Keeping Embedded Secure: Authentication And Encryption

Security demands focus the need for authentication, encryption, and digital signatures in embedded network devices as more devices are connected to the Internet. Attacks on desktops, servers, and PCs are increasing because of common platforms and languages, such as Visual Basic, and the number of Internet-connected PCs.

Soon, the number of embedded devices connected to the Internet will be greater than the number of PCs, making them ideal targets for a range of attackers. Unsecured and unverifiable transmission of information will still occur, although secured and verifiable transmissions will be required, especially for key actions like downloading programs or data to an embedded device.

Authentication, digital signatures, and encryption are generally based on a set of keys and algorithms for transforming digital data, called clear text, into an encrypted form and back again. Digital signatures are based on the encryption of a checksum of the data being signed. Secure authentication is accomplished using digital signatures.

Today's popular forms of encryption use a private key or a public key approach. The private key method employs shared secret keys that are typically identical, while the latter approach uses a pair of keys: one secret and one public.

Digital signatures can implement either approach for encrypting data that will confirm the validity of other data. Frequently, the encrypted data is a checksum. The encrypted checksum and its matching data are usually paired to make verification easier. Pairing allows additional digital signatures to be associated with the unencrypted data. Likewise, another digital signature could be applied to the combination.

Digital signature verification can be performed using two mechanisms. The first decrypts the signature and compares the decrypted information with that generated from the signed information. The second generates a copy of the encrypted information and compares the encrypted data. A match using either technique indicates that the clear text has been signed.

Digital signatures can be employed for authorization. These are often called certificates or tickets. In such cases, the encrypted information will usually be larger than the clear text. For example, Kerberos is a server-based authentication system that uses digital signatures. Authentication details are hidden in the encrypted information so the details can't be extracted from an intercepted signature packet. Digital signatures often have time stamps and lifetime information. Lifetimes of minutes or hours are often implemented to let remote applications access resources on a remote server.

A public key infrastructure (PKI) is a centralized method for securely managing and distributing public keys. The keys are delivered as certificates, each with one or more digital signatures from a certificate authority (CA). A certificate holder can trust the key if it verifies and trusts that the digital signatures and the lifetime of the certificate haven't expired. PKIs are typically implemented for keys used with e-mail, Web browsers, and remote-access services.

See associated figures:
Private key encryption
Public key encryption
Digital signature verification
Digital signature verification
Encrypted or signed communication