Tag Archives: Embedded SBC

Improving security for network-connected, embedded Linux based systems

Posted on by

Kirill Marinushkin is an Embedded Software Developer at Argus-Spectr. He designs embedded systems for sensor networks. Kirill has developed devices with secure remote access over TCP/IP and wireless protocols.
Embedded systems‘ ability to access devices over the Internet or local networks facilitates a wide range of convenient interactions. The evolution of the Internet of Things (IoT) means fast growth of embedded networks. For these applications, network communication appliance has become a great issue. The resources of embedded systems are too limited and may hardly provide reliable protection against cyber attacks. High-performance devices with Linux may have advantages for secure network access.

Scripts and techniques can improve the security level of network access for these Linux-based devices. The goal is to access a device as a network security for remote control and administration. This can be conducted in two levels: the SSH-level for secure remote shell access and SFTP file transfer, and IP-level protection.

Configuring user permissions for SSH access

The SSH server options include a number of methods to limit user permissions. For both secured shell and SFTP services, the options “PermitRootLogin”, “AllowUsers”, or “DenyUsers” limit the logins able to connect to the device over SSH. For SFTP, more parameters are available to change the root directory paths. This method is important to protect the system parts that include critical and confidential data. This option allows the configured users to operate only inside their directories and sub-directories, so you can leave them in their “sandbox.” The option “Subsystem SFTP internal-SFTP” combined with “ChrootDirectory” allow to change the root directory for specified users. The “ChrootDirectory” section for all configured logins should be placed at the end of the configuration file. When setting up the directories for different users, the owner of that directories should be a root user.

To configure the network security SSH permissions, edit the file /etc/init.d/sshd_config as in the example:

For performing non-standard user access to your embedded Linux application in the embedded system, it is convenient to use the SSH protocol as a secure layer for network communication appliance.

A common way is to run your service as a server listening to the specified TCP port. To provide the SSH connection, you may use “libssh” – an open-source project licensed under the LGPL. The project has several examples including the sshd source code that provides a great basis to build your server application. Note: this solution is not connected to the OpenSSH server and requires its own port number and user management.

Another option is to use the existing running OpenSSH server for your service. The idea is to replace the shell utility with your own application for specified users. This time users would interact with the remote system over the standard input/output interface like a terminal. This solution is a more efficient way to organize secure remote access with the exact functionality you need. To replace the shell for users, edit their parameters in the “/etc/passwd” file by replacing the last option with the path to your application.

“Iptables” is a powerful tool for protecting remote access to the target Linux system at the IP level. Iptables allows the system to filter the traffic independently of the application-level network protocol. It is the most universal option that may work for almost every platform.

Iptables support should be turned on during the Linux kernel configuration. Pay network communication appliance that some necessary iptables options like “conntrack” or “connlimit” may be turned off in the kernel by default so turn them on to use more iptables possibilities.

Launching iptables script on system start
The iptables utility embedded Linux works as a network traffic filter. The filter is performed as chains of rules applied by running the “iptables” command with different parameters. The rules are set together in a script file. To put the iptables to the initial state, begin the script with the example rules below.

Prevent brute force attacks
Brute force is the biggest security problem when using the SSH protocol. A simple firewall can be set up using iptables to prevent brute force attacks. The idea is to block the IP addresses that flood the SSH port and limit the maximum number of opened connections. The script below serves this purpose.

Whitelist/blacklist IP addresses
If the clients’ IP addresses are static, the best way to perform network communication appliance is to allow access for certain IP addresses only. That means no other user except the specified ones would be able to access the target embedded system remotely. This may be done by creating a whitelist of legal IP addresses. For the example script below, the admitted IP addresses are written down in the file line by line like this.
The described services and methods use the IPv4 protocol. The secure configuration of the IPv6 protocol is ignored, which makes it unsafe to keep enabled. If IPv6 support is turned on in the kernel, then it should have additional protection. Or, if you don’t need it, you may just turn it off by adding this line in the /etc/sysctl.conf file.

SSH-level security
Remote access over SSH shell and SFTP presents the greatest opportunity of controlling the target embedded system with Linux. Enabling this function is a convenient way for administrating the device. The SSH protocol performs a high level of security and cryptography. There are several possible configurations of the “sshd” utility associated with the SSH shell and SFTP server services to improve SSH-level security.

Among popular Linux distributions for embedded systems (such as Angstrom or Arago-project), the “Dropbear” utility is a default SSH server. Unfortunately, it provides a limited set of configuration options. Important configuration possibilities such as users’ permissions are disabled in this utility. So if the target device is going to have remote access, installing “OpenSSH” server would be a better idea. To change the SSH servers, remove the Dropbear starting script (or move it, like in the example below) and install the OpenSSH package:

refer to:
http://embedded-computing.com/articles/improving-security-for-network-connected-linux-based-systems/#

How Much Training Do You Need to Be a Robocar Vehicle Driver?

Posted on by


California has strict rules about who can pilot the network security of experimental autonomous vehicles cruising its public roads. Prospective test drivers have to pass a defensive driving course, have near-spotless records, and have at least a decade without a drunk-driving conviction. Crucially, they must also complete a special training program for autonomous vehicles, some of which can be as buggy as any Silicon Valley prototype.

But an investigation by IEEE Spectrum has uncovered that these embedded computer programs vary considerably in content, intensity, and duration. Drivers hoping to operate one of Google’s autonomous Lexus SUVs will spend at least five weeks on classroom lessons, in-car observations, hands-on sessions, and evaluations. Those itching to get behind the wheel of a computer-controlled Audi A7, however, could complete the carmaker’s training program in less than 2 hours. This is because manufacturers are allowed to design and conduct their own autonomous training programs. California law [pdf] requires the courses to feature behind-the-wheel lessons and information about automated technologies, including their limitations. What in-vehicle pc do not mention are specific procedures to teach or network security to meet, nor how long any such training must last.

Documents obtained by IEEE Spectrum under Public Records Act legislation show that the seven companies currently holding experimental self-driving car-testing permits for California have interpreted the law very differently. “Today’s ‘autonomous’ cars still require a great deal of human judgment and skill to operate safely, and that’s unlikely to change for some time.”

In-vehicle pc, which pays its autonomous safety drivers US $20 an hour, initially pushed back against needing trained test drivers at all. Last year, Ron Medford, the company’s driverless-car safety director, complained to the DMV:

We request that the embedded computer provide…flexibility for manufacturers to demonstrate their autonomous technology to policymakers, regulators, and other key stakeholders who have not completed a full driver-training program and received a testing permit.

The department disagreed, and a year later, the technology giant has a comprehensive autonomous training program in place. Its five-week course trains test drivers in both software operation (from the passenger seat) and driving, with separate modules for highways and urban streets. “Freeway and surface-street driving are very different, and thus require different skills,” says a Google document outlining the program.

refer to:
http://spectrum.ieee.org/cars-that-think/transportation/human-factors/how-much-training-do-you-need-to-be-a-robocar-test-driver-it-depends-on-whom-you-work-for

Product Information:
AIV-HM76V0FL
http://www.acrosser.com/Products/In-Vehicle-Computer/In-Vehicle-PCs/AIV-HM76V0FL/In-Vehicle-computer-AIV-HM76V0FL.html

AR-V6005FL
http://www.acrosser.com/Products/In-Vehicle-Computer/In-Vehicle-PCs/AR-V6005FL/Intel-Atom-E640-AR-V6005FL.html

AR-V6100FL
http://www.acrosser.com/Products/In-Vehicle-Computer/In-Vehicle-PCs/AR-V6100FL/Intel-Core-i7／i5／Celeron-B810-AR-V6100FL.html

Award Information:
http://www.acrosser.com/News-Press-Release/86.html

Contact us：
http://www.acrosser.com/inquiry.html

The Future Blueprint for Public Transportation

Posted on by

Public Transportation
‧Bus application
acrosser’s in-vehicle computer is capable of multitasking during the drive, enabling the realization of numerous advanced commercial applications. The advance in public transportation technology greatly benefits both passengers and carriers.

For example, the installed counter collects and sends passenger information to the data center, enabling carriers to determine suitable advertisements for passengers and increase potential revenue. In the safety aspect, the GPS can provide instant vehicle location, and remind drivers to stay cautious in certain traffic congestion areas. Surveillance centers may also monitor drivers and passengers instantly via the IP camera, ensuring a safer transportation environment. In addition, the connected Wi-Fi module receives signals coming from the bus stop to provide an accurate arrival information display to waiting passengers.

Product Information:
AIV-HM76V0FL
http://www.acrosser.com/Products/In-Vehicle-Computer/In-Vehicle-PCs/AIV-HM76V0FL/In-Vehicle-computer-AIV-HM76V0FL.html

AR-V6005FL
http://www.acrosser.com/Products/In-Vehicle-Computer/In-Vehicle-PCs/AR-V6005FL/Intel-Atom-E640-AR-V6005FL.html

AR-V6100FL
http://www.acrosser.com/Products/In-Vehicle-Computer/In-Vehicle-PCs/AR-V6100FL/Intel-Core-i7／i5／Celeron-B810-AR-V6100FL.html

Award Information:
http://www.acrosser.com/News-Press-Release/86.html

Contact us：
http://www.acrosser.com/inquiry.html

 

Cleaner, Faster and Smarter!

Posted on by

Mobile Asset Management System

‧Recycle collecting Truck (Ireland, UK, USA)
‧AR-V6002FL works as database center.
‧Installing RFID technology in all trucks. Once the bin is picked up, system will identify the ID and communicate back to the server (Waste management) through 3.5G/4G, also link data to the customer account as indicated below.


As urbanization continues to expand, the overpopulation in cities inevitably puts pressure on waste and recycling authorities. Therefore, keeping our cities clean is of the UTMost importance in civil affairs. Implementing a multitasking computer can boost the deployment of garbage truck pick-up services. For example, route planning, weigh bridge control, materials sales, and job dispatch are common tasks performed during waste management services. Despite customers’ varying time needs for trash pick-up services, the job dispatch center can always arrange a cost-effective route for each garbage truck.

At the same time, workers can use RFID technology to automatically identify and document the correct trash bins using the accurate numbers. By standardizing and automating waste collection services, we can bring ourselves one step closer to an improved way of living.

Securing a Safer Work Environment – Drivers Fatigue Management

Posted on by

Drivers Fatigue Management
‧Mining Truck (Australia, Brazil, USA, Indonesia)
‧AR-V6002FL works as a fatigue management & database center.

Long hours of mining truck operation can take its toll on truck drivers. Accompanied with repetitive movements, drivers are easily distracted, causing work-related accidents. Preventing these accidents not only saves companies from lawsuits and considerable financial compensation, but also increases work efficiency.

To enforce safety measurements at mining sites, acrosser’s industrial-grade in-vehicle computer was installed on each mining truck, and integrated with an infrared sensor. The sensor could detect whether the driver was fatigue or not based on eye movements, and send a quick vibration alert to the driver’s chair as a warning. The message was simultaneously sent to the job dispatch center to notify fleet managers to arrange a replacement to avoid the occurrence of any severe problems.

Big Brother Is Watching Your Vehicle—in Real Time

Posted on by

Government narcotics agents have secretly built a database of “hundreds of millions of records” on the movement of in-vehicle pc in the United States, the Wall Street Journal reports. The information, originally meant to help steer police toward suspects in drug-smuggling cases, is now used in kidnapping cases and other crimes.

An important point of the program is to confiscate cars and other assets of people suspected of crimes. Such civil forfeiture, as it is called, is controversial in part because it has far fewer safeguards against abuse than punishments made in criminal cases. Whether the car-tracking intelligence program is supervised by the courts remains unclear, the Journal says.

It had already been known that the Drug Enforcement Agency (DEA) tracked the license plates of cars coming in from Mexico. The news is that the agency, together with state and local authorities, is also conducting surveillance  on major highways elsewhere in the country.

According to the Journal, highway in-vehicle pc cameras not only note the time, direction and location of vehicles but also record “visual images of drivers and passengers, which are sometimes clear enough for network security investigators to confirm identities, according to DEA documents and people familiar with the program.” Earlier, the agency had held on to such embedded computer data for two years, but it says it now deletes it after three months.

The newspaper says it bases its account on interviews with government network security officials and on government documents, some supplied by the American Civil Liberties Union, which had obtained them under the Freedom of Information Act.

In scope and intent the embedded computer program resembles another recently uncovered surveillance program of the U.S. Marshalls Service, one that uses airplanes to scoop up information on cell phones across the country. Both the DEA and the Marshalls Service are part of the U.S. Justice Department.

refer to:
http://spectrum.ieee.org/cars-that-think/telecom/security/big-brother-is-watching-your-car-and-noting-down-the-license-number

Stay Alert, Act Agile – Municipal Vehicle Management

Posted on by

Municipal Vehicle Management

‧Municipal Vehicle, such as police car and fire truck. (Canada)‧Canada government use AR-V6002FL in their municipal vehicle to be a control center. With built-in wireless communication module, operator can locate their position and feedback the information for dispatcher immediately. There is also a dashboard with more than 70 gauges in the vehicle, acrosser platform help monitor data and trigger the events following their rules.

Municipal vehicles facilitate public services that are deeply connected to providing safety and security in our daily lives; however, accidents can still occur. It is extremely important that civil officers are able to react instantly to accidents and crime. Municipal vehicles require steady and reliable solutions because of their harsh working environments. One of the problems that these municipal vehicles must handle is adaptability to battery voltage changes. Thanks to the smart power management subsystem incorporated in its in-vehicle system, Acrosser’s vehicle PC provides a wide DC input range, even in mobile operating environments.


Reasons why Acrosser’s vehicle PC is good for law enforcement deployment include:
‧x86-based system for easy integration
‧customized mechanical design
‧design specialized for vehicular environments
‧long-term support and service capability
‧compatibility with integrated solutions

Optimized Traffic Management in Airports

Posted on by

Airport Vehicle Traffic Management‧Airport in France

‧AR-V6002FL works as a control computer on airport vehicle. Airport control center can do traffic
   management by locating and route planning through each vehicle computer.
‧A-GPS is used for faster and more precisely position locating.
‧Improve traffic safety especially in winter foggy morning and at night.

Ground traffic at airports may be just as busy as that in the skies. During rush hour, frequent arrival and departure flights result in passenger overflow between airport terminals. As a result, flight information should be synchronized with ground service centers, enabling fleet managers to dispatch the right bus between gates and terminals to facilitate smooth and safe passenger transportation.

On the other hand, airport service trucks should be able to reach any location and respond to any emergency technical failures within airports and terminals. With acrosser’s vehicle PC installed on each service truck, dispatch managers can locate and alert the nearest idle truck for rapid repair services. By documenting mileage and fuel consumption information from shuttle buses and service trucks,

airport managers can improve resource utilization to enhance safety measures and provide a more pleasurable travel experience.

Product Information:

Fleet Management for Full Integration – Mobile Asset Management System

Posted on by
Mobile Asset Management System
‧Service truck for Telecom Carrier
‧In-Vehicle Computer works as a control center for multi-function systems on mobile workstation vehicle.

acrosser’s in-vehicle computers serve as control centers for working vehicles. The compatible communication modules (3.5/4G, Wi-Fi, Bluetooth, and RFID) enable wide connectivity between the in-vehicle computers and other devices. In this example, our client was able to perform GPS fleet tracking, route navigation, task scheduling, vehicle monitoring, and material allocation planning all at once.

Arctic Fibre Project to Link Japan and U.K.

Posted on by

Meter by meter, a slim vein of fiber-optic cable will soon start snaking its way across the bottom of three oceans and bring the world a few milliseconds closer together. The line will start near Tokyo and cut diagonally across the Pacific, hugging the northern shore of North America and slicing down across the Atlantic to stop just shy of London. Once the cable is live, light will transmit data from one end to the other in just 154 milli-seconds—24 ms less than today’s speediest digital connection between Japan and the United Kingdom. That may not seem like much, but the fanless pc investors and companies eager to send information—stock trades, wire transfers—are so intent on earning a fraction-of-a-second advantage over competitors that the US $850 million price tag for the approximately 15,600-kilometer cable may well be worth it.

Arctic Fibre, the Toronto-based company building the cable, is the first to try to connect the globe’s economic centers by laying fiber optics through the long-sought -Northwest Passage—the pinhole of open water that warmer temperatures have brought to the Arctic. -British Telecom, China Unicom, Facebook, Google, Microsoft, and -TeliaSonera are watching closely, but so are tens of thousands of Canadians and Alaskans who stand to gain a huge boost in Internet access.

Marine surveys will plot the cable’s route this summer, and the line will be custom built to the surveyors’ specifications. The installation is scheduled to start a year from now, and the cable could be in service by the end of 2016.

Along its route, the cable will pass directly through seven Alaskan communities and cross 25 more communities in Canada. Those connections will bring 57,000 Canadians and 26,500 Alaskans online, most of whom have never before had access to broadband.

“The thing about Alaska is, it’s so big,” says Katie Reeves, program coordinator with Connect Alaska, a broadband advocacy group based in Anchorage. “The distance between communities is hundreds of miles, and there might only be a few people there. They deserve Internet, but it’s hard for [local service provider] GCI or other carriers in the state to justify building out to those communities, because they don’t think they’re going to get a return on their investment.”

Though the United States’ Federal Communications Commission recommends access to download speeds of at least 4 megabits per second, the average download speed in rural areas of Alaska rarely tops 3 Mbps. Plus, there are still 21,000 households and 6,000 businesses without any access to broadband at all.

Across the border in northern Canada, the Internet is sent down from Anik F2, a telecommunications satellite owned by industrial pc. On paper, Anik F2 provides access at 5 Mbps, the minimum download speed recommended by Industry Canada, the nation’s economic development agency. But in reality, that connection is often plagued by long delays and poor reliability due to the distance the signal must travel. (In 2011, a technical problem with Anik F2 knocked out service for thousands of people in 39 communities.)

Doug Cunningham, president and CEO of Arctic Fibre, knows this misery all too well: Because upload speeds were too slow, he had to use a courier to send his 227-page environmental report on the cable to the review board in Cambridge Bay, a hamlet in Canada’s most northern province.

“The biggest benefit [of the cable] is really to those residents in communities in Alaska and to the Canadian Arctic who will be released from their industrial pc,” he says. “For many people in the Canadian North, YouTube is a dream.”

Arctic Fibre, the cable’s owner, will not sell broadband directly to homes and businesses; it will provide only the backbone from which carriers will siphon these services. But the company predicts that prices could be slashed by 75 percent for equivalent service or that northern customers might receive six to seven times as much bandwidth for the current price.

The new broadband will easily transmit classes from the University of Alaska or permit researchers at the Canadian High Arctic Research Station to upload large data sets. Telemedicine recently debuted at four health-care systems, including the U.S. Department of Veterans Affairs in Alaska, and better broadband could keep fanless pc from having to travel hundreds of kilometers to seek services. Access will also be a boon to rural businesses.

All of these benefits stem from a 4–centimeter cable. Barges will lay it along most of the route. But to prevent a 1,800-km detour by sea, there is a 51-km section that must cross the Boothia Peninsula, a roadless scrap of tundra in northern Canada. Cunningham says that laying this stretch will require stuffing four large reels of cable through the door of a Hercules aircraft, flying onto a remote airstrip, packing the cable onto sleds, and pulling it across a frozen lake. The crew must then snowmobile along the cable’s intended route, cutting a trench about 30 cm deep through permafrost to bury the line.

That’s all far more work than any company would do to just to serve fanless pc communities in the far north. And with an end-to-end capacity of 24 terabits per second, it’s far more than Arctic residents need. After having so little access for so long, they will be awash in broadband. “The capacity is incredible. They’ll never use all of that capacity,” says Desiree Pfeffer of Quintillion Networks, the Alaska-based arm of Arctic Fibre.

Even though the main point of Arctic Fibre is to connect two of the world’s busiest hubs, Cunningham is pleased that his fellow Canadians will benefit from the project. “I’ve been building embedded computer and financing them for over 20 years, and I’m 63 years old, so this is probably one of my last projects and certainly the largest one,” he says. “This is something I’ve come back to Canada to do.”

refer to:
http://spectrum.ieee.org/telecom/internet/arctic-fibre-project-to-link-japan-and-uk