to this must also be stored somewhere in the file system.

If hacking into a camera’s certificate store does not reveal what is being looked for, a side-channel attack may do. Such an attack uses analytic hardware equipment to listen to the data bus of the system while this is performing its tasks. When triggering the authentication process, at some point, the key will appear unencrypted.

With sufficient criminal energy, time and appropriate equipment, the attacker will eventually succeed. A compromised private key can cripple the whole Public Key Infrastructure.

Having a Trusted Platform Module integrated, no such attempt will become successful as any activities involving a private key occur only inside the Trusted Platform Module. The Trusted Platform Module’s chip technology is even protected against light and laser attacks if someone would afford to grind off the chip’s housing.

For more information contact Bosch Security Systems – South Africa & sub-Saharan Africa, +27 (0)11 651 9600, security.systems@za.bosch.com,

http://africa.boschsecurity.com

Share this article:

Further reading: