Just to keep things interesting, we’re going to come at things from a slightly different direction to my usual columns. First, I’m going to tell you something you already know. Second, I’m going to tell you something of which you are probably aware. Third, once I’ve lulled you into a false sense of security, I’m going to surprise you with something new (be afraid, be very afraid).

Something You Already Know

Let’s start with the fact that there are a lot of “things” hanging of the end of the internet of things (IoT) at the edge where sensors and actuators and suchlike interface with the real world (assuming we aren’t all part of a Matrix-like simulation, in which case all bets are off and I’ll just keep on taking the pills, although I no longer recall which color is best).

How many things are we talking about? I no longer have a clue. One number that’s often bandied around is 50 billion devices by 2030. Meanwhile, Statista offers a slightly more modest prediction of 30 billion devices by 2030. Whichever of these numbers is closest to the mark, that’s a lot of devices, however you look at it.

The problem from a security point of view is that, unless protected, each of these devices offers a potential attack vector for ne’er-do-well hackers and nefarious nations. As reported in Forbes, a classic case we all recall from 2017 is when hackers compromised an IoT device used to remotely monitor and adjust the temperature and salinity in a fish tank that had recently been installed in a Casino. Via this device, the hackers gained access to the Casino’s network and managed to exfiltrate 10 gigabytes of data, including juicy tidbits of information on high-roller gamblers.

That was six years ago. A lot has changed since then, including the fact that our persons and our homes are becoming increasingly connected with things like wearable health monitors, camera-equipped voice assistants, Ring doorbells, video baby monitors, and Roomba floor-cleaning robots equipped with cameras that they use to help them create a floorplan. It’s not beyond the bounds of possibility that future high-tech burglars could compromise one or more of these devices and use the information thus gathered to decide who to steal from next.

As an aside, did you see my recent Cool Beans Blog Do Furbys + ChatGPT = AI Apocalypse? This torrid tale involves a programmer who augmented a Furby with speech recognition capabilities, hooked it up to ChatGPT, and posted the question: “Was there a secret plot from Furbies to take over the world?” The response from that cute little Furby’s mouth may well send shivers up and down your spine.

Something of Which You Are Probably Aware 

One “brick” in the foundation of a secure system is to be able to uniquely identify each and every device that has any sort of “intelligence” in the form of processing capabilities. This includes microprocessor units (MPUs), microcontroller units (MCUs), graphic processing units (GPUs), neural processing units (NPUs), field-programmable gate arrays (FPGAs), and system-on-chip (SoC) devices, to name but a few.

Another “brick” is the cryptographic keys that are used to implement encryption and decryption functions, along with digital signatures and certificates.

One of the problems associated with all of this is how to generate and load any unique identifiers and cryptographic keys into the device. If they start off outside the device, they are vulnerable to being stolen and/or cloned by the very people entrusted with their care. Even if they make it into the system untouched, any IDs and keys that are stored in the device are vulnerable to different forms of attack. What we need is some way for each chip to generate any IDs and keys “on the fly” as required.

All of this leads us to Intrinsic ID. Founded in 2008, Intrinsic ID has built an enviable reputation as the world leader in PUF (physical unclonable function, sometimes physically unclonable function) technology.

The idea here is that deep sub-micron variations in the production process give slightly random electrical properties to every transistor on a silicon chip. In the case of SRAMs, this randomness is expressed as the start-up values (0 or 1) in each of the SRAM cells.

These start-up values create a highly random yet repeatable pattern that is unique to each chip. The majority of the cells will power up the same way each time. Of course, some of the cells may power-up in either state depending on their mood of the moment. These cells may be affected by environmental conditions like temperature, and they may change their preferred power-up state over time as the device ages.

The folks at Intrinsic ID have come up with a way of “wrapping” an SRAM PUF with an error-correcting algorithm that results in an unchanging “silicon fingerprint” that can be used to build the foundation of a security subsystem. This PUF technology offers extreme reliability from -55°C to +150°C with a lifetime of 25+ years. As we see in this video, this includes using the PUF as part of a hardware root-of-trust (RoT); that is, a source that can always be trusted within a cryptographic system.

The end result is that devices equipped with Intrinsic ID’s IP offer the highest security in the industry. There are no keys “at rest,” the technology supports a Zero Trust supply chain, and it works with all foundries and process technologies (it’s been implemented in processes from 180nm down to 3nm) in standard silicon with no extra process steps required.

Keeping secrets safe (Source: Intrinsic ID)

In many ways, the results speak for themselves. Intrinsic ID has a solid patent portfolio in PUF technology, and its IP already serves multiple markets. In addition to the IoT, Intrinsic ID’s technology is found in datacenters and high-performance computing (HPC) facilities, in aerospace and defense, and in any application that demands secure transactions.

With 100+ design wins, 10+ global certification and government program wins, and four out of the top five MCU vendors as customers, Intrinsic ID’s IP can boast more than 500+ million deployments in the field.

Wait! What? Why so few?

On the one hand, 500+ million deployments are nothing to be sniffed at (we should all be so lucky as to create something so prolific). On the other hand, 500+ million is but a drop in the bucket when we consider how many IoT devices are already roaming the world, and how many we expect to join them in the not-so-distant future.

So, what’s the problem? Well, as wonderful as Intrinsic ID’s technology is, thus far it’s been realized in the form of hardware IP. This has meant that the creators of MCUs, FPGAs, SoCs, etc. have had to instantiate the PUF as an additional block of IP. Also, that all the processing (key generation, etc.) has been implemented in hardware. This has proved to be a fly in the soup or an elephant in the room for a lot of players (I never metaphor I didn’t like).

Something New to Surprise You

I feel a bit like the proverbial “iron hand in a velvet glove”; first I brag on the wonders of Intrinsic ID’s technology, and then I pull the rug out from under my own feet. But wait, there’s more, because “I come to praise the folks at Intrinsic ID, not to bury them” (with apologies to the Bard of Avon).

I was just chatting to Pim Tuyls, who is the Founder of, and CEO at, Intrinsic ID. As part of our conversation, Pim explained how Intrinsic ID unveiled something new at the recent Embedded World Conference and Exhibition, which was held 14-16 March 2023.

Pim started by noting that billions of devices need an unclonable identity, trillions of cryptographic keys need to be stored securely, and trillions of connections between connected devices need to be authenticated. The trick, of course, is coming up with a solution to establish and scale robust security.

This is the point where we can all break out our party hats, because such a solution has arrived in the form of Intrinsic ID’s new Zign X00 series of software products, which can be deployed in every digital device that offers processing capabilities (MCUs, FPGAs, SoCs, etc.) under the sun. This includes devices that have already been built and systems that have already been deployed.

The idea here is that every digital device that offers processing capabilities already has some amount of SRAM. All that is required is to set a small amount (1KB) of this SRAM aside to be used as the device’s PUF. All of the other functions are realized in software code rather than hardware logic gates.

The software is created in C that will run on any CPU—it doesn’t matter if the CPU is Arm, ARC, MIPS, RISC-V, X86, Xtensa, or whatever. Whichever CPU you are using, the software (leveraging the SRAM PUF) will provide you with all the security features you need, from random number generation, key generation, key management, encrypting other secrets on the device, encrypting and decrypting communications, authentication, and full public key cryptographic activities like setting up shared keys and creating signatures.

This software is delivered in the form of a compiled library (along with API specifications and a user manual) targeted at the CPU of your choice. Your application makes API calls into this library to access the required functions. If you wish to use existing hardware accelerators on your device for tasks like encryption and decryption, then the software includes interfaces that let you configure and connect to said accelerators.

There are currently three members in the Zign X00 Series: the Zign 100, 200, and 300, with Flash memory footprints ranging from 7KB to 30KB, depending on the member and options selected.

The Zign 100 API enables IoT developers to generate unique device identities, secure cryptographic keys, and random values. It enables easy and collision-free identification of billions of devices from various vendors. Zign 100 can also be integrated as a hardware-based trust anchor for Mbed TLS, OpenSSL, wolfSSL, and other libraries, extending the chain of trust beyond just a single device.

The Zign 200 is a secure key generation, management, and storage solution for any IoT device. Zign 200 offers functions to wrap and manage secret keys and encrypt data, which can then be stored in unprotected memory or can be securely transmitted over the network. Zign 200 also offers random values, generated by a NIST 800-90A/B-compliant random number generator and a collision-free unique device identity.

The Zign 300 is the Crème de la crème. To solve security problems in IoT systems, such as authentication, product lifecycle management, reverse engineering and cloning, every device needs an unclonable identity. This consists of a secret key, a public key and a certificate. The biggest challenge is to get these credentials into the device and keep the secret key secret. This can be achieved using Zign 300, which offers the strongest protection of the device secret key and the strongest authentication via unclonable identities. Zign 300 offers all the features of Zign 200. In addition, Zign 300 offers asymmetric cryptography: public key crypto functions such as ECDSA sign and verify, and ECDH shared secret. Public key infrastructure (PKI) elements, such as ECIES and certificate signing request (CSR) are optional.

All of the Zign X00 solutions are post-quantum secure!

I think that’s worth saying twice (and loudly)…

ALL OF THE ZIGN X100 SOLUTIONS ARE POST QUANTUM SECURE!

Security is a complex topic. It makes my head hurt. I used to enjoy the old days when all we had to do was to create cunning applications that made people gasp “Ooh” and “Aah.” I feel sorry for today’s developers who must meander their way through the security morass on top of everything else they have to do. I also feel sad for the device manufacturers who have to add additional functions to their components, and for system architects who are prevented from using their desired processing devices due to the lack of aforementioned security features.

The lads and lasses at Intrinsic ID have addressed all these problems in a single stroke. They’ve made it orders of magnitude easier to implement security for the 21st Century (did I mention that these solutions are post-quantum secure?), even with existing processing devices like low-end MCUs and currently deployed SoCs that don’t have any security features implemented in hardware.

Personally, I think this is an awesome solution and I believe Intrinsic ID is poised to take the world of security by storm. From 500+ million deployments of their hardware IP today, I expect to see billions of deployments of their software IP in the not-so-distant future. How about you? Do you have any thoughts you’d care to share on this topic?

• 
• 
• 
• 
•