User Manual

SARA-R4 series-AT commands manual
UBX-17003787 - R16

20Device and data security
Page 230 of 401
20Device and data security
20.1Introduction
Nowadays the security is very important to secure personal or confidential data from unauthorized access and
therefore it is important to secure the IoT devices to protect the business and the data.
In the IoT security, a weak point is a defect which is called a vulnerability and it may become a safety issue; IoT
devices connects/links physical objects and so in IoT it is needed to secure of course data traffic and networks
but also the network of "things" or physical objects (i.e. medical devices, infrastructure, utility meters, vehicles,
etc.) must be secured.
Some definitions are needed to understand the foundations of security:
• Integrity is about making sure that some pieces of data have not been altered from some "reference
version".
• Authentication is about making sure that a given entity (with whom you are interacting) is who the user
believes it to be.
• Authenticity is a special case of integrity, where the "reference version" is defined as "whatever it was when
it was under control of a specific entity".
• Confidentiality means no unauthorized access to data (i.e. encryption/cryptography).
The u-blox security solution lets secure the IoT devices from end-to-end:
• Device security, the privacy of data is protected from the devices to the cloud (confidentiality, integrity and
authenticity).
• Data security, the devices are protected from attack, they can be trusted and controlled (identity,
authenticity and firmware protection).
• Access Management, it can be controlled who has access to data and products (device policies, data
policies and feature authorization)
The pillars of the u-blox security are:
• Unique device identity, an immutable chip ID and a robust Root-of-Trust (RoT) provides the foundational
security.
• Secure boot sequence and updates, only authenticated and authorized firmware and updates can run on
the device.
• Hardware-backed crypto functions, a Secure Client Library (SCL) generates keys and crypto functions to
securely connect to the cloud.
The IoT device is secured through different steps:
• Provision trust: insert Root-of-Trust at production. An immutable chip ID and hardware-based
Root-of-Trust provide foundational security and a unique device identity.
• Leverage trust: derive trusted keys. Secure libraries allow generation of hardware-backed crypto functions
and keys that securely connect to the cloud.
• Guarantee trust: use keys to secure any function. It ensures authenticity, integrity, and confidentiality to
maintain control of device and data.
20.2Device security
20.2.1Introduction
These AT commands maintain device integrity over the entire lifecycle.
• +USECCHIP queries the immutable chip ID.
• +USECDEVINFO allows customer programming the device profile UID into each device along with their own
device serial number.
• +USECROTUID queries the Root of Trust (RoT) public Unique IDentifier (UID).
SARA-R4
+USECOFF disables the secure data suite features on the module if it has not been sealed with the
+USECDEVINFO AT command.