Microchip introduces an end-to-end LoRa security solution with security key configuration

     Microchip and The Things Industries are launching the industry's first end-to-end security solution to provide secure, trusted and managed authentication for LoRaWAN devices worldwide. The solution combines any MCUS and RF compatible ATECC608A-MAHTN-T CryptoAuthentication devices with The Things Industries' managed connectivity servers and Microchip's security configuration services. Hardware-based security for the LoRa ecosystem.

     As the LoRa (Long distance) technology ecosystem accelerates, network and application server keys in modules and MCU memory paired with the LoRaWAN protocol stack are highly vulnerable due to vulnerabilities, so security remains an urgent issue. Once a hacker has access to a key through a LoRaWAN device, he or she can impersonate the key owner and authorize fraudulent transactions, resulting in massive attacks that can result in significant losses in business revenue and brand equity, as well as significant recovery costs.

     The joint solution significantly simplifies the configuration of LoRaWAN devices and, from the outset, solves the logistical problems associated with managing LoRaWAN authentication keys throughout the device's lifecycle. Traditionally, because LoRaWAN devices are installed on-site throughout the supply chain, network and application server keys at edge nodes are left unprotected and unmonitored. Rated as "high" security by the Joint Interpretation Library of Common Standards (JIL), the ATECC608A is pre-configured with a secure key memory that isolates a device's LoRaWAN key from the system, ensuring that confidential keys remain secure throughout the supply chain, even when the device is deployed.

     Microchip's secure manufacturing facility securely configures keys to eliminate the risk of leakage during production. Combined with The Things Industries' unlimited Secure Connection server service for LoRaWAN networks and application server vendors, the solution establishes trusted authentication when a device connects to a network, reducing the risk of device identity corruption.

     The ATECC608A has no limitations and can be paired with any MCU and LoRa RF. Developers can deploy secure LoRaWAN devices by combining the ATECC608A with the SAM L21 MCU supported by Arm Mbed OS LoRaWAN protocol stack or the recently released SAM R34 system-level package with Microchip's LoRaWAN protocol stack. To build a prototype quickly, Designers can use The CryptoAutho XPRO connector board and The Things in SAM L21 Xplained Pro (atsamd21-xpro) or SAM R34 Xplained Pro (DM320111) Device sample for Industries configuration.

     Similar to prepaid plans for mobile devices, each ATECC608A-MAHTN-T device purchased will come with a one-year LoRaWAN hosted connection server service from The Things Industries. When a device confirms that it has joined The LoRaWAN network, the network connects to The Things Industries connection server to verify that the identity is from a trusted device. The temporary session key is then securely sent to the selected network server and application server. From commercially operated networks to private networks based on open source components, The Things Industries connection servers support any LoRaWAN network. After one year of service expires, The Things Industries will give users the option to extend the service.

     "Hardware-based security is critical for today's connected applications," said Nuri Dagdeviren, Microchip's vice president of Security Products. "The ATECC608A adds a trusted hardware root to the LoRa ecosystem that establishes trusted authentication when a device connects to the cloud, similar to the SIM card that authenticates mobile phone users by securely storing their International Mobile Identification Number and associated keys."

     Microchip is also working with The Things Industries to enable LoRaWAN devices securely and seamlessly. LoRaWAN device identifiers are recognized by The Things Industries' connected servers, minimizing human intervention and eliminating the need for developers to have expertise in security. Users can not only select any LoRaWAN network, but also migrate to any other LoRaWAN connection server by regenerating the device key. As a result, users do not have to rely on one vendor and have full control over where and how their device keys are stored.

     JohanStokking, CTO of The Things Industries, said: "The rapidly growing LoRaWAN market requires an efficient and secure system that increases security while reducing equipment configuration time. We are very excited to partner with Microchip to make this possible for devices in our global network."