Imagine driving a car that can communicate with other vehicles and respond to road conditions in real-time. This innovation is exciting but raises serious questions about safety and security. As vehicles become more connected and reliant on advanced technology, the risk of cyberattacks increases.Cybersecurity is now a major concern for automakers, engineers, and technology experts. To help address these growing concerns, SAE is hosting a two-part course on Automotive Cybersecurity.The course is designed to provide attendees with a comprehensive understanding of automotive cybersecurity fundamentals, best practices, and emerging trends. It will cover topics such as cybersecurity standards and regulations, secure vehicle architecture, risk assessment and management, and incident response and forensics.Level 1What: Automotive Cybersecurity Certification: Level One C2105When: May 5 &amp; 6, 2025, Live Online.How: <a href="https://www.sae.org/learn/content/c2105/">Register attendance here</a>.Level 2What: Automotive Cybersecurity Certification: Level Two C2107When: May 19 &amp; 20, 2025, Live Online.How: <a href="https://www.sae.org/learn/content/c2107/">Register attendance here</a>.&nbsp;<h2 dir="ltr">Overview of the Certification Structure</h2>The course is divided into two levels. Each level will provide valuable insights into automotive cybersecurity.<h3 dir="ltr">Level 1 (May 5-6, 2025)&nbsp;</h3>This session is aimed at participants who want to build a strong foundation in automotive cybersecurity. Participants will learn about the current challenges the automotive industry faces as it becomes more connected.&nbsp;The course provides a deep dive into cybersecurity basics, including industry standards like ISO/SAE 21434 and UNECE WP.29. Attendees will also explore risk management, threat assessments, and security engineering principles. This level is ideal for engineers, managers, and auditors looking to understand the core cybersecurity requirements and how they impact vehicle design and safety.<h3 dir="ltr">Level 2 (May 19-20, 2025)</h3>This advanced session will explore more complex cybersecurity topics. Participants will dive into automotive cybersecurity requirements according to ISO/SAE 21434. Key areas include understanding standards, regulations, and planning strategies for cybersecurity management. Participants will also learn about cybersecurity-conscious culture, handling distributed development, and conducting audits and assessments.&nbsp;Additionally, the session covers post-development activities, such as maintaining cybersecurity throughout the product’s life cycle. Practical aspects like tool management, cybersecurity case development, and validation and testing methods will also be highlighted to ensure the comprehensive protection of automotive systems.This level is perfect for those with prior knowledge or experience in the field looking to expand their expertise.Both levels are designed to provide practical, hands-on knowledge that can be applied directly to real-world automotive systems.<h2 dir="ltr"><img src="https://s3-us-west-1.amazonaws.com/wevolver-project-images/froala%2F1730210147827-cyber2.jpg" style="width: 100%px;" class="fr-fic fr-dib"> What Will Be Discussed – Level 1 May 5-6, 2025</h2>The Level 1 session aims to introduce participants to the basic principles of cybersecurity as they apply to the automotive industry. This includes definitions, key risks, and emerging threats that professionals must be aware of.<h3 dir="ltr">Key Sessions Covered</h3>Here is what you will learn at the Automotive Cybersecurity Certification Level One C2105.<h4 dir="ltr">Day 1:</h4><ul><li dir="ltr">Introduction to Cybersecurity in Automotive: The session will start with an overview of the challenges faced by the modern automotive sector due to the increasing automation and networking of vehicles, highlighting the importance of cybersecurity in protecting vehicles from attackers.</li><li dir="ltr">Transformation of Mobility: Exploring how the mobility landscape changes with the rise of connected vehicles and the relevance of automotive cybersecurity in this context.</li><li dir="ltr">Basics of Automotive Cybersecurity: Core goals of automotive cybersecurity, including protection mechanisms, terminologies, and the fundamentals of current cybersecurity strategies.</li><li dir="ltr">Regulatory Landscape: An overview of key global regulations, including upcoming laws, ISO/SAE 21434 standards, and UNECE WP.29, which define the framework for automotive cybersecurity.</li><li dir="ltr">Automotive Cybersecurity Engineering: How the ISO/SAE 21434 standard integrates into engineering practices, providing an understanding of the procedure, terminology, and the relationship between threat assessment and security concepts.</li></ul><h4 dir="ltr">Day 2:</h4><ul><li dir="ltr">Cybersecurity Governance: Analyzing the objectives and requirements for managing cybersecurity in automotive organizations and projects, particularly through the lens of ISO/SAE 21434.</li><li dir="ltr">Lifecycle Cybersecurity: Addressing cybersecurity management throughout the entire vehicle lifecycle—from concept to decommissioning—using practical case studies for illustration.</li><li dir="ltr">Continuous and Distributed Cybersecurity Activities: Participants will explore the ongoing cybersecurity tasks that need to be addressed, even in outsourced or distributed work settings, to maintain compliance and security integrity.</li><li dir="ltr">Practical Exercises and Final Exam: The course will conclude with a summary of key concepts and an exam designed to certify participants with a TÜV SÜD certification upon successful completion.</li></ul>By attending this Level 1 course, participants will understand the challenges and tools available for implementing cybersecurity measures in the evolving automotive world. <img src="https://s3-us-west-1.amazonaws.com/wevolver-project-images/froala%2F1730210157702-cyber3.jpg" style="width: 100%px;" class="fr-fic fr-dib"><h2 dir="ltr">What Will Be Discussed – Level 2 May 19-20, 2025</h2>The Automotive Cybersecurity Level 2 certification (May 19-20, 2025), developed in collaboration with TÜV SÜD, focuses on practical applications and lifecycle management in compliance with ISO/SAE 21434 and other relevant regulations.<h3 dir="ltr">Key Topics Covered</h3>You will learn:&nbsp;<ul><li dir="ltr">Cybersecurity Lifecycle: The role of cybersecurity from product development to post-development, including the implementation and management of cybersecurity processes.</li><li dir="ltr">Standards and Regulations: Participants will explore not only ISO/SAE 21434 but also additional standards such as UN R155 and how these frameworks guide automotive cybersecurity practices.</li><li dir="ltr">Planning and Audits: Detailed guidance on cybersecurity planning, conducting audits and assessments, and ensuring compliance throughout distributed development processes.</li><li dir="ltr">Cybersecurity Case Development: Learn to create and evaluate cybersecurity cases. It is important to justify the security measures taken throughout the product life cycle.</li><li dir="ltr">Post-Development Activities: Managing cybersecurity beyond the development phase, including maintenance, updates, and end-of-life considerations.</li></ul>Participants will leave the session with the tools and methodologies necessary for comprehensive cybersecurity management in the automotive sector and an exam to earn TÜV SÜD certification.<h2 dir="ltr">Benefits of Attending the Certification</h2>Attending the Automotive Cybersecurity certification offers numerous advantages for professionals in the automotive industry. Here are some key benefits:<ul><li dir="ltr">Expert Knowledge and Stay Updated: Gain valuable insights from experienced professionals in the automotive cybersecurity field. Understand the latest standards and regulations in automotive cybersecurity, including ISO/SAE 21434.</li><li dir="ltr">Practical Skills and Certification: Learn real-world techniques that can be applied directly to your work, from secure design to threat management. Upon completion, participants will receive a certificate to enhance their professional credentials.</li><li dir="ltr">Networking: Connect with other professionals in the field to share ideas and solutions. This will help build relationships and share insights with peers facing similar cybersecurity challenges.</li><li dir="ltr">Career Advancement:&nbsp;By earning a certificate of completion, participants can showcase their commitment to professional development and their value to current and potential employers.</li></ul><h2 dir="ltr">Who Should Attend?</h2>This certification is designed for professionals involved in the automotive industry who are looking to deepen their knowledge of cybersecurity. Engineers, product designers, and managers responsible for vehicle safety and cybersecurity will benefit the most.&nbsp;Compliance officers and auditors who need to stay updated on industry standards, like ISO/SAE 21434, will also find it useful. Whether you are new to cybersecurity or have prior experience, this event will help you understand the current threats, regulations, and best practices in automotive cybersecurity.<h2 dir="ltr">Register Your Attendance Now!</h2>The Automotive Cybersecurity certification (Levels 1 &amp; 2) is an important event for anyone involved in the automotive industry. With the increasing number of cyber threats, it is crucial to stay informed and prepared. Attending will give you valuable insights and practical knowledge to help safeguard your vehicles and systems.Register now to secure your spot and be part of the important discussions that will shape the future of vehicle security. Join us in making the automotive industry safer and more secure for everyone!Register now for <a href="https://www.sae.org/learn/content/c2105/">Level 1</a> &amp; <a href="https://www.sae.org/learn/content/c2107/">Level 2</a>!

The Automotive Cybersecurity Certification, organized by SAE International, is a timely event that aims to address these critical issues. The online certification will be held on two separate occasions to accommodate European audiences: Level 1 on May 5 & 6, 2025, and Level 2 on May 19 & 20, 2025.


Automotive Cybersecurity Certification

Quantum computers, on the other hand, promise to rapidly crack complex cryptographic systems that a classical computer might never be able to unravel. This promise is based on a quantum factoring algorithm proposed in 1994 by&nbsp;<a href="https://news.mit.edu/2023/weird-weird-quantum-world-peter-shor-killian-lecture-0310" target="_blank">Peter Shor</a>, who is now a professor at MIT.But while researchers have taken great strides in the last 30 years, scientists have yet to build a quantum computer powerful enough to run Shor’s algorithm.As some researchers work to build larger quantum computers, others have been trying to improve Shor’s algorithm so it could run on a smaller quantum circuit. About a year ago, New York University computer scientist Oded Regev proposed a <a href="https://arxiv.org/pdf/2308.06572" target="_blank">major theoretical improvement</a>. His algorithm could run faster, but the circuit would require more memory.Building off those results, MIT researchers have proposed a best-of-both-worlds approach that combines the speed of Regev’s algorithm with the memory-efficiency of Shor’s. This new algorithm is as fast as Regev’s, requires fewer quantum building blocks known as qubits, and has a higher tolerance to quantum noise, which could make it more feasible to implement in practice.In the long run, this new algorithm could inform the development of novel encryption methods that can withstand the code-breaking power of quantum computers.“If large-scale quantum computers ever get built, then factoring is toast and we have to find something else to use for cryptography. But how real is this threat? Can we make quantum factoring practical? Our work could potentially bring us one step closer to a practical implementation,” says Vinod Vaikuntanathan, the Ford Foundation Professor of Engineering, a member of the Computer Science and Artificial Intelligence Laboratory (CSAIL), and senior author of a&nbsp;<a href="https://eprint.iacr.org/2023/1501.pdf" target="_blank" data-lf-fd-inspected-kn9eq4roawkarlvp="true">paper describing the algorithm</a>.The paper’s lead author is Seyoon Ragavan, a graduate student in the MIT Department of Electrical Engineering and Computer Science. The research will be presented at the 2024 International Cryptology Conference.<h2>Cracking cryptography</h2>To securely transmit messages over the internet, service providers like email clients and messaging apps typically rely on RSA, an <a href="https://people.csail.mit.edu/rivest/Rsapaper.pdf" target="_blank" data-lf-fd-inspected-kn9eq4roawkarlvp="true">encryption scheme</a> invented by MIT researchers Ron Rivest, Adi Shamir, and Leonard Adleman in the 1970s (hence the name “RSA”). The system is based on the idea that factoring a 2,048-bit integer (a number with 617 digits) is too hard for a computer to do in a reasonable amount of time.That idea was flipped on its head in 1994 when Shor, then working at Bell Labs, introduced an algorithm which proved that a quantum computer could factor quickly enough to break RSA cryptography.“That was a turning point. But in 1994, nobody knew how to build a large enough quantum computer. And we’re still pretty far from there. Some people wonder if they will ever be built,” says Vaikuntanathan.It is estimated that a quantum computer would need about&nbsp;<a href="https://quantum-journal.org/papers/q-2021-04-15-433/" target="_blank">20 million qubits</a> to run Shor’s algorithm. Right now, the largest quantum computers have around 1,100 qubits.A quantum computer performs computations using quantum circuits, just like a classical computer uses classical circuits. Each quantum circuit is composed of a series of operations known as quantum gates. These quantum gates utilize qubits, which are the smallest building blocks of a quantum computer, to perform calculations.But quantum gates introduce noise, so having fewer gates would improve a machine’s performance. Researchers have been striving to enhance Shor’s algorithm so it could be run on a smaller circuit with fewer quantum gates.That is precisely what Regev did with the circuit he proposed a year ago.“That was big news because it was the first real improvement to Shor’s circuit from 1994,” Vaikuntanathan says.The quantum circuit Shor proposed has a size proportional to the square of the number being factored. That means if one were to factor a 2,048-bit integer, the circuit would need millions of gates.Regev’s circuit requires significantly fewer quantum gates, but it needs many more qubits to provide enough memory. This presents a new problem.“In a sense, some types of qubits are like apples or oranges. If you keep them around, they decay over time. You want to minimize the number of qubits you need to keep around,” explains Vaikuntanathan.He heard Regev speak about his results at a workshop last August. At the end of his talk, Regev posed a question: Could someone improve his circuit so it needs fewer qubits? Vaikuntanathan and Ragavan took up that question.<h2>Quantum ping-pong</h2>To factor a very large number, a quantum circuit would need to run many times, performing operations that involve computing powers, like 2 to the power of 100.But computing such large powers is costly and difficult to perform on a quantum computer, since quantum computers can only perform reversible operations. Squaring a number is not a reversible operation, so each time a number is squared, more quantum memory must be added to compute the next square.The MIT researchers found a clever way to compute exponents using a series of <a href="https://en.wikipedia.org/wiki/Fibonacci_sequence" target="_blank">Fibonacci numbers</a> that requires simple multiplication, which is reversible, rather than squaring. Their method needs just two quantum memory units to compute any exponent.“It is kind of like a ping-pong game, where we start with a number and then bounce back and forth, multiplying between two quantum memory registers,” Vaikuntanathan adds.They also tackled the challenge of error correction. The circuits proposed by Shor and Regev require every quantum operation to be correct for their algorithm to work, Vaikuntanathan says. But error-free quantum gates would be infeasible on a real machine.They overcame this problem using a technique to filter out corrupt results and only process the right ones.The end-result is a circuit that is significantly more memory-efficient. Plus, their error correction technique would make the algorithm more practical to deploy.“The authors resolve the two most important bottlenecks in the earlier quantum factoring algorithm. Although still not immediately practical, their work brings quantum factoring algorithms closer to reality,” adds Regev.In the future, the researchers hope to make their algorithm even more efficient and, someday, use it to test factoring on a real quantum circuit.“The elephant-in-the-room question after this work is: Does it actually bring us closer to breaking RSA cryptography? That is not clear just yet; these improvements currently only kick in when the integers are much larger than 2,048 bits. Can we push this algorithm and make it more feasible than Shor’s even for 2,048-bit integers?” says Ragavan.

The most recent email you sent was likely encrypted using a tried-and-true method that relies on the idea that even the fastest computer would be unable to efficiently break a gigantic number into factors.

Toward a code-breaking quantum computer

EPFL researchers in computer and communication sciences are hacking and fixing Android phones before malicious hackers do. They uncovered 31 critical security flaws in the Android system, explored its risks and developed methods to mitigate some of the key ones through better testing and broader mitigations.“Vulnerabilities in smart devices are the Achilles heel that can compromise the most critical aspects of a mobile device,” says Mathias Payer who leads EPFL’s <a href="https://hexhive.epfl.ch/" target="_blank">HexHive Laboratory</a> which conducts research in cyber security. “The main risk is that hackers can get a foothold in your system and gain lifelong access to your data as long as you have the same phone. Your phone is no longer secure.”<img src="https://s3-us-west-1.amazonaws.com/wevolver-project-images/froala%2F1724286999382-ce540686.jpg" style="width: 100%px;" class="fr-fic fr-dib">Mathias Payer, head of EPFL’s HexHive Laboratory - - 2024 EPFL/Murielle Gerber - CC-BY-SA 4.0The diverse critical security flaws revealed by the researchers could have been exploited to steal personal information like fingerprints, face data, along with other sensitive data stored on one’s phone like credit card or social security information.“We studied the Android system because of the open nature of its platform, but similar security flaws are likely present in the iPhone ecosystem as well. We see much less public security research on iPhones due to Apple’s closed approach which forces researchers to first reverse engineer essential information that is publicly available on Android,” explains Payer.Marcel Busch, a postdoc in the HexHive Laboratory with Payer, spearheaded the efforts into privileged layers of Android together with the PhD students Philipp Mao and Christian Lindenmeier that resulted in three publications presented at this year’s <a href="https://www.usenix.org/conference/usenixsecurity24" target="_blank" rel="noopener">Usenix Security Symposium</a>, one of the world’s four top tier cybersecurity venues. In their work, they show exactly how these security flaws manifest themselves and which layers of the Android system’s architecture are affected.<h2>The details of the Android security flaws over three layers</h2>The Android system essentially processes information via three layers of code (iPhone’s iOS follows a similar architecture.)The first layer is the secure monitor, it’s the code that processes switches to and from the world of encrypted data known as the secure world. The second layer is divided into two parts, the secure world where sensitive data is encrypted, and the normal world built on a Linux kernel. The third layer builds on top of the second layer and contains all the apps. Day-to-day apps, like the photo app or messaging app, in the normal world talk to secure apps called Trusted Applications (TA) such as the key master app which manages cryptographic keys or the biometric information management app that contain sensitive data about the user running in the secure world.<img src="https://s3-us-west-1.amazonaws.com/wevolver-project-images/froala%2F1724287024267-3bf4537a.jpg" style="width: 100%px;" class="fr-fic fr-dib">2024 EPFL/HexHive Laboratory - CC-BY-SA 4.0<h2 id="isPasted">Numerous defects and vulnerabilities discovered</h2>The EPFL team discovered security flaws across all three layers of the Android system. The researchers developed a program (called <a href="https://github.com/HexHive/EL3XIR" target="_blank" rel="noopener">EL3XIR</a>) that essentially throws unexpected inputs at the target code to reveal software defects and vulnerabilities, a technique called fuzzing. EL3XIR revealed 34 bugs in the most fundamental and most privileged layer of Android security, the secure monitor level, of which 17 were classified as security critical (the most severe risk level).The researchers also revealed a confusion in how the Android system communicates with trusted applications. The confusion arises when information from trusted applications are mislabeled when processed between layers. In particular, the complex and critical interaction between accessible day-to-day apps and trusted applications that has to first go down through the secure monitor, and then back up through the secure world and into the trusted applications, is affected by this issue. Across 15,000 trusted applications that the team analyzed, the researchers discovered 14 new critical security flaws, uncovered 10 silently fixed bugs that vendors patched without notifying users and confirmed 9 known bugs.<img src="https://s3-us-west-1.amazonaws.com/wevolver-project-images/froala%2F1724287049262-c3e4c300.jpg" style="width: 100%px;" class="fr-fic fr-dib">Mathias Payer, Marcel Busch and Philipp Mao from the HexHive Laboratory - 2024 EPFL/Murielle Gerber - CC-BY-SA 4.0They also discovered that, if vendors did not update the Android system properly with secure patches, then hackers could force a downgrade to previous vulnerable versions of trusted applications and retrieve sensitive information, compromising the entire Android ecosystem throughout the three layered architecture. The researchers scanned over 35,000 trusted applications deployed across numerous phone manufacturers.“Android is a complex ecosystem with many different vendors and devices. Patching security vulnerabilities is complex,” says Mao, PhD candidate with the HexHive. “We followed industry standards by responsibly disclosing all our findings to the affected vendors and gave them 90 days to develop patches for their systems – which they did – before publishing any details. The insights from our findings and our automated tooling will support securing future systems.”What’s the bottom line for the consumers? Keep your system and apps up-to-date by installing updates whenever they become available, download apps only through trusted app stores and buy a device from a manufacturer that guarantees long update cycles. Busch observes that “for some of the manufacturers we studied, time-to-market is the key metric which doesn't leave much room for the diligence required for building secure systems.”<hr>ReferencesSpill the TeA: <a href="https://www.usenix.org/conference/usenixsecurity24/presentation/busch-tea" target="_blank" rel="noopener">https://www.usenix.org/conference/usenixsecurity24/presentation/busch-tea</a> EL3XIR: <a href="https://www.usenix.org/conference/usenixsecurity24/presentation/lindenmeier" target="_blank" rel="noopener">https://www.usenix.org/conference/usenixsecurity24/presentation/lindenmeier</a> Global confusion: <a href="https://www.usenix.org/conference/usenixsecurity24/presentation/busch-globalconfusion" target="_blank" rel="noopener">https://www.usenix.org/conference/usenixsecurity24/presentation/busch-globalconfusion</a>

EPFL researchers have found numerous security flaws in Android’s most privileged components © iStock

Are you concerned about hackers stealing your fingerprint and face data for accessing your smartphone? EPFL researchers have found numerous security flaws in Android’s most privileged components before hackers do and give advice to users on how to reduce risks.

Finding security flaws in Android ahead of malicious hackers

Murata Digital Transformation (MDX) was launched with the goal of driving both business and IT, in order to realize Murata's long-term concept, "Vision 2030." In this article, executive officer Fumiyuki Suchi (Corporate Unit, Business Engineering &amp; Information System Group) explains the company's strategy for engaging with DX and transforming a wide range of fields including business models, value chains, and core competencies.<h2 id="isPasted">1. Aiming for a high-cycle organization where people and data are connected</h2>Murata launched MDX as a company-wide initiative. According to Suchi, the foundation for this was based on three Ds: "Diversity &amp; Decision Making Process," "Definition," and "Digital."<img src="https://images.wevolver.com/eyJidWNrZXQiOiJ3ZXZvbHZlci1wcm9qZWN0LWltYWdlcyIsImtleSI6ImZyb2FsYS8xNzIzMjIzODYwMjM2LW11cmF0YSBhLmpwZyIsImVkaXRzIjp7InJlc2l6ZSI6eyJ3aWR0aCI6OTUwLCJmaXQiOiJjb3ZlciJ9fX0=" style="width: 100%px;" class="fr-fic fr-dib">Autonomous and decentralized organizational management, and the three DsSuchi:&nbsp;"We want to implement digital transformation with digitization and digitalization as drivers. We will optimize decision-making processes based on diverse mutual understanding and cooperation that goes beyond individuals, teams, organizations, and sites ('Diversity &amp; Decision Making Process'), and then redefine KGIs/KPIs and how organizations should function ('Definition')."Describing transforming business models through DX as "extremely difficult," Suchi continues, "we're first focusing on a high-cycle organization where people and data are connected."Suchi:&nbsp;"A high-cycle organization is an organization where the cycle of establishing, trying, and verifying a hypothesis and then moving on to the next hypothesis is accelerated and spirals up, allowing for agile decision-making. In order to make that possible, we aim to build a data infrastructure that allows multiple people to access the same data at the same time, so that information can be connected between management, sites, customers, and suppliers, allowing us to autonomously make use of information and data to establish policies focused on collectiveness."<img src="https://images.wevolver.com/eyJidWNrZXQiOiJ3ZXZvbHZlci1wcm9qZWN0LWltYWdlcyIsImtleSI6ImZyb2FsYS8xNzIzMjIzODg3Mzg4LW11cmF0YSBiLmpwZyIsImVkaXRzIjp7InJlc2l6ZSI6eyJ3aWR0aCI6OTUwLCJmaXQiOiJjb3ZlciJ9fX0=" style="width: 100%px;" class="fr-fic fr-dib">A high-cycle organization where people and data are connected<h2 id="isPasted">2. Connecting all business processes for comprehensive and efficient optimization</h2>According to Suchi, the company will focus on Value Provided &amp; Business Model, Holistic Value Chain, and Enhancement of Core Competencies, as specific MDX initiatives.<img src="https://s3-us-west-1.amazonaws.com/wevolver-project-images/froala%2F1723224029515-img4-003-en.jpg" style="width: 100%px;" class="fr-fic fr-dib">MDX overall diagramSuchi:&nbsp;"Value Provided &amp; Business Model means launching new businesses outside of conventional standard businesses and specific application businesses, that are more focused on solving problems, and implementing transformation. Holistic Value Chain will be crucial in using digital to enhance this three-layer portfolio."The demand chain starts with customers and the market, while the engineering chain is rooted in manufacturing processes such as product development and manufacturing, and the supply chain extends from raw material and part procurement to sales. Holistic Value Chain is the process of connecting all of these and optimizing processes.Suchi:&nbsp;"One of Murata's strengths has been our ability to meet the needs of customers with superior technology and a willingness to bounce ideas off each other. However, this is not enough now. We need to also compete on being able to deliver quickly without loss. We will need to connect all business processes and aim for comprehensive and efficient optimization."According to Suchi, the company will aim to Enhance Core Competencies in order to realize Holistic Value Chain.Suchi:&nbsp;"Manufacturing is Murata's greatest strength, and it's in this area that we will promote the use of cyberphysical systems, the utilization of materials informatics (MI) in developing technologies, and the use of digital in marketing and promotion. We will create a high-cycle organization that enables more sophisticated decision-making, by visualizing and linking operations in the areas of Value Provided &amp; Business Model, Holistic Value Chain, and Enhancement of Core Competencies. We want to promote MDX in a way that encompasses all of this."<h2>3. Building a digital infrastructure focused on autonomy, collectiveness, and evolution</h2>Building a next-generation digital infrastructure will serve as the foundation for bringing more sophisticated decision-making, based on Value Provided &amp; Business Model, Holistic Value Chain, and Enhancement of Core Competencies. Suchi: "The goal is not simply to build infrastructures for data and applications and promote DX."<img src="https://images.wevolver.com/eyJidWNrZXQiOiJ3ZXZvbHZlci1wcm9qZWN0LWltYWdlcyIsImtleSI6ImZyb2FsYS8xNzIzMjIzOTM2Mjk5LW11cmF0YSBkLmpwZyIsImVkaXRzIjp7InJlc2l6ZSI6eyJ3aWR0aCI6OTUwLCJmaXQiOiJjb3ZlciJ9fX0=" style="width: 100%px;" class="fr-fic fr-dib">Next-generation digital infrastructure conceptSuchi:&nbsp;"Our keywords for the next-generation digital infrastructure are Autonomy, Collectiveness, and Evolution. Autonomy means that people on site autonomously use digital to bring about transformation and create new value. In order for that to happen, we will build a data infrastructure that provides data governance functionality to ensure that data is used safely and securely. That's Collectiveness."Autonomy has been an important value at Murata for some time.Suchi:&nbsp;"The improvements being made at all of our sites are based on autonomy. However, as an organization expands, it tends to become more vertically aligned with regard to businesses and functions. This also means that the company becomes weaker horizontally across organizations. This is why we think it's so important to press forward with Holistic Value Chain while also considering the proper balance between Autonomy and Collectiveness, and to promote collaboration between business divisions and sites."Evolution means making use of the latest technologies, such as application programming interface (API) linking and virtualization technology.Suchi:&nbsp;"In Europe, suppliers and customers are connected to the same data infrastructure or cyberphysical system, and the pace of business continues to increase. We want to introduce the latest technology and enhance our infrastructure linked with external services and applications, so that we won't be left behind by global trends like this."<h2>4. Business and IT driven by each employee undergoing DX</h2>According to Suchi, creating environments for employees to autonomously engage in DX is also important for MDX.Suchi:&nbsp;"For example, we're preparing environments at Murata and providing ChatGPT, so that people can get familiar with digital. We're also implementing a range of policies to democratize IT, such as establishing a cloud utilization promotion organization to make it easier for people to use the latest information technology safely, establishing a digital architecture consultation service for people to get answers to their questions, and enhancing security against cyber attacks and information leaks."The company is now implementing several policies, and Suchi stresses the importance of sharing information.Suchi:&nbsp;"In addition to presenting our vision of MDX, it's important to share information and show employees how things will change and how it will benefit them. That's why we launched our new portal site. Employees can access this information and begin using digital to solve problems and build success stories. We believe that, by taking the lead in promoting DX, employees will transform themselves and then drive business and IT."Although the company has launched MDX as a company-wide challenge and continues to promote initiatives, Suchi is quick to clarify that MDX is just one means of realizing what Murata wants to be for "Vision 2030."Suchi:&nbsp;"'Vision 2030' calls for four management transformations: Management that creates a continuous cycle of social value and economic value, autonomous and decentralized organizational management, change-responsive management based on hypothetical thinking, and DX promotion. MDX is just one means of accomplishing this. The use of digital will be crucial for expanding our three-layer portfolio and four business opportunities (communications, mobility, environment, and wellness), and for accelerating our results cycle. By 2030, we will realize MDX to the point where it has a definite effect, and will also realize a high-cycle organization where people and data are connected."

In this article, executive officer Fumiyuki Suchi explains the Murata's strategy for engaging with DX and transforming a wide range of fields including business models, value chains, and core competencies.

Strategies and challenges for accelerating digital transformation

This is the introductory article in a six-part series featuring articles on "<a href="https://www.wevolver.com/article/engineering-the-quantum-future/" target="_blank" rel="noopener noreferrer">Engineering the Quantum Future</a>". The series explains the revolutionary advancements in quantum computing and their implications for various industries. Each article discusses a specific aspect of this transformative technology, from the fundamental concepts of quantum computing to the practical applications and challenges. This series is sponsored by Mouser Electronics. Through the sponsorship, Mouser Electronics promotes innovation and the exchange of knowledge, aiming to harness the revolutionary capabilities of quantum computing for a smarter and safer technological future.This article was originally published in '<a href="https://resources.mouser.com/methods/engineering-the-quantum-future" target="_blank">METHODS: Engineering the Quantum Future</a>,' an e-magazine by Mouser Electronics. It has been edited by the Wevolver team and <a href="https://www.wevolver.com/profile/ravi.rao" target="_blank">Ravi Y. Rao</a> to adapt its presentation for a wider audience. While the foundational ideas originate from William Hurley (whurley), this version enhances accessibility and discussion context.&nbsp;<h2 dir="ltr">Introduction</h2>It is a challenge to imbue people with excitement about the practical realities of quantum computing. After all, the vast majority of voices evangelizing the topic routinely pull examples from science fiction rather than fact. At the same time, the naysayers cite how far we are from world-changing quantum breakthroughs. We’re still at the phase where we’re cool enough to fire up people’s imaginations while simultaneously causing the more right-brained among us to dismiss quantum computing as nothing more than a tech hype bubble sector, the latest technology buzz destined to fizzle.This article explores the current state of quantum computing, highlighting its challenges and potential. It addresses the excitement and skepticism surrounding quantum advancements and emphasizes the need for practical understanding and education. The article serves as an introduction to the six-part series "Engineering the Quantum Future" which covers various aspects of quantum computing, from fundamental concepts and technical breakthroughs to practical applications and ethical considerations. Each subsequent article delves into specific trends and technologies shaping the future of quantum computing.<h2 dir="ltr">Dual Nature of Quantum Computing's Promise</h2>Quantum computing garners support for its transformative potential while facing skepticism from those who question its immediate practicality. Both perspectives on quantum computing have a certain validity, with the truth currently hovering somewhere between the two poles.&nbsp;For professional developers who understand how to code for both classical and quantum machines, the future is now.&nbsp;Of course, we all create our own bubbles in life and being so deeply embedded within the quantum sphere, researchers surrounded by people who DO understand, and it’s only when they talk to people outside their field that they realize how much work there is still to do in terms of educating people on quantum computing’s potential.<h2 dir="ltr">Transformative Potential of Quantum Computing</h2>Quantum computing holds limitless potential, representing not just a more efficient way of computing but a whole new way of thinking about computing itself. The future power of quantum computers is unparalleled, and the potential applications are as vast as they are varied.&nbsp;So much of what currently limits our ability to solve problems comes down to time, translated into lifetimes. Since time travel has been deemed impossible (for now), going faster is the next best substitute. Quantum computing is how we unlock it and, in doing so, jumpstart the next technological revolution.&nbsp;Quantum can potentially be even more transformative than the industrial or informational revolutions combined. It is about improving our current systems and redefining them at the most fundamental level. It is strongly believed that the impact of quantum computing on our lives will be profound and far-reaching. It will not only affect our work and daily lives, but it will also significantly impact the future of our species. From eliminating diseases to healing the damage we have done to our planet—even taking us to Mars and beyond—the keys to humanity’s literal survival may well lie inside these magic machines.<h3 dir="ltr">Revolutionizing Healthcare</h3>Quantum computing possesses the remarkable potential to revolutionize the field of medicine and transform healthcare as we know it. Imagine a world where diseases currently deemed incurable, such as cancer and Alzheimer's disease, can be effectively cured. This seemingly far-fetched notion is moving closer to reality through the power of quantum computing.In a recent groundbreaking paper titled "Insights from Incorporating Quantum Computing into Drug Design Workflows" (Bioinformatics, Volume 39, Issue 1), published in January 2023, researchers explored the integration of quantum neural networks to predict the impact of mutations on drug binding.[1] This study exemplifies the promising applications of quantum computing in drug design, where intricate molecular interactions must be analyzed and optimized with unprecedented precision and efficiency. Leading global pharmaceutical companies are actively exploring the use of today's quantum computers to propel scientific discovery. By leveraging the immense computational power of quantum algorithms, quantum-friendly pharma companies aim to accelerate the drug discovery and development process, expediting the identification of potential therapeutic compounds and bringing effective treatments to patients in a fraction of the time.<img src="https://images.wevolver.com/eyJidWNrZXQiOiJ3ZXZvbHZlci1wcm9qZWN0LWltYWdlcyIsImtleSI6ImZyb2FsYS8xNzIyMjM3ODAwOTg0LWltYWdlMy5qcGciLCJlZGl0cyI6eyJyZXNpemUiOnsid2lkdGgiOjk1MCwiZml0IjoiY292ZXIifX19" style="width: 100%px;" class="fr-fic fr-dib" alt="quantum-computing-healthcare">Quantum computing enhances medical research and treatment accuracy, from genomic analysis to personalized medicineThe impact of quantum computing on healthcare, however, goes beyond pharmaceutical advancements. With the ability to process vast amounts of data and optimize complex algorithms, quantum computers will enhance medical imaging techniques, enable more accurate diagnoses, reduce surgery wait times by making hospital administration far more efficient, and contribute to personalized medicine. By analyzing individual patient data and genetic profiles, quantum computing has the potential to assist in tailoring treatments and therapies to specific individuals, optimizing outcomes, and improving patient care on a profound level.Human longevity aside, let’s examine the potential for humanity’s longevity on our planet.<h3 dir="ltr">Addressing Global Climate Challenges</h3>Quantum computing stands poised to make a significant impact in addressing urgent global climate challenges. By harnessing quantum computing’s power, we can greatly enhance our ability to model and predict climate change with unprecedented accuracy. This newfound precision empowers us to take proactive and effective measures to mitigate its impact on our planet and its various ecosystems.Furthermore, quantum computing offers a ray of hope in our pursuit of sustainable energy solutions by assisting in the development of novel and efficient energy sources to replace or reduce our dependence on fossil fuels. These advancements can revolutionize renewable energy technologies, optimize energy distribution systems, and accelerate the transition to a low-carbon future.From a material science environmental angle, quantum computing also has much to offer. By unraveling intricate molecular structures and properties, quantum computers can guide researchers towards innovative solutions that mitigate the environmental impact of single-use plastics, providing a sustainable path towards a cleaner and greener planet.<h3 dir="ltr">Solving Global Issues</h3>Poverty, inequality, and global conflict are also big problems that can be broken down into data sets that quantum computers could munch through, allowing us to see solutions we may not have been able to see before through the extraction of meaningful insights.&nbsp;<h2 dir="ltr">Ethical and Social Implications</h2>Every light casts its shadow, however, and as we embark on this exciting new era of quantum computing, we must also be mindful of the technology's ethical and social implications.&nbsp;One critical aspect of the ethical considerations surrounding quantum computing is the potential exacerbation of existing inequalities or the creation of new ones. As this technology advances, it is crucial to address the digital divide and ensure equitable access to quantum computing resources, knowledge, and opportunities. Efforts must be made to prevent the marginalization of underprivileged communities or perpetuate societal disparities. By fostering inclusivity and providing equal access to quantum computing education and infrastructure, we can strive for a future where everyone has the chance to benefit from its advancements.Additionally, privacy and data security are critical concerns in the age of quantum computing. Quantum computers possess the potential to break currently challenging encryption algorithms, raising questions about the security of sensitive information. Robust encryption methods must be developed and implemented to safeguard personal data, financial systems, and sensitive communications from potential threats. Ethical frameworks and regulations should be established to protect individuals and organizations from the misuse of quantum computing capabilities, ensuring responsible and secure practices.Furthermore, we must actively engage in ongoing discussions surrounding the ethical implications of quantum computing in fields such as healthcare, artificial intelligence, and autonomous systems. Transparent and inclusive dialog involving experts, policymakers, and society can help navigate the ethical challenges that arise and shape the development of guidelines and best practices while safeguarding against unintended consequences.Future articles in the "Engineering the Quantum Future" series will dive into these topics in great detail, providing comprehensive insights and developments in the field of quantum computing.<h2 dir="ltr" id="isPasted">Conclusion</h2>All caveats aside, we remain &nbsp;quantum computing optimists and enthusiasts, with the belief that the technology will be the savior of the future of our species.&nbsp;Let us embrace this technology with open arms and use it to create a better and brighter future for all. It won’t be long before you connect the quantum dots between quantum’s potential and every primary sector of society.This article was initially published in "<a href="https://resources.mouser.com/methods/engineering-the-quantum-future" target="_blank">METHODS: Engineering the Quantum Future</a>," an e-magazine by Mouser Electronics. It has been substantially edited by the Wevolver team and <a href="https://www.wevolver.com/profile/ravi.rao" target="_blank">Ravi Y Rao</a>. It's the introductory article to Engineering the Quantum Future Series. Upcoming articles will introduce readers to more trends and technologies transforming quantum computing.<hr>The&nbsp;<a href="https://www.wevolver.com/article/engineering-the-quantum-future/" target="_blank">introductory article</a>&nbsp;explores the current state of quantum computing, highlighting its challenges and potentialThe&nbsp;<a href="https://www.wevolver.com/article/from-bits-to-qubits-an-introduction-to-quantum-computing/" target="_blank">first article</a>&nbsp;dives into the foundational concepts of quantum computing, covering its theoretical basis, technological evolution, and potential applicationsThe&nbsp;<a href="https://www.wevolver.com/article/breakthroughs-in-quantum-computing/" target="_blank">second article</a>&nbsp;takes a look at some transformative breakthroughs in quantum computingThe <a href="https://www.wevolver.com/article/quantum-computing-and-energy-optimization-a-future-beyond-moores-law/" target="_blank">third article</a>&nbsp;examines the role of quantum computing in enhancing energy efficiencyThe <a href="https://www.wevolver.com/article/the-quantum-web-interconnecting-quantum-processors-for-larger-scale-machines/" target="_blank">fourth article</a>&nbsp;explains quantum interconnectivity, detailing how linking quantum processors can amplify computing powerThe <a href="https://www.wevolver.com/article/the-quantum-threat-to-cybersecurity-and-the-quest-for-quantum-proof-encryption/" target="_blank">fifth article</a>&nbsp;addresses how the advancements in quantum capabilities pose significant challenges to traditional encryption methods and cybersecurityThe&nbsp;<a href="https://www.wevolver.com/article/technical-and-ethical-issues-in-quantum-computing-the-quantum-challenge/" target="_blank">sixth article</a>&nbsp;discusses the technical and ethical challenges of quantum computing as the technology progresses<hr><h2 dir="ltr">Reference</h2>[1] Lau B, Emani PS, Chapman J, Yao L, Lam T, Merrill P, et al. Insights from incorporating quantum computing into drug design workflows. Bioinformatics. 2023 Jan 1;39(1). doi: 10.1093/bioinformatics/btac789. PMID: 36477833; PMCID: PMC9825754. Available from: <a href="https://pubmed.ncbi.nlm.nih.gov/36477833/" target="_blank">https://pubmed.ncbi.nlm.nih.gov/36477833/</a>

Introducing the Engineering the Quantum Future Series: Quantum computing redefines our approach to complex challenges, expanding the scope of what's possible across multiple disciplines.

Engineering the Quantum Future

In recent years, the rise of Generative Artificial Intelligence (AI) has been nothing short of revolutionary. This technology, capable of producing content that closely mimics human output, has paved the way for innovations across various fields. From writing convincingly real emails to creating impressive images, generative AI's capabilities are vast and transformative.However, as with any technological advancement, there are two sides to the story. The same capabilities that offer numerous benefits also pose significant risks, particularly concerning cybersecurity. Specifically, one of the most concerning developments has been the enhancement of phishing schemes, making them more sophisticated and challenging to detect than ever before. This article explores the rise of generative AI, how it's changing the phishing landscape, and best practices to avoid becoming a victim.&nbsp;<h1 dir="ltr">The Evolution of Generative AI</h1>Generative AI is marked by its ability to learn from a vast dataset of existing digital content and generate new, unique outputs that can pass for human-created. This process involves complex algorithms and neural network models that analyze patterns, styles, and structures within the data they're fed. As a result, generative AI can produce a wide range of outputs, including textual content, images, music, and even synthetic voices. Its applications are far-reaching, offering potential benefits in areas such as content creation, entertainment, education, and beyond. [1]However, the power of generative AI extends beyond positive use cases. Its very capabilities, particularly in mimicking human communication styles and generating personalized content, have opened new avenues for cybercriminals. These advancements have led to a new generation of phishing attacks that are significantly more difficult to identify and combat.<h1 dir="ltr">The Transformation of Phishing Tactics</h1>Phishing schemes have long been a staple in the arsenal of cybercriminals. Traditionally, these attacks involved sending generic, often poorly written emails, attempting to lure recipients into divulging sensitive information or downloading malicious software. While effective to a degree, these attempts were easier to spot and avoid due to their lack of personalization and sophistication. [2]Enter generative AI, and the landscape of phishing has changed dramatically. With the ability to analyze and replicate communication styles, generative AI enables cybercriminals to craft highly convincing and personalized messages. These messages can mimic the tone, style, and even specific phrases used by individuals or organizations, making them far more likely to deceive recipients.<h1 dir="ltr">Understanding AI-Enhanced Phishing</h1>The core threat of AI-enhanced phishing is its personalization and realism. Generative AI can create emails, text messages, or social media messages that look and sound like they're from a trusted source, such as a colleague, friend, or a reputable organization. This level of personalization is achieved by analyzing publicly available data or previously breached information to tailor attacks to individual targets. [3]<img src="https://images.wevolver.com/eyJidWNrZXQiOiJ3ZXZvbHZlci1wcm9qZWN0LWltYWdlcyIsImtleSI6ImZyb2FsYS8xNzE0Mzg4NjY3Mjg2LWN5YmVyMi5wbmciLCJlZGl0cyI6eyJyZXNpemUiOnsid2lkdGgiOjk1MCwiZml0IjoiY292ZXIifX19" style="width: 100%px;" class="fr-fic fr-dib">Phishing attacks begin with tricking users out of their important credentials. Image credit:&nbsp;<a href="https://www.valimail.com/guide-to-phishing/" target="_blank">Vailmail</a> For instance, a generative AI-powered phishing email might reference recent transactions, use language that matches the supposed sender's usual tone, or mimic the layout and design of legitimate correspondence. With such attention to detail, these fraudulent messages are incredibly persuasive, increasing the likelihood that recipients will comply with their requests, whether that involves providing passwords, financial information, or other sensitive data.<h1 dir="ltr">The Signs of AI-Generated Phishing Attacks</h1>Despite their sophistication, AI-generated phishing attacks are not foolproof. There are still telltale signs that can help discerning individuals identify them. These include slight inconsistencies in language or format, unusual requests, or links to websites that, upon closer inspection, have subtle differences from legitimate addresses. Moreover, these messages might lack the personal touch or in-depth knowledge that genuine communications from friends or colleagues would have, relying instead on information that could be publicly accessed or inferred.<h1 dir="ltr">Strategies for Personal and Organizational Protection</h1>Naturally, the advancement of AI-enhanced phishing schemes necessitates stronger defensive measures, both at personal and organizational levels. Awareness is the first step; understanding that no one is immune to these attacks is crucial. From there, adopting a multi-layered approach to security can significantly mitigate risks. [4]<h2 dir="ltr">For individuals:</h2><ul><li dir="ltr">Be Skeptical of Unsolicited Communications: Always approach unexpected requests for information or action with caution, even if they appear to come from known contacts or organizations.</li><li dir="ltr">Verify Independently:&nbsp;If a message asks for sensitive information or to perform a specific action, verify its authenticity through an independent channel. For example, if you receive an email from your bank asking for personal details, contact the bank directly using a phone number from their official website.</li><li dir="ltr">Use Advanced Security Features:&nbsp;Enable two-factor authentication (2FA) wherever possible. This adds an extra verification step that can protect your accounts even if your password is compromised.</li><li dir="ltr">Regularly Update Software:&nbsp;Ensure that your operating system, applications, and anti-virus software are up to date to protect against known vulnerabilities.</li></ul><h3>For organizations:</h3><ul><li dir="ltr">Conduct Regular Training: Employees should be regularly trained on the latest cybersecurity threats and how to recognize phishing attempts. Simulated phishing exercises can be particularly effective.</li><li dir="ltr">Implement Strict Information Handling Policies: Limit the amount of personal and sensitive information that can be shared or accessed based on job roles.</li><li dir="ltr">Adopt Advanced Security Technologies: Utilize email filtering, intrusion detection systems, and AI-based security solutions that can identify and block phishing attempts.</li><li dir="ltr">Establish Clear Reporting Procedures:&nbsp;Employees should know how to report suspected phishing attempts promptly, allowing IT security teams to respond quickly.</li></ul><h1 dir="ltr">The Role of Continuous Education</h1>As generative AI continues to evolve, so too will the tactics used by cybercriminals. For this reason, staying informed about the latest developments in AI and cybersecurity is essential. For individuals, this means staying abreast of the latest security advice and best practices. For organizations, it involves regular training sessions and updates on cybersecurity trends and threats. [5]Awareness campaigns, workshops, and online courses can play significant roles in educating the public and employees about the dangers of AI-enhanced phishing schemes and how to protect against them. Knowledge is power, and in the context of cybersecurity, it's also the best defense.<h1 dir="ltr">Looking Ahead: The Future of AI in Cybersecurity</h1>The dual-use nature of generative AI in cybersecurity presents a continuous game of cat and mouse between cybercriminals and defenders. As AI technologies become more sophisticated, so too do the tools and strategies to combat malicious use. Future developments in AI could offer more robust detection mechanisms, identifying and neutralizing phishing attempts before they reach their intended targets. Similarly, advancements in natural language processing could enable more effective filtering of phishing content, while machine learning models might predict and block new phishing tactics.[6]However, as technology advances, the complexity and novelty of phishing attacks will likely increase as well. A proactive and adaptive approach to cybersecurity, emphasizing technological solutions and human vigilance and education, will be necessary to combat these advances.<h1 dir="ltr">Conclusion</h1>The rise of generative AI has brought with it an era of enhanced phishing schemes, presenting new challenges in the realm of cybersecurity. While these sophisticated attacks pose significant risks, the combination of advanced security measures, continuous education, and heightened awareness provides a formidable defense. As we navigate this evolving landscape, staying informed, cautious, and prepared is essential for protecting personal and organizational integrity in the digital age. Through collective effort and the strategic application of technology, we can mitigate the threats posed by AI-enhanced phishing and secure our digital future.<h3 dir="ltr">References</h3><ol><li dir="ltr"><a href="https://www.techtarget.com/searchenterpriseai/definition/generative-AI" target="_blank">https://www.techtarget.com/searchenterpriseai/definition/generative-AI</a></li><li dir="ltr"><a href="https://www.phishing.org/what-is-phishing" target="_blank">https://www.phishing.org/what-is-phishing</a></li><li dir="ltr"><a href="https://withpersona.com/blog/ai-phishing-attacks" target="_blank">https://withpersona.com/blog/ai-phishing-attacks</a></li><li dir="ltr"><a href="https://consumer.ftc.gov/articles/how-recognize-and-avoid-phishing-scams" target="_blank">https://consumer.ftc.gov/articles/how-recognize-and-avoid-phishing-scams</a></li><li dir="ltr"><a href="https://www.cisa.gov/secure-our-world/teach-employees-avoid-phishing" target="_blank">https://www.cisa.gov/secure-our-world/teach-employees-avoid-phishing</a></li><li dir="ltr">https://sennovate.com/the-role-of-artificial-intelligence-in-detecting-phishing-attacks/</li></ol>

Generative AI has opened up an entirely new world of cybersecurity threats. 


The Rise of Generative AI and Enhanced Phishing Schemes

Health-monitoring apps can help people manage chronic diseases or stay on track with fitness goals, using nothing more than a smartphone. However, these apps can be slow and energy-inefficient because the vast machine-learning models that power them must be shuttled between a smartphone and a central memory server.Engineers often speed things up using hardware that reduces the need to move so much data back and forth. While these machine-learning accelerators can streamline computation, they are susceptible to attackers who can steal secret information.To reduce this vulnerability, researchers from MIT and the MIT-IBM Watson AI Lab created a machine-learning accelerator that is resistant to the two most common types of attacks. Their chip can keep a user’s health records, financial information, or other sensitive data private while still enabling huge AI models to run efficiently on devices.The team developed several optimizations that enable strong security while only slightly slowing the device. Moreover, the added security does not impact the accuracy of computations. This machine-learning accelerator could be particularly beneficial for demanding AI applications like augmented and virtual reality or autonomous driving.While implementing the chip would make a device slightly more expensive and less energy-efficient, that is sometimes a worthwhile price to pay for security, says lead author Maitreyi Ashok, an electrical engineering and computer science (EECS) graduate student at MIT.“It is important to design with security in mind from the ground up. If you are trying to add even a minimal amount of security after a system has been designed, it is prohibitively expensive. We were able to effectively balance a lot of these tradeoffs during the design phase,” says Ashok.Her co-authors include Saurav Maji, an EECS graduate student; Xin Zhang and John Cohn of the MIT-IBM Watson AI Lab; and senior author Anantha Chandrakasan, MIT’s chief innovation and strategy officer, dean of the School of Engineering, and the Vannevar Bush Professor of EECS. The research will be presented at the IEEE Custom Integrated Circuits Conference.<h2>Side-channel susceptibility</h2>The researchers targeted a type of machine-learning accelerator called digital in-memory compute. A digital IMC chip performs computations inside a device’s memory, where pieces of a machine-learning model are stored after being moved over from a central server.The entire model is too big to store on the device, but by breaking it into pieces and reusing those pieces as much as possible, IMC chips reduce the amount of data that must be moved back and forth.But IMC chips can be susceptible to hackers. In a side-channel attack, a hacker monitors the chip’s power consumption and uses statistical techniques to reverse-engineer data as the chip computes. In a bus-probing attack, the hacker can steal bits of the model and dataset by probing the communication between the accelerator and the off-chip memory.Digital IMC speeds computation by performing millions of operations at once, but this complexity makes it tough to prevent attacks using traditional security measures, Ashok says.She and her collaborators took a three-pronged approach to blocking side-channel and bus-probing attacks.First, they employed a security measure where data in the IMC are split into random pieces. For instance, a bit zero might be split into three bits that still equal zero after a logical operation. The IMC never computes with all pieces in the same operation, so a side-channel attack could never reconstruct the real information.But for this technique to work, random bits must be added to split the data. Because digital IMC performs millions of operations at once, generating so many random bits would involve too much computing. For their chip, the researchers found a way to simplify computations, making it easier to effectively split data while eliminating the need for random bits.Second, they prevented bus-probing attacks using a lightweight cipher that encrypts the model stored in off-chip memory. This lightweight cipher only requires simple computations. In addition, they only decrypted the pieces of the model stored on the chip when necessary.Third, to improve security, they generated the key that decrypts the cipher directly on the chip, rather than moving it back and forth with the model. They generated this unique key from random variations in the chip that are introduced during manufacturing, using what is known as a physically unclonable function.“Maybe one wire is going to be a little bit thicker than another. We can use these variations to get zeros and ones out of a circuit. For every chip, we can get a random key that should be consistent because these random properties shouldn’t change significantly over time,” Ashok explains.They reused the memory cells on the chip, leveraging the imperfections in these cells to generate the key. This requires less computation than generating a key from scratch.“As security has become a critical issue in the design of edge devices, there is a need to develop a complete system stack focusing on secure operation. This work focuses on security for machine-learning workloads and describes a digital processor that uses cross-cutting optimization. It incorporates encrypted data access between memory and processor, approaches to preventing side-channel attacks using randomization, and exploiting variability to generate unique codes. Such designs are going to be critical in future mobile devices,” says Chandrakasan.<h2>Safety testing</h2>To test their chip, the researchers took on the role of hackers and tried to steal secret information using side-channel and bus-probing attacks.Even after making millions of attempts, they couldn’t reconstruct any real information or extract pieces of the model or dataset. The cipher also remained unbreakable. By contrast, it took only about 5,000 samples to steal information from an unprotected chip.The addition of security did reduce the energy efficiency of the accelerator, and it also required a larger chip area, which would make it more expensive to fabricate.The team is planning to explore methods that could reduce the energy consumption and size of their chip in the future, which would make it easier to implement at scale.“As it becomes too expensive, it becomes harder to convince someone that security is critical. Future work could explore these tradeoffs. Maybe we could make it a little less secure but easier to implement and less expensive,” Ashok says.

A new chip can efficiently accelerate machine-learning workloads on edge devices like smartphones while protecting sensitive user data from two common types of attacks — side-channel attacks and bus-probing attacks. Image: Chip figure courtesy of the researchers; MIT News; iStock.

Researchers have developed a security solution for power-hungry AI models that offers protection against two common attacks.

This tiny chip can safeguard user data while enabling efficient computing on a smartphone

Harnessing cutting-edge technology to optimize energy efficiency, comfort, and security in modern buildings

Building Management: The Power of Building Automation Systems

While embedded systems tend to lack the processing horsepower of servers or even modern personal computers, the sheer number of devices is making them an increasingly valuable target for bad actors looking to run illegal botnets and cryptocurrency mining operations. One of the first major security-related wake-up calls for embedded system designers was the 2016 Nest thermostat botnet attacks. Given the consumer-facing nature of the particular Internet of Things (IoT) coupled with an increased sensitivity regarding privacy and security; the Nest botnet caused a huge amount of discussion. Those discussions tended to center on how companies should build security into their low-cost IoT products and how consumers can safely operate the devices in their homes and businesses.With the growing threat of cyberattacks, it is essential that developers keep security considerations in mind throughout the design process. By following some practical tips and recommendations, developers can guard against a wide range of attack scenarios. Read on for an outline of security measures developers can use in their embedded designs.<h2>Build Secure</h2>While there are numerous chip architectures, operating systems, and communications protocols; many IoT devices tend to be built around Arm®-based architectures, and if they run an OS it tends to be a Linux distribution. This commonality is good in many ways; lower costs and faster development times; it also comes with quite a few negatives. Attack vectors tend to become “one-size-fit-all”, especially for devices running a Linux-based OS. To mitigate the threats associated with widespread devices that share a common architecture, developers should implement the following “quick win” security design principles:<ul><li>Do NOT hardcode passwords into the firmware. Also, do not use a common default password for all devices. Require the user to create a custom username and password during device initialization.</li><li>Do NOT enable insecure protocols such as HTTP, FTP, or Telnet by default. Data going off the device via wired or wireless protocols must be strongly encrypted. Avoid “homebrewed” encryption solutions.</li><li>Ship the device with the most restrictive configuration possible and let the end-user make a proactive decision to reduce security-related settings.</li><li>All mechanisms used to access the devices should require authentication and authorization controls. Two-factor authentication (2FA) should be used if practical.</li><li>All user-facing inputs should be filtered to avoid injection-type attacks.</li><li>Implement a secure device management interface for the end-user that will allow them to manage their assets, update devices, monitor devices, and securely decommission the devices that have reached their end-of-life (EOL).</li><li>Over-The-Air (OTA) update mechanisms must be validated on-device. The update files must be sent encrypted en route to the device. Lastly, ensure there are anti-rollback features to prevent a device from being reverted to a previous, insecure firmware.</li><li>If third-party software libraries are used in the design of your device, they must be continually monitored to ensure that third-party updates are integrated and that they do not become deprecated. Abandoned software projects can become nasty vulnerabilities for your device. Change the third-party software default passwords before committing them to your project.</li><li>Limit what sensitive data should be stored on the device. Store such information in a secure enclave only.</li><li>Remember that with the IoT that embedded systems are only one part of a larger ecosystem. Ensure that security is built into the cloud, desktop, and mobile applications as well. Ecosystem security is only as strong as the weakest link.</li><li>Consider establishing a bug bounty program to encourage end-users and security researchers to submit flaws in a secure, responsible manner.</li></ul>Physical access to a device tends to be the game-over situation for devices. That doesn’t mean that there aren’t things that can be done to make it harder physically exploit these types of devices. Entire books have been written on making circuit boards and associated enclosures tamper-resistant but for a few “quick wins” consider the following physical design rules-of-thumb to harden your device:<ul><li>Pins for debugging ports such as JTAG and UARTs are very useful when developing and testing a device. They are also tempting targets for those seeking to reverse engineer a device with ill-intent. Obfuscating these pins and/or removing header pins for production units is recommended. Note that this will come at the expense of making it more difficult to troubleshoot once fielded. Designers must consider a balance between security and maintainability.</li><li>The use of adhesives, ultrasonic welding, and/or specialty security screws can make it more difficult to open a device.</li><li>Applying a non-conductive epoxy over sensitive components can obfuscate their identity and purpose.</li><li>You might be tempted to use older components that might have vulnerabilities. Be aware of the counterfeit components as well. If a deal seems too good to be true, it probably is. Balancing security and time-to-market considerations is not a decision to be taken lightly.</li><li>Multilayer boards can be used to route traces in a way that makes it harder to discern how the board functions.</li></ul><img src="https://s3-us-west-1.amazonaws.com/wevolver-project-images/froala%2F1723102912865-shutterstock_2343572457.jpg" style="width: 100%px;" class="fr-fic fr-dib">Some of the following recommendations might be a bit much for consumer-grade IoT devices. However, as we will elaborate on later, industrial control systems and defense systems would likely benefit from these more robust physical security measures:<ul><li>Build security features into the board itself, such as microswitches, mercury switches, or magnetic switches that can detect if a board is being unintentionally handled or opened. Nichrome wire or fiber optics can also be used. If the wire or fiber is negatively impacted by someone trying to tamper with a device, then there will be a detectable change in the current flow of the wire or the behavior of photons through the fiber.</li><li>Side Channel or glitching attacks, while perhaps not common, provide a unique advantage to adversaries in that they use the laws of physics against a device and thus are very difficult to prevent though can be detected. By attacking the timing or restricting the flow of electrons to a CPU, it’s possible to get a device to act in unintended ways that negate security features. Voltage and current sensors can be implemented onboard circuit boards to detect if glitching may be occurring, though there is potential for false positives.</li><li>Significant adversaries can employ x-ray machinery to peer into microchips and discover the topography of the transistors to determine function and more. Sensors that detect x-rays can be added to detect tampering, though can do nothing to prevent an adversary from extracting useful information.</li></ul>It should be noted that there is quite a dichotomy between the paradigms of security and openness. Security values obfuscation. Open hardware values understanding. Regardless, keep in mind the old adage that locks only keep honest people honest, and so too with security-at-large. For more information on how to build secure IoT devices, visit the Open Web Application Security Project (OWASP) IoT Project.<h2>Operate Secure</h2>Even if a manufacturer could implement all the best secure design principles in their product, they would be mostly for naught if the end-user does not operate their device in a secure manner.<ul><li>Change the default router name, router password, network name (SSID), and network encryption key. Be sure to use strong password principles and do not use the same password for both networks.</li><li>Segment your home network into two “virtual” networks so that IoT devices cannot be “seen” by the desktop computers, Network Attached Storage (NAS) devices, etc. To do this quickly and easily, use the guest network feature for your IoT network.</li><li>Most IoT devices rely on a smartphone app to control the device. Keep the app up to date and use 2FA for login if available.</li><li>Disable any features of your IoT devices that you do not intend to use.</li><li>Update the firmware of both your router and IoT devices on a regular basis.</li><li>When an IoT device reaches the end of life and no longer receives updates consider replacing it with a newer model.</li></ul><h2>Industrial Strength Security</h2>Consumer-facing IoT products may be plentiful, but their industrial counterparts, collectively&nbsp;<iframe id="65f2ad2682d39cfbc40c772a" width="250" class="specs-iframe" height="440" src="https://wevolver.com/iframe/specs/microchip-technology-evb-pci11400-pcie-switch-evaluation-board?iframe=true" frameborder="0" scrolling="no" data-lf-form-tracking-inspected-kn9eq4roawkarlvp="true" data-lf-yt-playback-inspected-kn9eq4roawkarlvp="true" data-lf-vimeo-playback-inspected-kn9eq4roawkarlvp="true"></iframe> referred to as Industrial Control Systems (ICS) manage numerous extremely important and potentially dangerous processes. Everything from energy production to factories uses embedded digital technology (referred to as Operational Technology or OT; in contrast to office-centric Information Technology or IT) to control the facilities and associated machinery responsible for performing the various processes. The ICS environment is sufficiently different from a strict IT environment that special considerations for hardening OT devices and ICS networks are warranted. The most fundamental principle is that ICS should not have a connection to the internet. While this seems like a no-brainer, it is surprising how often this fundamental rule is violated. For more information on how to secure ICS networks and devices, there are two security frameworks you should review: MITRE ATT&amp;CK for ICS and the MITRE ATT&amp;CK for Enterprise.The nature of where ICS systems are typically found (e.g., areas that are environmentally, chemically, or otherwise hazardous) means ICS has been designed to prioritize the availability of the systems over confidentiality. From a positive perspective, this typically means there are redundant systems, and those systems are designed to fail safely. However, ICS systems can be left in operations for several decades and may not always be kept up-to-date. In addition, many of the protocols are older and were built with efficiency, not security in mind. Bottom line, security in the ICS or IIoT space is uniquely challenging and best practices may be difficult to implement. However, embedded developers for such machinery should be cognizant of the need to modernize their design practices and incorporate security into future designs and not treat it as a bolt-on afterthought.

With the growing threat of cyberattacks, it is essential that developers keep security considerations in mind throughout the design process. By following some practical tips and recommendations, developers can guard against a wide range of attack scenarios.

Why are security protocols crucial for your embedded systems?

Are you an EE looking for a new podcast?  Here's a list of MacroFab Circuit Break episodes to get you started. 

The Perfect Binge! Top 8 Circuit Break Episodes for New Listeners

<h1 id="isPasted">Cybersecurity &amp; the Supply Chain: Safeguarding PCBA Builds</h1><section><img src="https://s3-us-west-1.amazonaws.com/wevolver-project-images/froala%2F1712161626033-1712161626033.png" alt="Cybersecurity supply chain first" class="fr-fic fr-dii">In today's hyper-connected world, the intersection of cybersecurity and the global supply chain has become increasingly crucial, particularly for electronics organizations. The growing reliance on digital technology and the Internet of Things (IoT) has given rise to new challenges, exposing vulnerabilities in cybersecurity measures and creating opportunities for cybercriminals.In this blog post, we'll explore the current state of cyberattacks, the staggering financial and reputational costs of cybercrime, and the steps organizations can take to protect their Printed Circuit Board Assembly (PCBA) builds while fulfilling their ethical obligations to end users and the wider community.<h2></h2><h3>The State of Cyberattacks</h3><img src="https://s3-us-west-1.amazonaws.com/wevolver-project-images/froala%2F1712161626427-1712161626426.png" alt="State of cyberattacks" class="fr-fic fr-dii">As we delve into the murky world of cyber threats, it's essential to understand the various attacks prevalent today. The cost of cybercrime is on the rise. With businesses becoming increasingly digital, the opportunities for cybercriminals are growing. In 2022, the estimated global cost of cybercrime was a staggering $600 billion, expected to rise in the coming years.The digital world has observed a striking surge in ransomware assaults in recent years. These pernicious attacks not only freeze critical business functions, potentially leading to significant operational losses, but they can also inflict substantial financial penalties and tarnish an organization's reputation. Prominent cases such as the Colonial Pipeline incident in 2021 serve as stark reminders of the potential scale and real-world implications of these attacks.The rapidly expanding ecosystem of the Internet of Things (IoT) is increasingly falling under the crosshairs of cybercriminals. This interconnected network of devices, particularly integral and of interest to the electronics industry, often lacks stringent security protocols, making them prime targets for exploitation. Notably, the Mirai botnet attack of 2016, which commandeered IoT devices to launch distributed denial of service (DDoS) attacks, illustrates the inherent vulnerabilities of these systems.Persistent threats from nation-state actors continue to menace government institutions and organizations, drawn by the cache of sensitive information they harbor. The U.S., with its vast digital infrastructure and wealth of data, remains a high-profile target, enduring an incessant barrage of cyberattacks. Examples of this include the SolarWinds hack of 2020, widely attributed to a nation-state actor, which infiltrated numerous U.S. government agencies.<h2></h2><h3>How Cybercrime and PCBA Design Interconnect</h3>PCBA design plays a significant role in determining the security and integrity of electronic devices, as it influences the effectiveness of security measures, exploitable vulnerabilities, and how resilient electronic devices are to cyber threats.In this context, a well-executed PCBA design, integrating robust security practices, can help safeguard against cybercrime. Conversely, a poorly designed PCBA can create vulnerabilities that cybercriminals can exploit, leading to data breaches, unauthorized access, and other malicious activities.Here are some specific ways PCBA design can enhance or undermine cybersecurity:<ul><li>Device Vulnerabilities: PCBA design plays a crucial role in determining the security of electronic devices. If a PCBA is poorly designed, it may have vulnerabilities that can be exploited by cybercriminals. For example, inadequate security measures, weak authentication mechanisms, or insufficient protection against tampering could make the device more susceptible to cyberattacks. Several <a href="https://nvd.nist.gov/vuln/detail/CVE-2021-42114" target="_blank">modern DRAM devices</a> were affected by a novel Rowhammer attack in 2021.</li><li>Malware and Backdoors: Cybercriminals may target PCBA design to introduce malware or backdoors into electronic devices. By compromising the PCBA design process or the supply chain, attackers can inject malicious code into the firmware or hardware of the device, allowing them to gain unauthorized access, control the device remotely, or steal sensitive information.</li><li>Data Breaches: PCBA design flaws can also contribute to data breaches. If a PCBA lacks proper encryption mechanisms or fails to implement secure communication protocols, cybercriminals may intercept or manipulate data transmitted by the device, leading to the compromise of sensitive information.</li><li>Countermeasures: Conversely, PCBA designers need to incorporate cybersecurity measures into their designs to mitigate the risks of cybercrime. This includes implementing secure communication protocols, strong encryption algorithms, secure authentication mechanisms, and physical protection against tampering. By considering cybersecurity during the PCBA design process, designers aim to minimize vulnerabilities and enhance the overall security of the device.</li><li>Forensics and Investigation: In the aftermath of a cybercrime incident, PCBA design can play a role in forensic analysis and investigation. Experts may examine the PCBA design, firmware, or components to identify potential vulnerabilities, backdoors, or traces of tampering. This analysis can help in understanding the nature of the cyberattack, attributing it to specific actors, and taking appropriate measures to prevent future incidents. After the SolarWinds supply chain attack in 2020, cybersecurity experts investigated both the affected software and the hardware it interacted with.</li></ul>The impact of PCBA design on cybersecurity cannot be overstated. A poorly designed or delivered product with design flaws or vulnerabilities not only risks user data and privacy but also puts individuals and organizations at risk of financial loss and reputational damage.As such, it is imperative for companies to invest in robust PCBA design processes, incorporate best practices for security, and conduct thorough testing and evaluation to identify and address potential vulnerabilities.To avoid the financial repercussions of delivering a product leading to a cyber breach, companies should ensure they maintain continuous high standards for PCBA design and protection during manufacturing by working with a trusted manufacturing partner who takes security seriously. By prioritizing cybersecurity, companies can contribute to a safer digital landscape, bolster user trust, and mitigate the risks associated with cybercrime.<h2></h2><h3>The Cost of Cybercrime</h3>Cybercrime carries far-reaching financial implications. For example, in the U.S., the average cost of a data breach in 2022 was estimated to be $8.64 million. Moreover, the time it takes to identify and remediate a breach is also a significant factor in the overall cost. On average, it takes organizations 280 days to identify and contain a breach, during which the cybercriminals can cause substantial damage.<img src="https://s3-us-west-1.amazonaws.com/wevolver-project-images/froala%2F1712161626668-1712161626668.png" alt="Cost of cybercrime graph1" class="fr-fic fr-dii">Source: <a href="https://cybersecurityventures.com/cybercrime-damage-costs-10-trillion-by-2025/" target="_blank">Cybercrime Magazine</a> Projections suggest that by 2025, the annual cost of cybercrime will skyrocket to $10.5 trillion, almost tripling the cost recorded in 2015.<img src="https://s3-us-west-1.amazonaws.com/wevolver-project-images/froala%2F1712161626744-1712161626744.png" alt="Cost of cybercrime graph2" class="fr-fic fr-dii">Source: <a href="https://www.statista.com/statistics/273575/us-average-cost-incurred-by-a-data-breach/" target="_blank">Statista</a>Furthermore, reputational damage, loss of customer trust, and potential legal repercussions can have far-reaching effects hard to quantify but are just as damaging.<h2></h2><h3>Protective Measures for Electronics Organizations Against Cyber Threats</h3><img src="https://s3-us-west-1.amazonaws.com/wevolver-project-images/froala%2F1712161626943-1712161626943.png" alt="Protective measures" class="fr-fic fr-dii">The cost of cybercrime is expected to soar in the coming years. Global expenditure in the cybersecurity market is projected to rise by $5.7 trillion between 2023 and 2028, reaching a staggering $13.82 trillion by 2028. Electronics organizations are particularly vulnerable, as cyberattacks can lead to intellectual property theft, product counterfeiting, and fraud.To address these challenges, manufacturers must adopt a comprehensive approach to cybersecurity. This section outlines several data-driven steps manufacturers can take to protect themselves against cyber threats.<h3></h3><h3>Uphold IP Confidentiality Throughout Manufacturing</h3>For electronics organizations, ensuring the protection of intellectual property (IP) during the manufacturing process is of paramount importance. This is due to the potential of cyberattacks and theft. Here are some actionable steps to guarantee IP confidentiality throughout manufacturing:<ul><li>Secure File Sharing: Adopt secure practices for sharing design files with contract manufacturers (CMs). Measures could include file encryption, password protection, and the use of secure file transfer protocols. Access to design files should be strictly limited to necessary personnel.</li><li>Trusted Partners: Maintain a strong relationship with CMs known for protecting sensitive information. Perform regular security audits to verify compliance and ensure they have robust cybersecurity defenses.</li><li>Non-disclosure Agreements (NDAs): Establish NDAs with CMs and other partners who handle sensitive design files. These agreements should stipulate each party's responsibilities concerning IP protection and penalties for breaches.</li><li>Design Obfuscation: Consider employing techniques that make unauthorized understanding or reverse-engineering of design files challenging. These could include splitting designs across multiple files or using proprietary file formats.</li><li>Monitoring and Tracking: Consistently oversee and track the handling of design files throughout the manufacturing process. Implement a system that records access to sensitive files</li><li>Manufacture in IP-strong locations: Manufacturing in countries with robust IP laws, like the USA and Mexico, further protects designs against cyber attacks.</li><li>Employee training: Train employees on the importance of IP protection and the potential consequences of IP theft. Encourage a culture of cybersecurity awareness and vigilance within the organization. Ensure all manufacturing partners do the same.</li></ul>By taking these proactive measures, electronics organizations can significantly reduce the risk of IP theft during manufacturing, helping maintain their competitive edge and protect their investments in research and development.<h3></h3><h3>Mitigate Counterfeit Component Risks through Strategic Sourcing</h3><img src="https://s3-us-west-1.amazonaws.com/wevolver-project-images/froala%2F1712161627129-1712161627129.png" alt="Mitigate conterfeit component risks" class="fr-fic fr-dii">A 2020 study by the Alliance for Gray Market and Counterfeit Abatement (AGMA) found that counterfeit components in the technology industry lead to an estimated loss of $28 billion in revenue annually. Ensuring components are sourced from reliable and verified suppliers can help mitigate this risk.Not only can counterfeit components lead to system instability, failures, or unusual behaviors that can aid a cyberattack, but they can also allow embedded malware and hardware trojans to be activated once the PCBA they're attached to has been used. By doing so, hackers can gain unauthorized access to sensitive data or disrupt the device's operations.To mitigate these risks, companies should maintain the integrity of their supply chain by vetting suppliers carefully and by using secure hardware and software design practices to protect against threats.<h2></h2><h3>Conclusion</h3><img src="https://s3-us-west-1.amazonaws.com/wevolver-project-images/froala%2F1712161627252-1712161627252.png" alt="Cybersecurity supply chain conclusion" class="fr-fic fr-dii">In conclusion, the rapidly evolving landscape of cyber threats and the significant financial and reputational damages that cyberattacks can inflict necessitate proactive measures to safeguard businesses, particularly in the electronics industry. As cybercrime costs continue to rise, organizations must prioritize implementing robust cybersecurity strategies to protect their valuable assets and intellectual property.By adopting various data-driven protective measures, such as detection and prevention tools, employee training, response planning, IP protection, and secure strategic sourcing, organizations can effectively mitigate cyber risks and create a more resilient and secure environment for their operations. Proactive investment in cybersecurity is essential for the survival of individual businesses and plays a crucial role in maintaining the integrity and security of the global supply chain.</section><h4>Discover How MacroFab Can Keep Your IP Safe&nbsp;</h4><a href="https://www.macrofab.com/prototyping/intellectual-property/" target="_blank">PROTECT YOUR BUILDS WITH MACROFAB</a>

Hackers can access sensitive data and disrupt device operations by activating embedded malware or hardware trojans in counterfeit components.  How can you avoid these issues? 

Cybersecurity and the Supply Chain: Safeguarding PCBA Builds

Wearable electronic devices designed to be worn while in use are becoming more popular and powerful as they can monitor various aspects of human health, activity, and environment. However, these devices also face challenges such as limited battery life, data privacy, and network bandwidth. To overcome these challenges, edge computing and AI/ML are emerging as key technologies that can enable wearable devices to process data locally, reduce latency, and enhance user experience.&nbsp;As wearable technologies evolve to meet market needs, new devices are upgrading features such as basic BLE connectivity by adding the ability to run AI algorithms on neural processors on-device rather than in the cloud. This reduces the amount of data that needs to be transmitted over the network, saving energy and bandwidth. With the AI/ML models running in silicon, wearable devices can, therefore, learn from data and perform tasks such as recognition, classification, prediction, and optimization without incurring additional latency, data costs, and power consumption. However, these improvements require greater processing power and capabilities from embedded microcontrollers (MCUs) and application processors. At the same time, consumers expect longer battery life from their wearables. Thus, new chips must balance connectivity and higher processing power with low power consumption while maintaining a small enough package size.&nbsp;This case study explores the challenges for the next generations of wearable MCUs with a specific look at <a href="https://alifsemi.com/" target="_blank" rel="noopener noreferrer">Alif Semiconductor's®</a> Balletto™ family of BLE-enabled MCUs for wearable applications.<h2 dir="ltr">The current landscape</h2>The wearables market, which includes common accessories such as smart bands, smart rings, smartwatches, and medical devices, such as glucose monitoring devices is projected to grow to USD 118.16 billion by 2028 at a 13.8% CAGR. Demand for multimedia devices, smartphones, fitness trackers, and health wearables drives growth. Increasing health awareness fuels interest in fitness tracking devices for activities like cycling and running, contributing to market expansion.[2,3]Wearables have evolved significantly in recent years, presenting enhanced capabilities in various domains, such as AI processing and wirelessly transmitting data. New market demands have driven the expansion of wearable features. For example, the COVID-19 pandemic made blood oxygen sensing a must-have feature for many smartwatches. As a result, Apple and Samsung included blood oxygen monitoring in their smartwatches in 2020.Wearables incorporate edge AI-based solutions to process huge amounts of data in real-time. AI-enabled microcontrollers are a must to carry out these large AI/ML workloads efficiently and quickly. The integration of artificial intelligence enables new features, such as:<ul><li dir="ltr">Tracking and analyzing changes in users’ health data.</li><li dir="ltr">Sending users alerts for noise levels or air quality.</li><li dir="ltr">Personalize your device based on your tracked activity.&nbsp;</li></ul>Equally important as collecting and processing user data is the ability to wirelessly share data between devices. As such, Bluetooth connectivity has risen as a top requirement for wearables including functionalities, such as:&nbsp;<ul><li dir="ltr">Sending an alert to emergency services if a fall is detected.</li><li dir="ltr">Sharing important health updates with an approved health care professional.</li><li dir="ltr">Sharing workout metrics with a friend to stay motivated.</li></ul><h2 dir="ltr">Bluetooth LE changes the status quo in wearables</h2>Among the many low-power wireless technologies on the market, Bluetooth Low Energy (BLE) technology is uniquely suited for wearable devices that require long battery life measured in days or even weeks before needing to be recharged. BLE allows wearables to easily connect and communicate with other devices, such as smartphones, tablets, exercise equipment, or even other wearables.&nbsp;This enhances the device's functionality by enabling it to share exercise data, receive timely notifications, and more. Increasingly, wearable devices are adding audio support for which BLE is uniquely positioned. With the addition of support for the Low Complexity Communication Codec (LC3), BLE is now capable of use cases such as broadcast audio and shared or group listening experiences with LE Audio’s Auracast feature. For example, a wearable device can use the on-device neural processor such as Arm’s Ethos-U55 to run a convolutional neural network (CNN) model for gesture recognition or activity classification based on the motion data captured by inertial measurement units (IMUs). The device can then use BLE to communicate with other devices or a smartphone app to provide feedback or instructions to the user.&nbsp;In the Smart Home, wearables can be integrated into a smart home system, with AI algorithms learning the user's habits and preferences to automate various home appliances. BLE 5.4's enhanced performance and range can facilitate efficient communication with many IoT devices in the home. For example, a wearable could learn that a user likes to listen to calming music when they get home from work and automatically instruct the smart speaker to play the user's favorite playlist when they walk through the door.&nbsp;Additionally, features allow wearables to be located precisely, while location-based services (LBS) such as personalized fitness coaching (created by learning from a user’s previous workout data) can be enabled. It can suggest workout routines tailored to the user's fitness goals and current health status. The wearable device can recognize the user’s activity and posture using an ML model that runs on the Ethos-U55 core and sends the data to a cloud service via Enhanced Attribute Protocol (EAP). This could enable personalized, reliable, and secure fitness tracking for the user.&nbsp;<img src="https://images.wevolver.com/eyJidWNrZXQiOiJ3ZXZvbHZlci1wcm9qZWN0LWltYWdlcyIsImtleSI6ImZyb2FsYS8xNzEzMTY0MTY0MDQ1LVdob29wLUJvZHlUcmFpbmluZy1Ub3AuanBnIiwiZWRpdHMiOnsicmVzaXplIjp7IndpZHRoIjo5NTAsImZpdCI6ImNvdmVyIn19fQ==" style="width: 100%px;" class="fr-fic fr-dib">Next-gen wearables will enable highly-personal fitness tracking. Credit: WHOOP.&nbsp;AI/ML algorithms can be trained to detect patterns in biometric data gathered by wearables, such as heart rate, blood pressure, and oxygen saturation levels. BLE's enhanced broadcast communication mechanism (EAD, PAwR) can allow these devices to send real-time health risk alerts to other devices, such as a smartphone, even in congested or high-interference environments. For example, a wearable could alert a user or a healthcare provider if it detects signs of an impending health crisis like a heart attack or stroke.&nbsp;When you combine AI-enabled MCUs with BLE, wearables become more personalized, efficient, secure, and useful in our everyday lives. Alif Semiconductor <a href="https://alifsemi.com/press-release/first-ble-matter-wireless-microcontroller-with-neural-co-processor-for-ai-ml/" target="_blank">has just announced</a> their Balletto family of BLE and Matter microcontrollers&nbsp;with neural processing for AI/ML workloads, which seeks to exceed the standard for low-power BLE operations.<h2 dir="ltr">Hardware accelerated machine learning</h2>To meet the market-need for state-of-the-art wearables, Alif Semiconductor offers AI/ML-enabled microcontrollers with dedicated NPU accelerators that allow heavy AI/ML workloads to run without compromising battery life. <a href="https://alifsemi.com/products/balletto/" target="_blank" id="isPasted">The Alif Balletto family</a> of microcontrollers introduces the world's most power-efficient microcontroller with on-device secure AI/ML processing, top-notch security, and ample peripherals for applications requiring integrated Bluetooth Low Energy and 802.15.4-based connectivity.&nbsp;The Balletto family boasts the powerful Arm® Cortex®-M55 core, equipped with double-precision FPU and Helium Vector Extensions, operating at a remarkable speed of up to 160MHz. Arm Ethos-U55 is a dedicated NPU accelerator that offloads AI/ML operations from the Cortex-M55 processor, allowing the M55 cores to operate in very low-power modes. This is especially important for wearables like hearing aids, which need to have a long battery life. Equally as important for wearables is having a small form-factor design, which Balletto can provide in a sub 16mm ² package. &nbsp;&nbsp;Balletto’s Ethos™-U55 Neural Processing Unit (NPU) can improve the performance and efficiency of speech recognition machine learning models by up to two orders of magnitude, excluding the 5-10x improvement already provided by the Cortex-M55 core over previous generation Cortex-M CPUs. This is ideal for wearables that rely on voice commands, improving processing speed and lowering latency.&nbsp;<img src="https://images.wevolver.com/eyJidWNrZXQiOiJ3ZXZvbHZlci1wcm9qZWN0LWltYWdlcyIsImtleSI6ImZyb2FsYS8xNzEyODQyNDU1ODU5LWFsaWYgbWFpbiAyLnBuZyIsImVkaXRzIjp7InJlc2l6ZSI6eyJ3aWR0aCI6OTUwLCJmaXQiOiJjb3ZlciJ9fX0=" style="width: 100%px;" class="fr-fic fr-dib">Balletto and Ensemble families. Image credit: Alif Semiconductor.<h3 dir="ltr" id="isPasted">Battery-friendly microcontrollers powered by Alif’s aiPM™ technology&nbsp;</h3>The Balletto family also tackles a common problem seen by previously existing AI/ML-powered microcontrollers: short battery life. Connected wearables or mission-critical devices like hearing aids depend on long battery life for users. Their ability to function is hindered when there is a need for heavy local processing and AI/ML. Balletto MCUs are the most power-efficient in their class, thanks to Alif's innovative aiPM technology. This technology manages all aspects of the device, including individual processing cores for real-time control, neural processing, DSP and audio, deep security, and radio protocols capable of BLE 5.4 with LE Audio, Thread, and Matter. Balletto devices also include a wide range of interfaces and large memories, all monolithically integrated inside extremely small packages. This makes them ideal for demanding battery-powered applications such as wearables and hearables.Alif Semiconductor’s aiPM technology manages the power usage of the device through 8 power domains. It activates only the necessary chip sections and deactivates them when not in use, resulting in a highly efficient always-on region when there is a high requirement for local processing and AI/ML. The integrated dual-PA and on-chip antenna gives customers control of the reliability-range equation by providing tuning options of 4 dBm or up to 10 dBm Bluetooth transmit power. &nbsp;Balletto’s Bluetooth radio has a receive current of 1.5mA and a transmit current of 2.0mA, making it power conscious.Additionally, off-die peripherals produce higher energy consumption for wearables, while Balletto’s on-die solution fosters maximum efficiency. Utilization of the internal bus fabric effectively lowers access time, dynamic power, and standby power, ultimately providing more granular and precise power control at a lower cost.&nbsp;<h3 dir="ltr">Balletto family multi-layered security</h3>In addition to handling processing requirements, microcontrollers for wearables must ensure data security. Alif Balletto microcontrollers provide exceptional security features with multiple layers of protection, including:<ul><li dir="ltr">Root of Trust</li><li dir="ltr">Unique device ID for each individual chip</li><li dir="ltr">Dedicated security processor</li><li dir="ltr">Dedicated protected memory</li><li dir="ltr">Configurable firewalls that regulate access of each CPU to sections of memories and individual peripherals and extend the capabilities of the standard Arm Trust Zone security partitioning</li></ul>Alif Semiconductor is the only company in this market segment that injects at manufacturing, a unique public key infrastructure (PKI) key pair to support immutable&nbsp;hardware root of trust (RoT) from secure boot to strong authentication and remote software attestation capabilities.As a result, the personal data acquired by sensors and processed by the Alif Balletto microcontrollers are secured against third-party attacks.Users can securely manage all aspects of the device lifecycle, including key management, certificate management, remote updates, and more. Legacy MCUs may stop at TrustZone, but Alif takes you beyond TrustZone to ensure that multi-core devices are protected by not allowing two CPUs to access the same Secure domain and share secrets.&nbsp;<h3 dir="ltr">Graphics and imaging</h3>The Balletto family includes a number of hardware features to help offload traditionally CPU-intensive workloads from the MCU/MPU cores to improve performance and keep current consumption in check. One such feature is an integrated 2D graphics accelerator that can help speed up drawing operations by 4-10x compared to an unaccelerated system. This, combined with a set of imaging and display interfaces, which include parallel as well as MIPI-CSI2 and MIPI-DSI interfaces for 24-bit RGB displays and 8 to 16-bit cameras, provide everything needed for responsive and buttery-smooth graphics on pixel-dense screens.<h2 dir="ltr">Conclusion</h2>As the wearable technology market continues to expand, the convergence of edge AI and BLE technology has enabled wearables to become smarter, more efficient, and more secure. Alif Semiconductor's Balletto family of MCUs represents a significant leap forward in meeting the ever-growing demands of the wearables market. These innovative solutions empower wearables to not only collect and process data but also to provide real-time, personalized, and secure experiences, all while maintaining long-lasting battery life and optimizing form factor. The future of wearables is here, and it's exciting.<h3 dir="ltr">References</h3><ol><li dir="ltr">GlobeNewswire. <a href="https://www.globenewswire.com/en/news-release/2023/03/15/2627702/0/en/2023-2028-Smart-Wearables-Market-Size-Share-and-Trends-Analysis-Report-By-Y-O-Y.html" target="_blank">2023- 2028 Smart Wearables Market Size, Share and Trends Analysis Report By Y-O-Y</a>.</li><li dir="ltr">businesswire. <a href="https://www.businesswire.com/news/home/20220104005806/en/Global-Wearable-Technology-Market-Trends-Analysis-Report-2021-2028-Adoption-of-Fitness-Trackers-and-Health-based-Wearables-is-Anticipated-to-Propel-Growth---ResearchAndMarkets.com" target="_blank">Global Wearable Technology Market Trends &amp; Analysis Report 2021-2028: Adoption of Fitness Trackers and Health-based Wearables is Anticipated to Propel Growth - ResearchAndMarkets.com.</a></li></ol><h3>Further Research</h3>Ramesh Nair, 2023. “<a href="https://www.safetymint.com/blog/smart-wearables/" target="_blank">Smart Wearables: Advancing Safety in the Workplace</a>”StartUs Insights, 2023. “<a href="https://www.startus-insights.com/innovators-guide/wearables-trends/" target="_blank">Top 10 Wearables Trends in 2023</a>”GlobalData, 2022. “<a href="https://www.medicaldevice-network.com/comment/wearable-technology-iot/" target="_blank">Wearable technology market continues to rise</a>”Lisa Eadicicco, 2022. “<a href="https://www.cnet.com/tech/mobile/smartwatches-have-measured-blood-oxygen-for-years-but-is-it-useful/" target="_blank">Smartwatches Have Measured Blood Oxygen for Years. But Is This Useful?</a>”Fi Forest, 2022. “<a href="https://www.pharmaceutical-technology.com/sponsored/wearables-managing-complexities-data-privacy-consent/" target="_blank">Wearables: managing complexities in data privacy and consent in healthcare tech</a>”Industry News, 2022. “<a href="https://www.helpnetsecurity.com/2022/11/16/alif-semiconductor-telit/" target="_blank">Alif Semiconductor partners with Telit to develop and deploy IoT edge devices</a>”Alif Semiconductor, 2023. “<a href="https://alifsemi.com/ensemble/" target="_blank">Supplying next generation scalable microcontrollers</a>”Arrow, 2022. “<a href="https://www.arrow.com/en/research-and-events/articles/alif-semiconductor" target="_blank">Alif Semiconductor</a>”Eduardo Montanez, 2022. “<a href="https://www.nxp.com/company/blog/nxp-i-mx-rt-mcu-technology-powers-our-smartwatch-future:BL-NXP-IMX-RT-MCU-TECHNOLOGY" target="_blank">NXP i.MX RT MCU Technology Powers Our Smartwatch Future</a>”

Learn how bluetooth connected AI/ML microcontrollers are setting the bar for next generation wearables.

Leading Wearables into a New Era with Cutting-Edge Connected Bluetooth LE based MCUs

<h1 dir="ltr" id="isPasted">Introduction</h1>In an age where data is the new gold, and digital infrastructure forms the backbone of our society, the importance of data security cannot be overstated. Silicon-level security refers to the protective measures embedded at the hardware level of computing devices. It is a fundamental layer that underpins the reliability and trustworthiness of everything from consumer electronics to critical national infrastructure.As we usher in the era of ubiquitous computing, with billions of connected devices exchanging data every second, the stakes for robust security have never been higher. The concept of silicon-level security isn't new; however, the complexity and sophistication of threats it must mitigate have evolved dramatically. Gone are the days when simple perimeter defenses were sufficient. Today's security architects must assume a posture of 'defense in depth', where multiple layers of security measures are integrated into the silicon itself.This proactive approach to security is vital as the functionality and value of devices increasingly hinge on their ability to protect and process sensitive data securely. Whether it's financial transactions, personal information, or state secrets, the common denominator is the silicon that processes and stores this data. Thus, the integrity of silicon-level security mechanisms is a paramount concern, laying the foundation for trust in the digital age.In the following sections, we'll delve into the intricate world of secure interface technologies, unpack the challenges faced by modern System on Chip (SoC) designs, and explore how advancements in technology are paving the way for stronger, more resilient security measures. &nbsp;&nbsp;<h1 dir="ltr">The Backbone of Security: Root of Trust and Cryptography IP</h1>At the heart of silicon-level security is the concept of a 'Root of Trust' (RoT), a set of functions trusted implicitly by the system due to their foundational role in ensuring overall security. The RoT provides a secure starting point for system boot and cryptographic operations and is immune to software-based attacks because it is often implemented in hardware. This secure cornerstone handles critical tasks such as secure boot, secure firmware updates, and cryptographic key management, ensuring that only authenticated code and communications are running on the device.Adjacent to the Root of Trust is the role of Cryptography IP, which includes hardware-based cryptographic engines designed to perform encryption and decryption tasks. These cryptographic modules serve as the workhorses for data protection, enabling secure data storage and transmission, and are essential for functions like secure communications, digital signatures, and user authentication.Both RoT and Cryptography IP are imperative for a secure boot process, which is the first step in a secure chain of events that occur when a device is powered on. During this process, the integrity and authenticity of the software stack are verified using cryptographic checks, establishing a secure execution environment from the outset.To understand their importance, consider the analogy of a bank vault. In this analogy, RoT is the combination to the vault—highly confidential and used to validate the identity of individuals attempting to access the vault. Cryptography IP, on the other hand, is like the reinforced walls and time-locked doors—structural features that enforce security protocols and prevent unauthorized access.These technologies also enable secure end-to-end communication, ensuring that data remains confidential and unaltered during transmission. With the proliferation of the Internet of Things (IoT) and connected devices, securing data in transit has become as crucial as securing it at rest.Despite their robustness, the implementation of Root of Trust and Cryptography IP is not without challenges. Ensuring that these security measures themselves are impervious to exploitation requires meticulous design and regular updates in response to the evolving threat landscape. In the next section, we will examine the security challenges inherent in modern SoC designs and discuss how these foundational technologies can help mitigate those risks.<h1 dir="ltr">Securing the Core: Challenges in SoC Designs</h1>Modern Systems on Chip (SoCs) are marvels of integration, embedding processors, memory, I/O, and various other functionalities into a single chip. This consolidation brings vast benefits in terms of performance and power efficiency but also introduces a myriad of security challenges that must be navigated carefully.One of the primary challenges is the increased attack surface. The very features that make SoCs powerful—connectivity, configurability, and smart functionalities—also make them more vulnerable to attacks. With more lines of code, there are more potential bugs or backdoors. With more interfaces, there are more points of entry for malicious actors.Additionally, as SoCs become more complex, ensuring that every component is secure from design to decommission becomes harder. This complexity often results in a greater risk of side-channel attacks, where an attacker could infer sensitive information from power consumption, electromagnetic emissions, or even computation time.Supply chain security presents another significant challenge. SoCs are global products, with materials and components sourced from and passing through multiple vendors and countries. Each step in this chain presents an opportunity for malicious actors to introduce vulnerabilities.Moreover, the need for speed in markets means that security can sometimes be an afterthought, leading to vulnerabilities in the rush to get products to market. As a result, rigorous security testing and validation procedures are essential but can be overlooked or undervalued.In dealing with these challenges, the industry has turned to a variety of mitigation strategies. One key approach is the concept of 'security by design', where security measures are considered at every step of the SoC design and manufacturing process. This approach includes using hardware-based security features, like those provided by secure enclaves and trusted execution environments, which can isolate sensitive operations from the main processor to protect them from software attacks.Another strategy is regular security audits and updates. Even after an SoC is deployed, its security posture must be maintained and updated in response to new threats—much like how software is regularly patched.Finally, leveraging advanced fabrication techniques and materials can reduce the physical vulnerabilities of SoCs, making them harder to tamper with or reverse engineer.Navigating these challenges is a complex task, but it is one that is crucial for maintaining trust in technology. In the next section, we discuss how these strategies are put into practice, keeping SoCs secure against an ever-evolving array of threats.<h1 dir="ltr">Building Defenses: Mitigation Strategies for SoC Security</h1>To confront the security challenges in SoC designs, the semiconductor industry has developed a suite of mitigation strategies that bolster the defenses of these complex systems.<ul><li dir="ltr">Secure Architectural Design: The first line of defense is secure architectural design. This includes the incorporation of hardware-based security features such as secure boot, trusted execution environments, and secure key storage. By integrating these elements at the design phase, SoCs are better equipped to handle unauthorized access attempts and ensure that critical operations remain uncompromised.</li><li dir="ltr">Layered Security Approach: A layered security approach is critical for protecting against a wide range of potential attacks. This involves implementing multiple security layers that function together to protect the system. If one layer is breached, the subsequent layers provide an additional level of defense, making it more difficult for an attack to be successful.</li><li dir="ltr">Dynamic Security Measures:&nbsp;Dynamic security measures, such as runtime monitoring and anomaly detection, are also key. These systems can detect and respond to suspicious behavior in real-time, providing a responsive layer of security that adapts to current threats.</li><li dir="ltr">Encryption and Cryptography:&nbsp;Strong encryption and cryptography are indispensable in SoC security, safeguarding data both at rest and in transit. Advanced encryption standards and cryptographic algorithms are implemented to ensure that even if data is intercepted, it remains indecipherable without the appropriate keys.</li><li dir="ltr">Regular Security Audits and Firmware Updates:&nbsp;Ongoing security audits and regular firmware updates ensure that security measures remain up-to-date in the face of evolving threats. This strategy includes the establishment of secure update mechanisms that prevent the installation of malicious firmware.</li><li dir="ltr">Supply Chain Integrity:&nbsp;Protecting the integrity of the supply chain is another critical strategy. This involves measures such as secure manufacturing practices, tamper-evident packaging, and traceability of components to ensure that SoCs are not compromised at any point from fabrication to delivery.</li><li dir="ltr">User Education and Access Control: Lastly, user education and strict access control policies are necessary to prevent inadvertent breaches. Users need to be aware of the security features of their devices and how to use them properly, while access control ensures that only authorized individuals can make changes to the system configuration or access sensitive information.</li></ul>By implementing these strategies, SoC designers and manufacturers can create more secure systems that are resilient in the face of both current and emerging security threats. However, the fast pace of technological change means that vigilance and continuous improvement are mandatory. Security is not a one-time achievement but an ongoing process of adaptation and reinforcement.<h1 dir="ltr">Conclusion</h1>Silicon-level security stands as a critical pillar in our digital era. Through exploring secure interface technologies, such as Root of Trust and Cryptography IP, we recognize their indispensable role in safeguarding modern SoCs. As we confront security challenges—from side-channel attacks to complex interface vulnerabilities—the need for a robust, multi-layered defense strategy becomes clear.Securing silicon goes beyond a single solution—it's a continuous battle, balancing innovation with vigilance. As technology advances, so must our security strategies, integrating state-of-the-art features and adopting a culture of security-first in design and deployment.The future hinges on our collective effort to ensure the trustworthiness of our digital foundations. In fostering this trust, the commitment to silicon-level security must remain unwavering, uniting stakeholders across the industry to fortify our digital landscape.<h1 dir="ltr">Synopsys' Impact on SoC Security</h1>In the realm of SoC security, <a href="https://www.synopsys.com/" target="_blank" rel="noopener noreferrer">Synopsys</a> offers critical technologies that sharpen the defenses of silicon interfaces. Their AI and Machine Learning tools not only expedite chip design but also imbue systems with smart threat detection, essential for anticipatory security. Their cloud solutions provide secure integrations essential for IoT devices dependent on cloud data management.Their Design Technology Co-Optimization (DTCO) propels the creation of SoCs resistant to advanced threats by exploring new transistor architectures. Synopsys' emphasis on early-stage security integration through DevSecOps, alongside energy-efficient design practices, further strengthens SoCs against exploits like power analysis attacks.Synopsys also pioneers in fortifying system integrity with its Multi-Die System solutions, safeguarding sensitive operations within SoCs. Their vigilance extends to software security, ensuring open-source components and software supply chains are robust against vulnerabilities from inception.Through innovation and a strategic approach to security, Synopsys plays a pivotal role in the evolution of more secure digital infrastructures, demonstrating a comprehensive commitment to the advancement of SoC security.<h1 dir="ltr" id="isPasted">References</h1>[1] Dana Neustadter, Hezi Saar, Michael Posner, ‘How Security for SoC Interfaces Enhances Data Protection’, Synopsis, 4 Oct. 2022, [Online], Available from:&nbsp;<a href="https://www.synopsys.com/blogs/chip-design/soc-interfaces-security-enhance-data-protection.html" target="_blank">https://www.synopsys.com/blogs/chip-design/soc-interfaces-security-enhance-data-protection.html</a>[2] Marco Ciaffi, John Min, ‘Building security into an AI SoC using CPU features with extensions’, Embedded, 12 Apr. 2021, [Online], Available from:&nbsp;<a href="https://www.embedded.com/building-security-into-an-ai-soc-using-cpu-features-with-extensions/" target="_blank">https://www.embedded.com/building-security-into-an-ai-soc-using-cpu-features-with-extensions/</a>[3] Ruud Derwig, Nicole Fern, ‘Techniques for Ensuring Security in Processor-based SoCs’, Synopsis, [Online], Available from: <a href="https://www.synopsys.com/designware-ip/technical-bulletin/ensuring-security-processor-socs.html" target="_blank">https://www.synopsys.com/designware-ip/technical-bulletin/ensuring-security-processor-socs.html</a>[4] Landry J., ‘What Is Hardware Root of Trust?’, Dell, 22 July 2022, [Online], Available from: <a href="https://www.dell.com/en-us/blog/hardware-root-trust/" target="_blank" rel="noopener noreferrer">https://www.dell.com/en-us/blog/hardware-root-trust/</a>

Silicon-level security is crucial in protecting the hardware of computing devices, serving as a foundational layer for data integrity and system reliability in our increasingly digital world.


Silicon-Level Security: A Deep Dive into Secure Interfaces

Network System Control Center Operator Working

Dive into our comprehensive guide on defense in depth layers, unravelling the complexities of multi-tiered security strategies for robust protection.

Unraveling Defense in Depth Layers: A Comprehensive Guide

Experts say 2021 was the year of ransomware, but things changed in 2022 as criminals realized an estimated 17 billion IoT devices represented an easier target. While IT hardware and software security has dramatically improved, the IoT has lagged.Many IoT products need to be adequately secured and, as such, represent vulnerable entry points for attacks on critical infrastructure. Or the IoT device itself can be the specific target due to the data it hosts &ndash; for example, video from security cameras and patient information from medical wearables.There is a steady stream of news items about cyberattacks affecting everyday businesses and well-known brands. These can result in financial losses, privacy breaches, or individuals being blocked from accessing critical services. But now key infrastructure is also proving a major target, posing a danger to health, energy, food, water, and communications.<h2>IoT as a growing attack surface for cybercrime</h2>This is a problem that&rsquo;s not going away. Inexpensive wireless components are proving a boon to connectivity. The price of turning a dumb device into a smart device can be as low as 10 cents, says security expert Mikko Hypp&ouml;nen. That&rsquo;s encouraging vendors to add wireless connectivity to many devices, even if the benefits might be minor. And Hypp&ouml;nen explains that whenever an appliance is connected, that also makes it vulnerable.According to analyst firm IDC, there will be almost 42 billion IoT devices by 2025. The vulnerable products among that network will contribute to a cost of cybercrime that&rsquo;s set to grow to $10.5 trillion by the same year, according to research firm Cybersecurity Ventures. The growing number of connected devices creates a larger &lsquo;attack surface&rsquo;&mdash;the number of potentially unprotected targets a miscreant can seek to exploit. In addition, the large volumes of data gathered and transmitted by billions of connected IoT devices create a bigger target for interception.<h2>Addressing the vulnerability of connected devices</h2>Enhancing the <a href="https://www.nordicsemi.com/Support/Security" target="_blank">security</a> of the IoT is challenging. Cyber attackers benefit from the complexity of the network, as the more companies, equipment, devices, and software are involved, the more opportunities there are for exploitation. Such complexity emphasizes the importance of security being considered at all stages of a product&rsquo;s lifecycle - not just when it&rsquo;s in the field.Even simple IoT products, smart thermostats, for example, should be endowed with a degree of protection. It&rsquo;s not expensive to build-in simple protection such as secure-boot and secure-update with anti-rollback. Secure boot ensures the device verifies that its original software, and any subsequent update, is authorized and is safe to run. Anti-rollback prevents an older (and potentially vulnerable) version of the firmware being reinstated.Even greater security can be achieved by isolation. Isolation provides a barrier between the firmware responsible for potentially vulnerable interfaces and the security critical code. Non-critical information can still be extracted from the isolated area for general operation of the IoT device, but no security critical information is accessible beyond the isolated area. The device might also feature secure storage for security critical data and assets.<h2>Changing IoT-customers&#39; expectations of security</h2>In the wake of heightened awareness of cyber-attacks, public expectations of IoT devices have shifted. A survey by the U.K. government in 2020 found nine out of ten people now expect smart devices to have basic embedded features to protect user privacy and security.In response, <a href="https://www.psacertified.org/" rel="noopener" target="_blank">PSA Certified</a>, a framework for securing connected devices, has brought together major stakeholders to consolidate a range of security approaches into a standardized approach for the IoT. It developed a <a href="https://www.psacertified.org/what-is-psa-certified/using-psa-certified/" rel="noopener" target="_blank">four-stage framework</a> that guides developers through the steps necessary to implement the right level of security for a product. Nordic itself has aligned with the framework.Regulators in several countries are also outlining expectations and establishing minimum security standards for IoT products. In the EU, lawmakers recently introduced security standards that require internet-connected products to have &ldquo;appropriate levels of cybersecurity&rdquo;. In the U.S., recent Executive Orders on cybersecurity have led to the development of IoT security standards by The National Institute of Standards and Technology (NIST).<h2>Unlocking the value of the IoT</h2>Improved security can help developers of IoT solutions unlock stronger customer relationships, especially in contexts where reliability is critical. A prime example is the <a href="https://www.psacertified.org/products/fluence-wireless-flex-dimming-receiver/" rel="noopener" target="_blank">Wireless Flex Dimming Receiver</a> lighting solution from illumination company Fluence, which is built using Nordic&rsquo;s nRF52840 SoC and is PSA Certified.The product is targeted at the agriculture sector and enables growers to increase the amount and quality of produce by optimizing lighting conditions. Its built-in security features make it resistant to disruption increasing industry&rsquo;s trust in connected commercial solutions. This trust must now extend to key smart infrastructure such as smart electricity distribution grids, education, and healthcare.As wireless IoT suppliers like Nordic, industry consortiums like PSA Certified, and regulators around the globe work to prioritize digital security, we may finally see inherent high levels of protection that will unlock the full potential of the IoT.<hr>This article was first published on Nordic&#39;s&nbsp;<a href="https://blog.nordicsemi.com/getconnected" target="_blank" rel="nofollow" id="isPasted"></a><a href="https://blog.nordicsemi.com/getconnected?utm_campaign=2021%20wevolver" target="_blank" rel="noopener noreferrer">Get Connected Blog</a>. &nbsp;

Many IoT products need to be adequately secured and, as such, represent vulnerable entry points for attacks on critical infrastructure. Or the IoT device itself can be the specific target due to the data it hosts – for example, video from security cameras and patient information from medical wearables.