Hello! My name is Tim Stapko. I'm a Senior Software Engineer at Microsoft.
I work on Azure RTOS and other microcontroller things.
Today we are going to be talking about
the offering that we built along with ST Microelectronics
It's based on the ST U5
which is a new ultra low power microcontroller device
that's designed specifically for IoT
We're going to be talking about the security
and RTOS applications that can be built
using that device
Before we dig in to the specifics
of the hardware and software
We'll get a sort of overview here of
of how all this fits together.
The ST U5
is the new microcontroller device based on an ARM cortex M 33
and in this scenario, it's going to be running Azure RTOS
which includes real time operating system,
connectivity stack
and it's also going to be running the Azure IoT device's SDK
which enables the connectivity and
features that you can leverage
using the Azure IoT cloud services
All of this is tied together by
Azure IoT Central
which enables you to develop applications to visualize
your data and control your fleet of devices
So looking at the hardware first
this is the STM32U5.
It is a microcontroller device with enhanced security features
Based on an ARM Cortex M-33 with TrustZone
It has a built-in cryptographic acceleration for AES, ECC, and hashing
It has a hardware unique key for data protection
It has some hardware tamper detection monitoring
and the hardware itself is actually certified
both by PSA which is ARM's security certification
and SESIP.
Paired with the U5 on the discovery kit device
is the STSafe A110
hardware security module
that enables a true hardware root of trust.
It has a pairing key, full bus encryption
to protect data physically on the device
It's got cryptographic acceleration and
handling in hardware to protect your private keys
It's got protected memory so your key data never actually leaves the hardware
Most importantly for IoT
it has a factory installed X.509 device certificate
which can be utilized by IoT Hub and Azure
to uniquely identify your device in the cloud
So digging in to the security features of the U5
we have TrustZone
TrustZone is an ARM technology which is essentially a secure partitioning scheme
It allows for hardware enforced boundaries
between your secure and non-secure applications
it enhances the security of other features such as monitoring
of peripherals, monitoring of the device, hardware drivers, etc.
TrustZone by itself is just partitioning scheme so you need
some way to be able to utilize those services effectively
TFM is a reference implementation
of ARM's PSA API's
and essentially provides a secure kernel
for microcontroller devices
It enables such services as cryptography, root of trust, protected storage
firmware update, secure boot
and specifically, on the U5
the implementation of TFM that ST provides
also integrates with that STSafe hardware security module so that you have that true hardware root of trust
So now digging into the Azure RTOS security features
as mentioned before, Azure RTOS is a complete
microcontroller stack with a real time operating system called ThreadX
a TCP\IP stack called NetX Duo.
Running on top of NetX Duo is NetX Duo Secure TLS
which is a complete TLS stack with cryptography library.
The cryptography library is both
software implementations of popular algorithms
but also there's an abstraction layer that
enables us to integrate with TFM and STSafe part
on the U5 device
enabling us to tap into that hardware security that we were just discussing.
Writing on top of TLS is the NetX Duo MQTT client
and the embedded C IoT SDKs
from Microsoft that enable you to connect to
Azure Cloud services, specifically the IoT endpoints
and also enables, there's a couple of different lightweight agents for
device update
and Azure defender, which we are going to talk about in a moment.
So now you have your device all set up and ready to go and
you want to connect it to Azure and do some cloud things.
To connect a microcontroller to Azure, you're going to be using Azure IoT Hub
By itself, IoT hub has support for
some basic security. It utilizes TLS
You can use a SAS token, which is essentially a pre-shared key
or you can use a certificate.
Now in our case, with the U5,
we can utilize that
X.509 certificate that is baked into the STSafe device from the factory
with a private key that is never exposed anywhere. You have that true hardware root of trust.
and you're going to be able to connect that
microcontroller running Azure RTOS
through Azure Provisioning service to Azure IoT Hub.
DPS is going to enable you to assign
your devices to specific hubs and do a few other things
And then hub itself is going to enable you to
actually, collect telemetry and do control plane operations for your fleet of devices
Additionally, Azure Defender for IoT framework is running
in tandem with IoT Hub
and utilizing the agent that is within
the Azure RTOS stack that is running on your microcontroller
All of this is integrated together to enable you to securely connect
your U5 application to Azure
collect telemetry, send control data, update the firmware
anything else you might want to do for an IoT type device.
Okay! Now that we have seen the full stack from end to end
we're going to take a look at the actual hardware here.
So what we've got here is an end to end IoT Solution
utilizing the U5 hardware and Azure RTOS
The kit itself enables you to easily connect
your device through to IoT Central
where you're going to be able to visualize real sensor data
coming from the device and
it's going to be secured using TFM and Azure RTOS security features we talked about
With Azure IoT Plug and Play, your U5 device is already modeled
and be recognized by Azure when it connects
So all of your sensor data will be easily picked up
and will allow you to build your application very rapidly
within IoT Central to visualize that data
You can get started with the U5 today.
First of all you're going to need to get your hardware.
Then you're going to need to configure and build the app that's going to go on to your device
You're going to need to create a free IoT Central application
and Boom!
Your data will be visualized
All of this is done through the quick connect guide that comes with the kit
And there's a script that is basically no code / low touch
You're going to have to enter a few things like Wifi Credentials
but in a few easy steps
you'll be up and running with your IoT Central Application.
Thank you for listening!