The need to secure the growing number of internet of things (IoT) connected devices has become obviously apparent in the last few years, which is a good thing for embedded security vendor Mocana. On May 16, Mocana announced that it raised a new $11 million round of funding to help further advance its mission of directly integrating security into embedded IoT devices.
The new round of funding comes from Sway Ventures, Shasta Ventures, Trident Capital Fund and GE Ventures and brings the total amount raised to $93.6 million. Mocana was founded back in 2002 when the term IoT didn’t exist, though there were embedded computing devices.
“Mocana has been one of the pioneers of securing devices from the inside out, providing embedded security,” Mocana CEO William Diotte, told eWEEK. “We have a vision to secure a full stack all the way from the device, to the gateway and up into the cloud.”
Rather than think of IoT security and as a bolt-on detection feature for threats, Diotte said that a core foundational component of what Mocana does is to enable trustworthy and hardened devices.
“You have to do more than put in whiz-bang machine learning or artificial intelligence technology that is just trying to predict an attack,” Diotte said. “The main focus for us is to make attacks infinitely more difficult as a layer zero of defence.”
The ‘layer zero’ line of defence is a term that Diotte say he coined to define embedded security that is present at the lowest layers of operation on a device, starting with secure boot. Any updates to an IoT device also needs to be performed in a secure way that is attested to by a secure chain of trust. In Diotte’s view, much of the IoT security discussion to date has been about encryption and secure data transport with SSL/TLS, but that’s not enough.
The core technology behind Mocana’s product portfolio is the company’s NanoCrypto engine. Diotte said that Mocana has been improving the NanoCrypto engine over the last 15 years into a very small, but capable footprint to secure embedded devices. The NanoCrypto engine can fit in under 20 kb (kilobytes) of memory, which helpful on resource constrained devices.
Diotte said that in a Secure Boot scenario what Mocana’s technology is attesting to is that the known good state of a BIOS, firmware, operating system stack is verifiably unmodified.
“At every stage of boot, we’re ensuring that what is coming up on the device is in fact known good based on measurement that we have taken from the known good master that we carry in the NanoCrypto engine,” Diotte said.
For software updates, a similar approach occurs where each attempted update is compared against a known good update. Going a step further, the Mocana platform can then be used to make sure that only verifiably trusted devices can communicate with other known good devices.
“So we’re not guessing if there is any malicious transactions, since we sit at the chip level,” Diotte said. “There is nothing artificial about our intelligence, we know the true value of what is happening in the network.”
Mocana recently joined the Linux Foundation’s EdgeX project, which is an effort to enable IoT interoperability. Diotte said he wanted to make sure that Mocana is playing a role in creating baselines for IoT security, which is also part of the larger vision for the company.
“What we’re building now is an ecosystem that over time will create an industry-wide abstraction layer for IoT,” Diotte said.
Diotte said that every IoT device and silicon vendor has different implementation requirements when it comes to security, which is where the new funding will help to fuel future security development.
“We want to enable abstraction where developers can use a Mocana API that is uniform and consistent and we hide the complexity of all the different components,” Diotte said.