Achieve Modern IP Protection by Protecting the Host
Click to read the first blog!
My last blog described what Star Lab’s believes is a sound, modern approach to achieving effective protection for software IP at the edge. Globalization, as well as the rapid adoption of digital technologies into all aspects of business operations, have companies thinking more and more about how they protect their software IP once it leaves their control, i.e., once it is sold to a consumer. The approach I described in that blog briefly described three guideposts. In this blog I want to expand on the first: Protect IP by first protecting the host.
What’s the connection between protecting a host and protecting software IP?
Well, to reach the software IP in a manner that enables both access, visibility, and extractability, an attacker will first interface with the host in some manner. An attacker might search the host for open network interfaces or an available JTAG port. They might also introduce interposers or connect probes or use side-channel analysis tools. The battle is fought on the host, and like a general taking the initiative to dictate the terms, terrain, and tempo of an engagement, so too can system engineers prepare the host so they have the advantage in an IP protection engagement. Protecting the host is a deliberate exercise aimed at controlling the terms of a contest.
Next, protecting the host to protect software IP does not require obfuscation. Security through obscurity is a trendy approach in the IP protection industry, but it comes with a severe vulnerability—if the attacker learns your obfuscation technique, they can exploit it. Protecting a host does not require obscurity if done properly. A build-the-host-secure approach will leverage secure boot and extended trust mechanisms to defeat at-rest tamper while applying sound isolation and least privilege principles for runtime protections.
Finally, there is another positive outcome to prioritizing the protection of the host when trying to protect IP – cyber resilience. What is cyber resiliency? NIST defines it as:
“Cyber resiliency engineering intends to architect, design, develop, implement, maintain, and sustain the trustworthiness of systems with the capability to anticipate, withstand, recover from, and adapt to adverse conditions, stresses, attacks, or compromises that use or are enabled by cyber resources.”
To support organizations looking to improve their engineering efforts around cyber resiliency, MITRE created the Cyber Resiliency Engineering Framework (CREF). This framework, centered around four guiding pillars: Anticipate, Withstand, Recover, and Adapt, can help engineers navigate the various techniques and approaches for building in cyber resiliency.
Star Lab’s solutions are designed to help you achieve cyber resiliency for your embedded Linux system. Both Titanium Technology Protection and Kevlar Embedded Security include features that span all four pillars. Future blogs will elaborate on these features.
Click to read the next blog in this series!
To re-iterate, IP protection done properly, namely by first protecting the host, overlaps greatly with cyber resiliency goals. Both objectives focus not only on defeating attacks but on enduring successful ones. In other words, they both operate under the assumption that adversaries will gain access, and both are concerned with limiting the effectiveness of the adversary while still successfully operating and delivering capability, even if only in a degraded state.