PSA Certified is a security certification scheme for Internet of Things hardware, software and devices. It was created by seven stakeholder companies as part of a global partnership. The security scheme was created by Arm Holdings, Brightsight, CAICT, Prove & Run, Riscure, TrustCB and UL. Arm Holdings first brought forward the Platform Security Architecture specifications in 2017 to outline common standards for IoT security, with PSA Certified assurance scheme launching two years later in 2019.
Foundation
In 2017, Arm Holdings created Platform Security Architecture, a standard for IoT security. The standard builds trust between Internet of Things services and devices. PSA has since evolved to become PSA Certified, a four stage framework which can be used by IoT designers for security practices. In 2018, the first IoT threat models and PSA documents were published. The certification of PSA Certified launched at Embedded World in 2019, where Level 1 Certification was presented to chip vendors. A draft of Level 2 protection was presented at the same time. Six of the seven founding stakeholders created the PSA Certified specifications, which are now make up the PSA Joint Stakeholders Agreement. The stakeholders are Arm Holdings, Brightsight, CAICT, Prove & Run, Riscure and UL. TrustCB became the seventh PSA Certified JSA member, acting as an independent Certification Body for the scheme. Out of the six other founding members, four are security test laboratories, which includes Brightsight, CAICT, Riscure and UL. The first PSA Certified Level 2 certificates were issued to chip vendors in February 2020.
Certification
The PSA Joint Stakeholders Agreement outlines how members can create a worldwide standard for IoT security that enables the electronic industry to have an easy to understand security scheme. The security certification scheme documents enable a security-by-design approach to a diverse set of IoT products. The scheme starts with a security assessment of the chip and its Root of Trust and then builds outwards to the system software and device application code. PSA Certified specifications are implementation and architecture agnostic so can be applied to any chip, software or device. PSA Certified aims to removes industry fragmentation for IoT product manufacturers and developers in a number of ways. The world’s leading IoT chip vendors are delivering system-on-chips built with a PSA Root of Trust providing a new widely available security component with built-in security functions that software platforms and original device manufacturers can make use of. A high-level set of APIs are provided to the PSA-RoT abstracting the complex trusted hardware and firmware used by different chip vendors. Free API Test Suites are available to provide this software API compliance to achieve PSA Functional API Certification.
Security
As part of the third stage of PSA Certified, threat models and security analyses documents are provided for a set of IoT devices. These English LanguageProtection Profiles differ from the treat models, and derive security requirements that are generalised by the PSA Certified 10 Security Goals.
