Embedded systems security

Embedded systems are the cornerstone of the technological architecture of modern society. They are present in every aspect of modern life. From the moment we wake up to the moment we go to bed (and even during the night), they accompany us on our journeys in vehicles or on public transport, in our leisure activities associated with connected objects, in our homes where home automation is becoming widespread to increase our comfort and limit our energy needs, in our consumer actions via our means of payment and, of course, in every facet of our professional activities. Beyond the individual, embedded systems are ultra-present in industry and its evolution (Industry 4.0), in the Internet of Things, in energy distribution, and in the defense and protection of nations. Given the importance of embedded systems in our society, it's easy to understand how critical their security is. But are they protected from all threats? On the contrary, except to a certain extent (systems for which security is a constraint by definition – for example, military and banking applications –), embedded systems are very much under threat, not only from software and network attacks (like all IT systems), but also from physical attacks targeting their electronic and microelectronic parts.

This article presents the main attack strategies targeting embedded systems and their software and hardware components. It also presents the main defense and protection strategies. Embedded systems are complex, combining advanced software functionalities, highly heterogeneous integrated hardware resources such as systems-on-a-chip and, increasingly often, communication capabilities. Protecting them is a delicate exercise, which cannot result in total security. Designers need to address all levels of design, and pay particular attention to safety at every stage. To achieve this, they need to be aware of the potential threats to the embedded systems they are developing, and to have an idea of the possibilities for protection, which is what this article proposes to address.