IoT technology utilization is increasing, but security is lacking
Adoption of HW security technology application solutions accelerates development
Infineon performs provisioning at the security chip production stage


In 2019, domestic IoT sales exceeded 10 trillion won for the first time, recording 10.9379 trillion won, a 16.2% increase from 9.4149 trillion won in 2018.

Gartner predicts that the number of connected things installed worldwide will reach 25 billion by 2021.

IDC forecasts that annual data generation will explode to 163 ZB (zetabytes; 1 billion terabytes) by 2025. It added that data generated from things will account for 80% of the total.

Many companies see the use of IoT technology as a starting point for digital transformation. However, as corporate assets are connected to the Internet, security issues are emerging.

Any network-connected IoT device is always susceptible to session hijacking, meaning an attacker can gain control and commit cybercrime. Not only that, IoT infrastructure may also be damaged.

So how can we achieve IoT security? We met with Kim Gyu-hyun, head of the Digital Security Solutions Business Unit at Infineon Korea, to ask him how the industry is currently achieving IoT security and how we can quickly develop and release products that provide IoT security enhancements.

Kim Gyu-hyun, the head of IoT, said, “The concept of IoT has been around for quite some time, but there are not many cases of IoT security being applied in reality.” However, he predicted, “As IoT products become more diverse and demand increases, the IoT security market will soon explode.”

Kim Gyu-hyun, the vice president, pointed to a major domestic home appliance company that adds Internet connectivity to almost all of its products as a company that is paying special attention to IoT security. “They are currently preparing their own IoT security solution, and Infineon is also participating in the development of related products,” he said.

Since IoT devices are connected to the Internet, both hardware and software security are important. However, the development period is limited due to the tight market release schedule. “IoT device developers need to pay more attention to software-based IoT security,” said Kim. “Customers only need to prepare an environment in which the actual product can operate,” he said, explaining that Infineon already supplies security chips with hardware-based security technology to customers.

When asked specifically what kind of environment they can operate in, Manager Kim said, “The security chips provided by Infineon do not operate independently, but are peripheral devices that operate in conjunction with MCUs or APs.” He continued, “In order to operate these security chips, software work is required to enable the product to operate on an actual MCU or AP, and developers must perform this work.”

Developers don’t have to do all the work. “Infineon has published code on its website that can run its security chips,” he said. “Developers just need to integrate the code that can run Infineon’s security chips into the MCU or AP they want to use in their IoT applications.”

IoT security requires different levels of security and authentication, including device-to-device authentication and device-to-cloud server authentication. This is why Infineon's embedded security solution, 'OPTIGA™ Trust', is divided into X, B, E, and M products.

“OptiG Trust B (hereinafter B) is an entry-level product used for device-to-device authentication, while OptiG Trust M (hereinafter M) is a flagship product used for authentication between devices and cloud servers,” said Vice President Kim Gyu-hyun. “Infineon discusses with customers to supply the most suitable embedded security product.”

How does OptiGaTrust perform authentication? Manager Kim explained, “A certificate is something that contains data such as key values between a device and an MCU in a specific format, and this certificate is included in B.” He continued, “If the MCU is configured to receive the certificate, that is, if the host library is configured to operate, B generates a random number and presents it to the MCU, and the MCU determines whether or not it is the correct device through mathematical calculations.”

Kim Gyu-hyun, the head of the company, said that B is currently being installed in drones, laptops, electric scooters, and other products manufactured in China and other places, implementing a function to determine whether the battery is genuine. He added, “Since the authenticity of the battery is related to not only security but also safety, many customers are applying B without hesitation.”

While saying that, “Customers usually have specific keys for the mathematical encryption algorithms they want to use, and there is a need for a process to upload those keys to OptiGa Trust,” and “Infineon uploads the keys desired by customers to the product at a specific factory that has received international certification before delivery,” it said that it performs the provisioning process on behalf of the customer. Additionally, Infineon operates a support team that provides on-site support for integrating the host library into customers' MCUs or APs.

Infineon completed the acquisition of Cypress Semiconductor in April. “Infineon can now integrate Cypress’s connectivity and MCU technologies into OptiGa Trust,” said Vice President Kim, evaluating the value of this acquisition, “and now we can provide customers with the IoT security technology they need as a turnkey solution.”

Lastly, he predicted, “If the IoT market grows larger than it is now and more people have access to IoT devices, the need for solutions like Optiga Trust in the IoT security market will grow even more.”