AWS IoT Greengrass Hardware Security Interface (HSI)

PKCS#11 is part of the Public Key Cryptography Standard (PKCS). To put it simply, it’s an interface or API that defines the communication between a controller (microcontroller or microprocessor) and a Hardware Secure Module (HSM). The ATECC608B is the HSM in the IoT Greengrass Hardware Security Integration. 

Security is often mistaken with encryption. Encryption alone doesn’t solve security. It’s not because a key is encrypted and stored that the system can be secure as firmware and software bugs will always exists. Bugs are a natural part of coding. In addition, there is another considerable attack surface to consider during the manufacturing process where keys and other cryptographic assets can be severely exposed to employees and equipment. All these backdoors are attack surfaces to spoof a private key. The usage an ATECC608B secure element combined with Microchip’s provisioning service will help to reduce significantly the exposure of your keys from software, firmware, manufacturing, third-party companies and users. The ATECC608B has been rated JIL “High” demonstrating its high robustness on protecting keys.

There are two authenticated links that IoT Greengrass Hardware Security Integration will look in for a signature:

• The authentication between the IoT Greengrass Core to AWS IoT
• The authentication from the IoT Greengrass Core to the IoT edge node connected to the gateway.

Both authentication paths rely on a mutual TLS1.2 protocol. Consequently, the system could require two private keys to address the two authentication links, one for each. Alternatively, a single private key can be used to authenticate both links. The choice will depend on the application and the security model decided on by the designer. The IoT edge node will still require having its own private key to be stored in a secure element like the ATECC608B within the end-node itself.