Secure Communication with ARM TLS
In today's world, secure communication is crucial for many applications to protect data transmission between two network nodes. The Transport Layer Security (TLS) protocol is a standardized technology for establishing a secure, encrypted and authenticated link between two parties over an insecure network. TLS is an industry standard and is used in millions of devices and websites.
Software Stack
Although the Network Component does not offer encryption and secure communication on its own, you can use ARM's mbed TLS software component to achieve this.
From the bottom up:
- The Cortex-M-based microcontroller provides the processor core, storage, memory and network interface.
- The CMSIS-RTOS compliant operating system provides standard services such as scheduling and thread-safety.
- The Network Component provides services, sockets (TCP/IP) and the interface for network communication.
- Building on top of the Network Component, mbed TLS provides an abstraction layer for secure communication.
- The application code uses mbed TLS to abstract the secure communication from itself.
Why mbed TLS?
The mbed TLS library is designed for ease-of-use. The library is documented and has examples so you can easily understand how to use it. In the Network Component, mbed TLS is used under the Apache 2.0 license, enabling you to use it in both open source and closed source projects. mbed TLS is a fully featured and standards compliant SSL library offering server and client functionality in one single package.
Configure mbed TLS using the mbedTLS_config.h file under Security in the Project window.
Difference between SSL/TLS
The TLS protocol is the successor of the SSL protocol. Just like its predecessor, the TLS protocol provides communication security for connections over possibly untrusted networks, like the Internet. The main difference between TLS and SSL is the increased standardization of the workings of the protocol. SSL itself was designed and developed by Netscape. The newer TLS standard is defined in a number of public RFCs and is extended periodically to counter possible weaknesses or add much needed functionality.
Parts of an SSL/TLS Library
In order to perform the SSL or TLS protocol, a number of supporting functionality is required. The SSL/TLS library:
- needs to perform symmetric cryptographic operations, such as AES, to encrypt the data over the connection.
- uses asymmetric cryptographic operations, such as RSA, for identifying and authenticating the parties of the connection.
- uses message digest operations, such as the SHA-256 hash algorithm, to protect the integrity of the information sent over the wire.
- needs to be able to parse, understand and use X.509 certificates.
- has to perform network operations to send and receive the protocol packets.
All of this is hidden from most users and wrapped inside an SSL library, such as mbed TLS, which developers can use to implement SSL or TLS in their applications.
For more information on mbed TLS and how it works, visit the high-level design overview page.
Add the mbed TLS Library to a µVision Project
The Network Examples section carries two examples for secure communication over the IP network: SSL Server and SSL Client. To use the mbed TLS library in your own projects, follow these steps:
- Download the ARM:mbedTLS library from www.keil.com/pack or use Pack Installer
- Open or create a project using the Network Component.
- Configure the Network Component as required by your application (Ethernet settings, TCP/IP communication, etc.).
- In the Manage Run-Time Environment window expand Security and enable mbed TLS:
