Ethernet is widely used in embedded and edge computing systems to enable reliable communication between devices, controllers, and cloud platforms. On the NXP i.MX8M plus processor, Ethernet connectivity supports applications such as industrial automation, gateways, medical devices, and IoT edge nodes. These systems frequently transmit sensitive information, including authentication credentials, sensor data, diagnostic logs, and control commands.
While TCP provides reliable data delivery, it does not offer confidentiality, integrity, or authentication. As embedded devices increasingly operate in network-exposed environments, unencrypted TCP communication introduces significant security risks, including data leakage, tampering, and impersonation attacks.
Transport Layer Security (TLS) is the standard protocol for securing IP-based communication. TLS provides encryption, authentication, and data integrity, enabling secure data transmission over untrusted networks without requiring changes to the underlying Ethernet infrastructure. The NXP i.MX8M Plus processor, based on the Arm® Cortex®-A53 architecture, supports TLS-enabled communication through integrated Ethernet controllers, hardware-assisted cryptographic
acceleration, and trusted execution environments.
Risks of Plain TCP Communication
Using plain TCP exposes sensitive data to several threats:
- Eavesdropping: Unauthorized parties can intercept unencrypted traffic.
- Data tampering: Attackers can modify TCP payloads, potentially causing system errors.
Man-in-the-middle (MITM) attacks: Adversaries can impersonate endpoints and inject malicious commands. - Replay attacks: Valid packets can be intercepted and resent to disrupt system behaviour.
These vulnerabilities make TLS essential for secure Ethernet communication.
TLS-Encrypted Communication Concept
TLS secures communication by providing three fundamental security properties:
- Confidentiality: Encrypts data to prevent unauthorized access.
- Authentication: Verifies the identity of communication endpoints using digital certificates.
- Integrity: Detects data modification through cryptographic message authentication mechanisms.
TLS operates above the TCP/IP stack and does not require modifications to the physical Ethernet network. On the i.MX8M Plus platform, TLS can leverage hardware cryptographic acceleration and trusted execution environments to offload computationally intensive operations, improving performance while maintaining strong security guarantees.
Secure Architecture on i.MX8MP
The i.MX8MP platform provides a layered architecture for secure Ethernet communication:
- Gigabit Ethernet Controller: Provides high-speed network connectivity.
- Cryptographic Acceleration and Assurance Module (CAAM): Offloads encryption, hashing, and key management, reducing CPU load.
- ARM TrustZone & OP-TEE: Divides the system into Normal World (Linux applications) and Secure World (trusted cryptographic services).
- PKCS#11 Interface: Provides an API for applications to access cryptographic services without exposing keys.
How it works:
- Applications use standard networking APIs and OpenSSL for TLS.
- kTLS offloads TLS record encryption and decryption from user space to the Linux kernel, minimizing plaintext exposure in user-space memory.
- PKCS#11 allows asymmetric operations (RSA/ECC) to execute in secure hardware.
- OP-TEE executes sensitive cryptographic operations and securely tores keys used by TLS in the Secure World, isolating keys, and session material from untrusted software.
This architecture ensures that Ethernet data is encrypted before leaving the device, and cryptographic keys remain protected throughout their lifecycle.
TLS Offload and Encryption Approaches
Kernel TLS (kTLS) Offload:
- Purpose: Offload TLS record encryption and decryption to the kernel
- Benefits: Reduce plaintext exposure in user-space memory, lowers CPU overhead, and improves throughput with hardware acceleration.
- Validation: Confirms that TLS data is encrypted efficiently at the ernel layer, minimizing attack surface.
OpenSSL Asymmetric Operations via PKCS#11:
- Purpose: Offloads RSA/ECC operations to CAAM using the PKCS#11 engine.
- Benefits: Private keys remain in secure hardware, preventing memory-based attacks. Improves handshake performance.
- Validation: Ensures all asymmetric operations use hardware-backed keys securely.
OpenSSL TLS Offload to OP-TEE via PKCS#11 Provider:
- Purpose: Delegates TLS cryptographic operations and key storage to the Trusted Execution Environment.
- Benefits: Strong isolation of keys and session material; protected even if Normal World applications are compromised.
- Validation: Confirms that TLS sessions operate securely within OP-TEE.
Validation & Security Benefits:
Validation demonstrates that the secure architecture works as intended:
| Mechanism | Validation Purpose | Security Benefits |
|---|---|---|
| kTLS | Offload TLS record processing to kernel/hardware | Reduces plaintext exposure, improves throughput |
| PKCS#11 | Offload asymmetric crypto to CAAM | Protects private keys, strengthens authentication |
| OP-TEE PKCS#11 | Execute TLS operations in Secure World | Isolates cryptography, reduces attack surface, protects session keys |
Summary: These mechanisms together ensure confidentiality, integrity, and authentication, while leveraging hardware acceleration and TEE isolation to improve performance and security.
These validation cases collectively demonstrate that secure Ethernet communication on the i.MX8MP platform is achieved through layered security mechanisms. Kernel TLS improves performance and reduces plaintext exposure, PKCS#11-based hardware acceleration secures
asymmetric key operations, and OP-TEE provides strong isolation for sensitive cryptographic processing. Together, these mechanisms ensure confidentiality, authentication, and integrity for data
transmitted over Ethernet.
i.MX 8M Plus SMARC System on Module Overview
The proposed secure communication system is based on the i.MX8M Plus SMARC Processor, which combines high-performance application processing with advanced networking and security capabilities. The multicore architecture enables efficient handling of operating system tasks, secure Ethernet communication, peripheral management, and real-time data processing for embedded and industrial applications.
With support for hardware-accelerated cryptographic operations, Gigabit Ethernet connectivity, and industrial-grade embedded design, the i.MX8MP SMARC Platform provides a reliable and scalable solution for implementing TLS-encrypted Ethernet communication in edge and IoT systems.
- 4 x Cortex-A53 cores running up to 1.8GHz
- Dedicated Cortex-M7, GPU, VPU, NPU, ISP & HiFi4 Audio DSP
- 2GB LPDDR4 expandable up to 8GB memory support
- 16GB eMMC Flash Expandable up to 128GB, Micro SD Slot
- Wi-Fi 5 and Bluetooth 5.0 Connectivity
- Gigabit Ethernet x 2 (TSN support on one port)
- NPU with up to 2.3 TOPS Neural Network performance
This combination enables the embedded system to efficiently manage secure Ethernet communication, TLS encryption/decryption, network packet processing, and peripheral control while maintaining reliable real-time performance. The scalable architecture also simplifies deployment in industrial automation, IoT gateways, secure edge devices, and intelligent embedded systems.
Conclusion
TLS-encrypted Ethernet communication is essential for protecting embedded systems from eavesdropping, tampering, and impersonation attacks. On the i.MX8M Plus platform, security is strengthened through hardware cryptographic acceleration, ARM TrustZone, OP-TEE, and PKCS#11 based key management. Combined with kernel TLS offload, these mechanisms provide secure, efficient, and hardware-backed protection for data in transit while reducing the overall attack surface. This layered approach enables i.MX8MP-based embedded systems to achieve strong confidentiality, integrity, and authentication for modern connected applications.
