Chip Security Becomes a Hot Topic in the Electronics Supply Chain
by 
Avnet's Pascal Fernandez, vice president, Velocity EMEA
Users and consumers are beginning to see the types of gadgets that will eventually comprise the Internet of Things (IoT). What many can’t yet visualize are the unseen parts of the IoT – the software and services that ultimately are going to determine whether the IoT becomes as ubiquitous and conventional as cellular technology.
“Services are going to make the difference in the IoT market — some companies are even considering giving the hardware away for free and that will give them an entry point [into the market],” said Pascal Fernandez, vice president of Avnet Velocity, EMEA, a business unit of Avnet Inc. “Competitiveness no longer depends on the cost of the hardware but also the enabling of the hardware which is really exciting. The reason we think we are at the center of the IoT is we are connecting the dots of the technology on one side and hardware on the other, from sensors to servers.”
Avnet, a global electronics distribution company, spans the hardware, software and service businesses. In hardware, Avnet’s primary businesses are electronic components and enterprise computing equipment. Over the years, both suppliers to and customers of electronics distributors have demanded more of their channel partners. Avnet has expanded into services that support both these constituents. The distributor now provides product design and integration services; hardware and software configuration; logistics and reverse logistics and more recently what Avnet calls “the Supply Chain of Things.”
“We have the technologies and the products such as sensors; we have solutions in servers and the cloud; we can connect the components to the products and get the products to connect through software and the enterprise platform and also to cloud services,” said Fernandez. He describes the IoT as an ecosystem in which distributors are best suited to orchestrate the supply chain.
At the most basic level an electronic product requires the selection and configuration of a number of components that operate the device. Distributors, which carry hundreds of component brands, mix, match and deliver these products to end customers. Many customers entering the IoT have nothing but an idea to start with, Fernandez explained. That’s where distribution comes in.
“In many cases we know we need to invent the supply chain for these customers,” he said. “These are companies without a supply chain — they are start-ups, or they are entering electronics from another market — so we have to define the supply chain and make sure it is a trustworthy and secure supply chain.”
For many of these companies, Fernandez said, their “secret sauce” is the IP behind the gadget they develop. “The IP is the customer has an idea — it could be based on a sensor only or some software only; then the question becomes who has the parts, who has the inventory and how do I secure [the idea]?” Security, he explains, can mean licensing a company to design and manufacture the products or developing Web-enabled solutions to control third party access to sensitive information.
“For the IP owner the issue is control: for us, we provide the tools and services to enable the people who have access to the IP or to grant access. So the license includes an arrangement of products and pricing; we give the customer visibility and control and we can help though our Web-based technology and make sure the information only goes to who has permission to access that information. We manage the physical flow and the programming of the products and give visibility of the IP only those who need it.”
As component profit margins have eroded over the years, distributors have turned to services to boost revenue. For decades, distributors – not suppliers – have provided programming services for chips such as FPGAs. Avnet has recently dipped its toes into chip design. “We have been working in Europe to develop secure chips that enable communication between the IoT object and the server, and between the object and the consumer,” Fernandez said.
The “no-man’s land” between connected devices remains a primary concern for vendors and users. If a consumer is connected to the smart grid, for example, that consumer’s security practices could impact the grid and its user base. Consumer trade associations, Fernandez explains, are trying to work around the data access and privacy issues associated with the IoT. This will be a growing concern.
“If my device is connected, how do we make sure it is secure? “ he said. “All those things are becoming a problem. There is also concern about the signal chain and how you secure your signal chain. So putting ‘keys’ into the communications is one way —there could be a web key for your Wi-Fi box; that is as secure as a two-PIN code and it is easy to forget or to crack — so there has to be more than one option,” he explained.
“In Europe an option is to put in a secure chip with the same level of encryption as a credit card; and within the ecosystem you have the ability to program [the chip] and track the chain through the chip,” Fernandez said. “You can unlock, program, unlock and transport the device to the customer, and then the chip is unlocked remotely. That is the type of technology [we are developing].”
Avnet is working in partnership with Morpho (Safran Group) for the secure element and Trusted Object for the software. Avnet’s logistics services will be generating the private/public keys compliant with the EMVco security specifications. This is in a way the IoT version of what SIM cards are in mobile communications, Fernandez explained.
“This IoT expansion is coming with some formidable challenges,” Fernandez added. “The supply chain is one of these. This will be equally as important as the ‘things’ themselves — the big issues are IP protection and data protection. That’s incredibly important for anyone that is entering the IoT world.”
Since distributors serve numerous customers that directly compete with one another, the channel is accustomed to strict privacy practices. “We are adaptable to what these [emerging] companies want, whether they want to control everything or outsource some functions,” Fernandez said. “It differs from customer to customer. We can help with design; we can assist at the board level; we can take on a project or work with an EMS partner. We can manage a customer’s physical flow of goods to the EMS and then we can finish the product and drop ship it to the customer. We can provide end-to-end support.”
Related posts
