Practical Industrial Internet of Things Security

Securing secrets, or sealing

An endpoint may have a number of secrets, such as passwords, shared secrets, and data encryption keys. The disclosure of these keys to unauthorized parties could compromise the endpoint, and subsequently, the broader ecosystem of devices.

Secrets stored in the TPM can provide substantial protection against loss through physical, network, or software interfaces. However, the limited power of the TPM's crypto engine may impact signing throughput in scaled environments, especially for high-end endpoints, such as gateways, routers, and servers. A possible solution is to hold the keys at rest in the TPM's encrypted storage, but, when in use, release them for access to platform software, or perhaps a high-throughput ...