GlobalPlatform, the standard for secure digital services and devices, has published a new protection profile for Microcontroller Units (MCUs), to help IoT component and device manufacturers to build, certify and launch secure technologies and services.
The document is the latest update to GlobalPlatform’s Security Certification Programme and defines a set of security objectives and requirements for an MCU, to answer to a specific level of protection and robustness, so solution providers can effectively manage risk and demonstrate the trustworthiness of products, in line with regulations.
Adoption of MCU technology
Gil Bernabeu, Technical Director at GlobalPlatform, said “Adoption of MCU technology is growing rapidly in IoT, as device makers and solution providers seek out increasingly flexible solutions that can deliver a set level of security.”
Gil Bernabeu adds, “By aligning our protection profile with Common Criteria EAL2+, GlobalPlatform is making it easier for solution providers to evaluate the security services available on a device, to simplify the deployment of services.”
Simple framework for use of digital services
As the use of digital services continues to proliferate, the newly released PP will address the need for consistent and verifiable security. It offers a simple framework for:
- Security laboratories to evaluate the security of MCU-based products and validate conformance with security, regulatory and data protection mandates, such as the European Cybersecurity Act.
- Silicon and MCU vendors to demonstrate their products are secure for use, across all connected consumer device use cases and verticals.
- Device manufacturers to determine the trustworthiness of components and select a solution with the required features, to protect apps and digital services on their devices.
New protection profile
The new protection profile is a generalisation of GlobalPlatform’s current TEE protection profile
The new protection profile is a generalisation of GlobalPlatform’s current TEE protection profile, removing specific references to applications, to cover other software types, such as operating systems and virtual machines.
Additionally, other secure component technologies, such as Secure Elements and Trusted Execution Environments, can be added to an MCU, in order to meet the specific security needs of a device.
Addressing the need for rapidly changing IoT ecosystem
Gil Bernabeu further said, “In expanding our work to support the evaluation of MCUs, GlobalPlatform is responding to the needs of a rapidly changing IoT ecosystem, by offering a clear security benchmark against which manufacturers can build, labs can certify, and vendors can select devices.”
The MCU Protection Profile builds on 10 years of GlobalPlatform work on security evaluation and certification.
- Network / IP
- Electronic security systems
- Application security
- Physical security
- Commercial security
- Perimeter security
- Security management
- Security devices
- Security installation
- Security access systems
- Asset tracking
- Electronic access control
- Building security
- Facility security
- Network cameras
- Door access control
- Security software
- Security service
- Physical Security Information Management (PSIM)
- IP security solutions
- Security communication
- Integration software
- Perimeter protection
- Cyber security
- Mobile communications
- Internet of Things (IoT)
- Data Security
- Incident Management
- Security Assessments
- Cloud security
- Artificial intelligence (AI)
- Mobile access
- Machine Learning
- Touchless Security
