IoT Sikkerhed. Afhængigheder til enheder, netværk og dataplatform. Ole Kjeldsen CTO & CISO Microsoft Danmark

Size: px

Start display at page:

Download "IoT Sikkerhed. Afhængigheder til enheder, netværk og dataplatform. Ole Kjeldsen CTO & CISO Microsoft Danmark"

Colleen Cummings
5 years ago
Views:

1 IoT Sikkerhed Afhængigheder til enheder, netværk og dataplatform Ole Kjeldsen CTO & CISO Microsoft Danmark

2 AGENDA What is How big is it & why? What are the Threats & more importantly the Solution So how is that done? Why Microsoft? When?. Much more if you want to deep dive

3 What is. 9 billion IoT devices deployed per year Microsoft Corporation

4 Microcontrollers (MCUs) Wave 1: The Microcontroller (MCU) Wave 2: Internet Connectivity Microsoft Corporation 1970 s 1980 s 1990 s 2000 s 2010 s 2020 s 2030 s

5 9 BILLION new MCU devices deployed every year IN TOYS... IN APPLIANCES IN EQUIPMENT FEWER THAN 1% ARE CONNECTED TODAY.

*NSTAC Report to the President on the Internet of Things. www.dhs.

6 North Carolina Highway Signs Compromised By a Foreign Hacker* First/Largest known DDoS attack using insecure IoT devices (2016) disrupted WW internet traffic ** *NSTAC Report to the President on the Internet of Things. **

7 Microsoft Corporation

8 What is. 5 billion USD Microsoft investment in IoT Microsoft Corporation

9 The internet security battle. We ve been fighting it for decades. We have experience to share. Microsoft Corporation

10 Azure Sphere Announced at RSA

11 Azure Sphere is an end-to-end solution for securing MCU powered devices A new Azure Sphere class of MCUs, from silicon partners, with built-in Microsoft security technology provide connectivity and a dependable hardware root of trust. A new Azure Sphere OS secured by Microsoft for the devices 10-year lifetime to create a trustworthy platform for new IoT experiences Microsoft Corporation The Azure Sphere Security Service guards every Azure Sphere device; it brokers trust for device-to-device and device-to-cloud communication, detects emerging threats, and renews device security.

12 Highly-secured connected devices require 7 properties Hardware Root of Trust Is your device s identity and software integrity secured by hardware? Defense in Depth Does your device remain protected if a security mechanism is defeated? Small Trusted Computing Base Is your device s TCB protected from bugs in other code? Dynamic Compartments Certificate-Based Authentication Failure Reporting Renewable Security Can your device s security protections improve after deployment? Does your device use certificates instead of passwords for authentication? Does your device report back about failures and anomalies? Does your device s software update automatically? Microsoft Corporation = Silicon support required = OS support required = Cloud Service support required

13 Three components. One low price. No subscription required. An Azure Sphere certified MCU The Azure Sphere Security Service for 10 years The Azure Sphere OS with 10 years of on-device updates Microsoft Corporation

14 Open to any MCU manufacturer We are licensing our Pluton security subsystem royalty free for use in any chip* Azure Sphere is open Open to any cloud Azure Sphere devices are free to connect to Azure or any other cloud, proprietary or public for application data Open to any innovation MCU manufacturers are free to innovate with our GPL d OSS Linux kernel code base * Azure Sphere branding requires an Azure Sphere chip with Azure Sphere Microsoft Corporation OS and Azure Sphere Security Service

15 Connect millions of devices, integrate your business systems with new analysis tools to gain insights and transform your business. Get started quickly with preconfigured solutions for common IoT scenarios, using accellerators. Azure IoT Leverage a worldwide ecosystem of experienced IoT partners to tailor IoT solutions to your needs. Sphere delivers highly secured, Internet connected MCU devices with a purpose built OS & turn-key cloud service guarding every device.

Microsoft Corporation https://www.seeedstudio.

16 WHEN? The first devices with Azure Sphere MCUs on shelf September 2018 In preorder now! Microsoft Corporation

18 Microsoft Corporation

19 More. Sphere: Azure IoT: Accelerators: DevKit: Best Demo ever: Microsoft Corporation

20 Microsoft Research Paper: 7 Properties of Highly Secure Devices Microsoft Corporation

22 Ole Kjeldsen

23 Our Silicon Partners Microsoft Corporation

24 Hardware Root of Trust Unforgeable cryptographic keys generated and protected by hardware Is your device s identity and software integrity secured by hardware? Some properties depend only on hardware support o o o Hardware to protect Device Identity Hardware to Secure Boot Hardware to attest System Integrity Microsoft Corporation

25 Dynamic Compartments Internal barriers limit the reach of any single failure Can your device s security protections improve after deployment? Some properties depend on hardware and software o o Hardware to Create Barriers Software to Create Compartments Microsoft Corporation

26 Renewable Security Device security renewed to overcome evolving threats and security breaches. Does your device s software update automatically? Some properties depend on hardware, software and cloud o o o Cloud to Provide Updates Software to Apply Updates Cloud to Prevent Rollbacks Microsoft Corporation

27 Azure Sphere empowers manufacturers to create highly-secured, connected MCU devices S E C U R I T Y Every device built with Azure Sphere is secured by Microsoft. For its 10 year lifetime. P R O D U C T I V I T Y The Azure Sphere developer experience shortens OEM time to market. O P P O RT U N I T Y Azure Sphere empowers OEMs to create new customer experiences and business models. Microsoft Corporation

Azure Sphere MCUs create a secured root of trust for connected, intelligence edge devices C O N N E C T E D with built-in networking S E C U R E D with built-in Microsoft silicon C Osecurity N N E C

Security processing Subsystem power brought to MCUs for the first time C R O S S O V E R Cortex-A processing power brought to MCUs for the first time Microsoft Pluton Security Subsystem Firewall

28 Azure Sphere MCUs create a secured root of trust for connected, intelligence edge devices C O N N E C T E D with built-in networking S E C U R E D with built-in Microsoft silicon C Osecurity N N E C Ttechnology E D with built-in including networking the Pluton Security Subsystem S E C U R E D with built-in Microsoft silicon security technology C R O S Sincluding O V E R the Cortex-A Pluton Security processing Subsystem power brought to MCUs for the first time C R O S S O V E R Cortex-A processing power brought to MCUs for the first time Microsoft Pluton Security Subsystem Firewall Firewall Firewall ARM Cortex-A Optimized for low power FLASH 4MB SRAM 4MB Firewall Firewall Firewall Multiplexed I/O Network Connection Wi-Fi in first chips ARM Cortex-M For real-time processing GPIO PWM TDM I2S UART I2C SPI ADC Microsoft Corporation

29 The Azure Sphere OS is optimized for IoT, Security and MCU agility Azure Sphere OS Architecture OS Layer 4 App Containers for POSIX (on Cortex-A) App Containers for I/O (on Cortex-Ms) Secure Application Containers Compartmentalize code for agility, robustness & security OS Layer 3 OS Layer 2 OS Layer 1 On-chip Cloud Services HLOS Kernel Security Monitor On-chip Cloud Services Provide update, authentication, and connectivity Custom Linux kernel Empowers agile silicon evolution and reuse of code Security Monitor Guards integrity and access to critical resources Hardware Azure Sphere MCUs Microsoft Corporation

The Azure Sphere Security Service connects and protects every Azure Sphere device Protects your devices and your customers with certificate-based authentication of all communication Detects emerging

30 The Azure Sphere Security Service connects and protects every Azure Sphere device Protects your devices and your customers with certificate-based authentication of all communication Detects emerging security threats through automated processing of on-device failures Responds to threats with fully automated on-device updates of OS Allows for easy deployment of software updates to Azure Sphere powered devices Microsoft Corporation

Experience interactive, context-aware debugging across device and cloud Simplify Azure

31 Modernize MCU development with Azure Sphere and Visual Studio Simplify development Focus your device development effort on the value you want to create Streamline debugging Experience interactive, context-aware debugging across device and cloud Simplify Azure connect Connect your Azure Sphere devices quickly and easily to Azure IoT Microsoft Corporation

32 S E C U R I T Y Peace of mind Protect your products and customers with our turnkey, 7 property security solution that protects, detects and responds to threats dynamically so you re always prepared. P R O D U C T I V I T Y Faster time to market Lower overhead and increase team efficiency with tools that deliver productivity and dramatically optimize development and maintenance of your device and experiences. O P P O RT U N I T Y The future is now Transform engagement your products and customer strategies, and enable new revenue streams with connected crossover chips powerful enough to create next generation experiences. Microsoft Corporation

33 Microsoft Corporation

34 MICROSOFT WILL INVEST $5 BILLION IN IoT Our goal is to give every customer the ability to transform their businesses, and the world at large, with connected solutions.

35 The Internet of Things opportunity 80 billion connected things by IDC 70% value enabled by IoT from B2B scenarios - McKinsey and Company 180 zettabytes digital data by IDC $457 billion global IoT market by Gartner

36 Innovation at work real IoT use cases Auto Public Safety

37 Azure IoT Hero Portfolio Microsoft s vision is to democratize IoT by allowing everyone to access the benefits of IoT and provide the foundation for digital transformation Azure IoT Central Fully managed SaaS Best used when you need to get started quickly with minimal IoT experience Azure IoT Edge + On-premises processing Azure IoT solution accelerators Customizable PaaS Best used when you need a lot of control over your IoT solution Adds capacity to do local processing

End-to-end implementation Completely customizable Open-source microservices based architecture Azure IoT solution accelerators Device connectivity and management Dashboards,

38 End-to-end implementation Completely customizable Open-source microservices based architecture Azure IoT solution accelerators Device connectivity and management Dashboards, visualization and insights Workflow automation and integration Command and control Preconfigured solutions Remote Monitoring Predictive Maintenance Connected Factory Device Simulation

devices and begin tailor to your needs Fine-tuned to specific assets and

39 Accelerate time to value Start quickly for common IoT scenarios Finish with your IoT application Get started in minutes Modify existing rules and alerts Add your devices and begin tailor to your needs Fine-tuned to specific assets and processes Highly visual for your real-time operational data Integrate with back-end systems

Microservices Microservices Microservices Logic Apps

40 Components of a preconfigured solution Devices Web App Active Directory C# simulator IoT Hub Cosmos DB Microservices Microservices Microservices Logic Apps Back end systems and processes Orchestrator VM VM VM Azure ML

41 Fully hosted and managed by Microsoft No cloud development expertise required Device connectivity and management Azure IoT Central Monitoring rules and triggered actions User roles and permissions Analytics, dashboards and visualization Risk-free trial with simplified pricing

management Analytics & dashboards Time-series

42 Builder Operator Product Modeler Device settings Template Management Rules Workflows Device management Analytics & dashboards Time-series Insights Alerts and actions User and identity management

43 Establish bi-directional communication with billions of IoT devices Enhance security with per device authentication Azure IoT Hub Provision devices at scale w/ IoT Hub Device Provisioning Service Manage devices at scale with device management Multi-language and open source SDKs

44 Azure IoT Hub Bi-directional communication Enterprise scale and integration End-to-end security

45 IoT Device Management Lifecycle Replace or decommission devices after failure, upgrade cycle or service lifetime Retire Plan Group devices and control access according to your organization's needs Monitor device inventory, health and security while providing proactive remediation of issues Monitor Provision Securely authenticate devices, on-board for management and provision for service Configure Provide updates, configuration and applications to assign the purpose of each device

46 Azure IoT Hub Device Provisioning Service Azure IoT Hub Device Provisioning Service Register and provision devices with zero-touch in a secure and scalable way Simple "plug and play provisioning Minimize manual connection requirements Enhanced security through HSM Global availability

Move cloud and custom workloads to the edge, securely Seamless deployment of AI and advanced analytics Azure IoT Edge Configure, update and monitor from

47 Move cloud and custom workloads to the edge, securely Seamless deployment of AI and advanced analytics Azure IoT Edge Configure, update and monitor from the cloud Compatible with popular operating systems Code symmetry between cloud and edge for easy development and testing Secure solution from chipset to cloud

48 IoT scale time-series data store Schema-less store, just send data Azure Time Series Insights Easy IoT Hub connection Store, query and visualize billions of events Get near real-time insights in seconds Build apps using Time Series Insights APIs

49 Azure Sphere is an end-to-end solution for securing MCU powered devices and empowers manufacturers to create highly-secured, connected MCU devices A new Azure Sphere class of MCUs, from silicon partners, with built-in Microsoft security technology provide connectivity and a dependable hardware root of trust. A new Azure Sphere OS secured by Microsoft for the devices 10-year lifetime to create a trustworthy platform for new IoT experiences The Azure Sphere Security Service guards every Azure Sphere device; it brokers trust for deviceto-device and device-to-cloud communication, detects emerging threats, and renews device security. S E C U R I T Y Every device built with Azure Sphere is secured by Microsoft. For its 10 year lifetime. P R O D U C T I V I T Y The Azure Sphere developer experience shortens OEM time to market. O P P O R T U N I T Y Azure Sphere empowers OEMs to create new customer experiences and business models.

Azure PaaS and SaaS Microsoft s two approaches to building IoT solutions

Azure PaaS and SaaS Microsoft s two approaches to building IoT solutions Hector Garcia Tellado Program Manager Lead, Azure IoT Suite #IoTinActionMS #IoTinActionMS Agenda Customers using IoT today Microsoft