Securing the IoT to empower trust in a digital world

Connected devices make our lives easier and more efficient. But with great connectivity comes great responsibility. As smart devices handle our personal data, manage our work, and even drive our cars, they may open the door to security risks. And now, with AI becoming a bigger part of our lives, security is more crucial than ever.

With or without Secure Element - we make the choice easy

We understand that every use case has its own requirements. This is why we have designed Infineon Edge Protect to meet your unique security needs. It integrates leading security hardened and connected microcontrollers (MCU) from our PSOC™ and AIROC™ families, as well as discrete Secure Elements (dSE) from our OPTIGA™ and SECORA™ portfolios. Our hardware offering comes in combination with comprehensive security services such as cloud onboarding and late-stage provisioning.

Every device needs some type of MCU/MPU, but when should you extend your system with a discrete Secure Element? With Infineon Edge Protect we make it easy to choose the best fitting PSOC™ microcontrollers and to know when adding a discrete Secure Element can bring additional value.

Unlock the benefits of Edge Protect:

1. Stay compliant with evolving regulations such as the Cyber Resilience Act (CRA)
2. Enhance interoperability across your systems
3. Gain a competitive edge and boost brand trust
4. Future-proof your products
5. Add value with NFC, payment, and late-stage provisioning capabilities
6. Reduce costs and minimize liability risks

MCU with or without Secure Element

With the reference table, you can easily find out when a microcontroller on its own is a good match for your application and when you can gain an additional advantage by adding a discrete Secure Element. Our PSOC™ & AIROC™ microcontrollers offer robust security features, while our OPTIGA™ and SECORA™ discrete Secure Elements work in tandem with each PSOC™ to add value such as simplified manufacturing, improved efficiency, and long-term cost saving.

The table is divided into four Infineon Edge Protect categories (EPC) for simplified guidance.

  • Edge Protect Category 1
    Supports CRA and RED, PSA L1v2
  • Edge Protect Category 2
    Supports SESIP/PSA Level 2
  • Edge Protect Category 3
    Supports SESIP/PSA Level 3
  • Edge Protect Category 4
    Supports SESIP/PSA Level 3 + Secure Enclave
infin-promopage-grafik-edge-protect
infin-promopage-grafik-edge-protect
infin-promopage-grafik-edge-protect

Solving the most common security pain points

Customer pain points
 
  • In-house or in-the-field provisioning: In-house or in-the-field provisioning requires significant setup costs and specialized know-how, straining resources and budgets.
  • Late-stage provisioning challenges: Provisioning devices at a late stage in the production process or in the field often poses significant logistical and security challenges.
  • Protecting provisioning credentials: Ensuring the secured storage and management of provisioning credentials, both in the factory and in the field, is a critical concern to prevent unauthorized access and device cloning.
Necessary features
 
  • Secured credential storage: Secured storage of provisioning credentials for late-state provisioning, protecting the integrity and confidentiality of sensitive information.
  • Plug-and-play provisioning: Offering a plug-and-play provisioning solution, simplifying the process and reducing the need for specialized know-how.
  • Cloud-based in-field provisioning: Providing a cloud-based system for in-the-field provisioning, enabling secured and efficient provisioning of devices at any stage.
  • Cost-effective scalability: Delivering a cost-effective solution that scales with the needs of the business, minimizing costs and maximizing efficiency.
#
#
#

Example of a solution for smart home

Secured integration with OPTIGA™ Trust M Matter
 
  • Easy to add Matter compatibility while keeping your existing design
  • Flexibility add the DACs until the start of production and to create multiple product variants that can be released on the market quickly
  • Matter certified with a Matter Attestation Certificate issued by our partner Kudelski IoT and approved by the CSA
  • Common Criteria EAL6+ (high) certified hardware
Customer pain points
 
  • Unauthorized excess production: Contract manufacturers produce excess devices without permission, selling them into the grey market as "authentic" products.
  • Tampered firmware, software, and configurations: Devices are altered before reaching the end customer, with changes to firmware, software, or configurations that can compromise security and functionality.
  • Component fraud: High-value components, such as CPUs, GPUs, SSDs, and RAM, are replaced with cheaper alternatives, compromising device performance and reliability.
Necessary features
 
  • Secured pre-provisioning: Pre-provisioning of certificates, keys, and device IDs in a secured environment, ensuring the integrity of devices from the start.
  • Unique endorsement certificates: Provisioning of unique endorsement certificates in a certified environment, starting at the wafer level, to protect authenticity and trust.
  • Immutable chip-ID: Ability to read out an immutable chip-ID, providing a secured and unique identifier for each device.
#
#
#

Example of a solution for securing the supply chain

OPTIGA™ Trust M Express: the easiest way to securely deploy your IoT devices to the cloud - at scale

Key features

  • Secured pre-provisioning of certificates, keys, and device IDs in a certified environment
  • Provisioning of unique endorsement certificates at the wafer level
  • Immutable chip-ID for secured and unique device identification

 

Benefits

  • Automated cloud onboarding
  • Simplified Device Customization
  • Only Authenticated Devices attach to Product Cloud

Customer pain points

  • Brand damage and liability: Clones can have safety issues, performance problems, or security breaches, resulting in costly recalls, lawsuits, and reputational harm.
  • Device bricking: Lost or stolen devices must not be usable, even if they are original, to prevent unauthorized access and protect sensitive data.
  • Refill fraud: Refilled or tampered consumables must be detected in the device, to maintain the quality of the output.
  • Consumable counterfeiting: Counterfeit consumables, must not be usable in the device, preventing revenue loss and ensuring the quality of the output.

Necessary features

  • Device blacklisting: Ability to blacklist devices when they are lost or stolen, preventing unauthorized access and use.
  • Reverse engineering protection: Advanced security features that make reverse engineering significantly more complex.
  • Cloud-based device activation: Cloud features for device activation and late provisioning so only authorized devices can be activated and used.
  • Protected device identifier and authentication: Mechanisms that give each device a unique identity so it can be authenticated securely.
  • Secured certificate-based authentication: A valid certificate and one-way authentication are required to include the device into the target system, with the authentication secret key stored and processed only in the Secure Element (SE).
edge
edge
edge

Example of a solution for protection against cloning

OPTIGA™ Authenticate S is a full turnkey solution that gives things a unique identity to verify their authenticity and to protect brands and their customers from counterfeits.

How it works

  • Secured production
  • Enabling tamper protection
  • Secured implementation, storage and calculation
  • Tracking of the value chain in a non-certified environment
  • Reducing complexity and therefore time to market

Advantages of authentication

  • 16 customization options
  • Effortless implementation - full system integration support including embedded software, host software and advanced ecosystem support tools
  • Freedom to design - tiny package of 1.5 mm² optimized for even the smallest devices
  • Security to rely on

Why OPTIGA™ Authenticate S

  • 16 customization options
  • Effortless implementation - full system integration support including embedded software, host software and advanced ecosystem support tools
  • Freedom to design - tiny package of 1.5 mm² optimized for even the smallest devices
  • Security to rely on

Customer pain points

  • Vendor lock-in: MCU security features are often vendor-specific, limiting flexibility and making it difficult to switch to a different MCU or vendor.
  • Inflexibility for future capabilities: Devices are not flexible enough to accommodate new future capabilities, such as AI or low power requirements, making it difficult to adapt to changing market needs.
  • Balancing security and MCU evolution: Security requirements need to be stable and well-tested, but MCU requirements are constantly changing, making it challenging to balance security with the need for innovation and adaptation.

Necessary features

  • Plug-and-play security: Adding a Secure Element (SE) to the device for encapsulated security implementation and help to retain the same security system architecture and flexibility.
  • Host library for MCU: For interaction with the SE is required, providing a standardized interface for communication and ensuring seamless integration.
  • Scalable security: SE provides scalable security, enabling the implementation of different security levels and features depending on the specific device requirements.
  • Future-proof security: The SE provides future-proof security, allowing for easy integration of new security features and algorithms as they become available.
  • Standardized APIs: For easy integration with different MCUs and devices and to maintain the targeted security level.
#
#
#

Example of a solution for protection against cloning

OPTIGA™ TPM provides maximum flexibility and no vendor lock-in with thanks to a standardized API.

Infineon’s OPTIGA™ TPM is certified for conformance with published TCG specifications with greater interoperability & flexibility

We produce high quality TPM products with various customization options and proven track record of more than 20 years.

Customer pain points

  • Navigating evolving cybersecurity regulations: Staying up-to-date with changing cybersecurity legislation and standards across different regions.
  • Managing security requirements complexity: Understanding and fulfilling intricate security requirements, which demands significant resources and expertise.
  • Designing future-proof secured products: Creating products that adapt to emerging threats and evolving security standards, maintaining customer trust and brand reputation.

Necessary features

  • Streamlined system certification with comprehensive support: We provide all necessary documentation, reports, and support to simplify the system certification process, saving you time and resources.
  • Expert design-in support for certification success: Our dedicated team provides guidance and support throughout the design-in process, ensuring a smooth and successful certification journey for your products.
  • Simplified compliance with plug-and-play security: Easily integrate our Secure Element into your system for compliance with current and future legislation, without requiring extensive security expertise.
edge
edge
edge

Example of a solution for compliance with regulations

SECORA™ Pay W: Best-in-class contactless performance enables the integration of payment functions in a wide variety of items.

  • Flexible, one-stop-shop solution combining innovative technology with extensive services and design-in support
  • Simple and fast integration of contactless payment functionality into innovative form factors
  • Pre-certified by Visa and Mastercard and ready for implementation into innovative form factors
  • Optimized for battery-less, passive wearables or payment accessories (key fobs, wristbands, bracelets, etc.)
  • Based on SPA (Smart Payment Accessory) and can be integrated into almost every material

Customer pain point

  • End-of-life management: Managing the end-of-life of microcontrollers, to take care that they are securely decommissioned and that any sensitive data is erased.
  • Secured field return analysis: Products may fail in the field due to various circumstances and methods are required to enable their analysis without compromising security.

Necessary features

  • Hardware-based Root of Trust: A hardware-based root of trust provides a secured foundation for the boot process.
  • Secure Boot mechanism: A Secure Boot mechanism prevents unauthorized firmware from being executed, preventing unauthorized access to the device.
  • Digital signature verification: Digital signature verification capabilities allow for secured firmware authentication and validation.
  • Secured key storage: Secure key storage protects cryptographic keys and prevents unauthorized access to sensitive data.
#

AN237324 PSOC™ 64 RMA mode for field failure analysis describes how to enable failure analysis.
#

AN237324 PSOC™ 64 RMA mode for field failure analysis describes how to enable failure analysis.
#

AN237324 PSOC™ 64 RMA mode for field failure analysis describes how to enable failure analysis.

Example of a solution for lifecycle management: RMA

In the event of a device failure or need for evaluation, a secured Return Merchandise Authorization (RMA) process is crucial to protect the integrity of your PSOC™ 64 MCU.

As a critical stage in the device lifecycle, RMA requires robust security measures to prevent unauthorized access, tampering, or theft of sensitive information.

By relying on the PSOC™ 64 secure RMA process you can:

  • Prevent unauthorized access to sensitive data and intellectual property
  • Protect the authenticity and integrity of returned devices
  • Maintain compliance with industry regulations and standards
  • Protect your brand reputation and customer trust

Customer pain point

  • Unauthorized software execution: Preventing unauthorized software from running on the device, to take care that only trusted and validated code is executed.
  • Counterfeit firmware: Preventing counterfeit firmware from being installed on the device, to take care that only genuine and authorized firmware is used.
  • Lack of visibility into running software: When it's unclear what software is running on a device, it becomes difficult to take care that only authorized software is executed and to detect potential security threats.

Necessary features

  • Hardware-based Root of Trust: A hardware-based root of trust provides a secured foundation for the boot process.
  • Secure Boot mechanism: A Secure Boot mechanism ensures only authorized firmware is executed, preventing unauthorized access to the device.
  • Digital signature verification: Digital signature verification capabilities allow for secure firmware authentication and validation.
  • Secured key storage: Secure key storage protects cryptographic keys and prevents unauthorized access to sensitive data.
#
#
#

Example of a solution for Secure Boot

Infineon’s wide range of MCUs like PSOC™ support Secure Boot

Unlock the power of Secure Boot with our cutting-edge prototyping kit, designed to empower customers in implementing ironclad security measures with ease and efficiency. This comprehensive solution provides a seamless way to develop, test, and deploy Secure Boot solutions that meet highest standards of security and integrity.

Customer pain point

  • IP theft: Preventing competitors and sub-contractors from stealing intellectual property (IP) from a device, to maintain a competitive advantage
  • Code protection: Protecting code from being readable from the device, to prevent reverse engineering and IP theft
  • Secure Updates: Enabling Secure Updates to the device, while preventing unauthorized access to IP
  • Protection of investments: Protecting investments in software, algorithms, and other IP developments, to maintain a competitive edge

Necessary features

  • Code and data protection: Read-out protection to prevent unauthorized access to code and data, taking care that sensitive information remains confidential
  • Secure Updates: Encrypted updates to prevent tampering and protect authenticity, taking care that only authorized updates are applied to the device
  • External storage protection: Authenticated encryption of external storage devices to prevent data theft and tampering, protecting sensitive data even when stored outside the device
  • Debug interface protection: Protection and locking of debug interfaces and modes to prevent unauthorized access and IP theft, preventing attackers from exploiting debug interfaces to steal IP
  • Logical attack protection: Protection against logical attacks, such as fault injection and side-channel attacks, to prevent IP theft and data breaches, protecting the device against these advanced attacks
#
#
#

Example of a solution for IP protection

Secured edge computing with PSOC™ Edge product family

Infineon's new PSOC Edge E8x MCU product family is designed to provide robust embedded security for Internet of Things (IoT) applications. The family has achieved the highest level of certification, PSA Certified Level 4, which ensures a hardware-isolated enclave on the chip for secure boot, key storage, and cryptographic operations.

The PSOC™ Edge product family addresses IP protection and Secure Update through its hardware-based security features. The devices feature protected crypto algorithms that can be used to encrypt critical IP, protecting sensitive information.

Customer pain point

  • Unintended device manipulation: Preventing firmware updates from being used for unintended device manipulation, such as malware injection or data theft.
  • Scalable security: Taking care that unintended manipulation of devices is not scalable, to prevent widespread security breaches.
  • Complex update process: Simplifying the complex process of firmware updates in the field, including key management and secure authentication.
  • IP protection: Protecting intellectual property (IP) in firmware updates, to prevent theft and reverse engineering.
  • Legacy device support: Easily extending legacy devices without sufficient resources, to provide continued security and support.

Necessary features

  • Secured communication: Secured communication to a service, either over-the-air (OTA) or wired, to prevent eavesdropping and tampering.
  • Integrity check: Integrity check on the device, using digital signatures, to take care that firmware updates are authentic and unmodified.
  • Encryption: Encryption of firmware updates to prevent unauthorized access and provide confidentiality.
  • Cloud service: Cloud service, including key management, to simplify and secure the firmware update process.
  • Device identification & authentication: To check that firmware updates are sent to the correct device and to prevent unauthorized access.
#
#
#

Example of a solution for software protection

With ModusToolbox™ for Security offers a comprehensive ecosystem of tools, middleware, libraries, code examples, user guides and application notes to facilitate the implementation of secured embedded systems.

Device firmware update

Middleware for connected and over-the-air (OTA) updates of its MCU lines. This supports connected serial interfaces as well as Wi-Fi and Bluetooth® and is complemented by a PC-based Host Tool. With the source code available, it can be adapted to specific customer requirements.

Customer pain point

  • Balancing security and cost: Finding the right fit of security level with the best price point, to allow that security needs are met without breaking the bank.
  • Meeting must-have security needs: Meeting minimum price points that can fulfill must-have security and feature needs, without sacrificing security or functionality.
  • Limited security options: Only high-end MCUs with high prices have integrated security features, making it difficult to find a cost-effective solution that meets security needs.
  • Complexity of security implementation: Implementing security features is complex and time-consuming, requiring significant expertise and resources.

Necessary features

  • Low-cost security add-on: Lowest add-on in price to add security to the system, making it easy to integrate security without breaking the bank.
  • Modular security architecture: Enable separation of the MCU functions from the security functions to gain a simple, scalable system with low price overall, allowing for easy integration and customization.
  • Integrated security for high-end MCUs: Integrated security features in high-end SoCs, providing a comprehensive and robust security solution for demanding applications.
  • Plug-and-play security: Adding security features must be easy to do, with a plug-and-play approach that simplifies integration and reduces development time.
#
#
#

Example of a solution for providing flexibility

With EPC we provide the flexibility to optimize the cost position overall by combining various MCUs with SE features to best address customer needs.

EPC allows to rely on IFX provided solutions (e.g., PSA Level 3) but also enables the customer to build cost efficient systems by adding a discrete Secure Element.

Get started with Infineon Edge Protect today

Do you have questions or need expert guidance on integrating our security solutions into your design? Our team is here to help. Reach out to us to discuss your project and let us support you in bringing your vision to life.

Stay informed, stay ahead

Stay up-to-date on the latest security trends, product releases, and announcements about Infineon Edge Protect. Subscribe now and get instant access to exclusive updates, insights, and resources to help you stay ahead of the curve in security.

Sign Up