Mitigation-page

MID-068: Data Bus Encryption and Message Authentication

Mitigation Tier: Intermediate

Description

Applying cryptographic solutions to inter-chip and inter-peripheral data bus messaging can protect against data interception and modification. A message authentication code (MAC) scheme can be sufficient to protect the integrity of bus data from manipulation, but a more complete encryption scheme is required to maintain confidentiality. More complex chips (e.g., microcontrollers) will often be needed on either end of the communication that have specialized support for pairing, key management, message authentication codes, and encryption. Additionally, the extra overhead of adding encryption often requires migrating to newer, more capable bus protocols that support encryption, for examples CAN-FD vs. CAN [1]. On the higher end of performance, the PCI SIG is developing the Integrity and Data Encryption feature for inclusion in a future version of the PCIe bus specification [2].

Apple’s TouchID fingerprint authentication mechanism incorporates an example of this mitigation [3]. The device’s TouchID fingerprint sensor and the Secure Enclave chip are provisioned with a unique shared key at manufacturing time. This key is used to negotiate an additional session key that encrypts and authenticates the sensor data as it passes between the two chips.

Limitations: Many common PCB-level bus and interconnect protocols do not support encryption or authentication. Restricting a device design to components that do have these features may be a too limiting or too costly constraint. Device pairing and key management mechanisms and processes are necessary, add complexity to device design and manufacturing, especially to implement unique keys on each device (see MID-033).

IEC 62443 4-2 Mappings

  • CR 3.1 – Communication integrity - RE (1) Communication authentication

  • EDR / HDR / NDR 3.11 (1) - Physical tamper resistance and detection

References

[1] W. Busch. “Boosting security in cars with CAN-FD.” Avnet Silica. Accessed: Aug. 28, 2024. [Online]. Available: https://my.avnet.com/silica/resources/article/boosting-security-in-cars-with-can-fd/

[2] D. Harriman. “Integrity and Data Encryption (IDE) and IO Security Updates.” PCI SIG. Accessed: Aug. 28, 2024. [Online]. Available: https://pcisig.com/blog/integrity-and-data-encryption-ide-and-io-security-updates

[3] Apple. “Apple Platform Security.” apple.com. Accessed: Aug. 26, 2024. [Online]. Available: https://help.apple.com/pdf/security/en_US/apple-platform-security-guide.pdf