How secure connection between modem and microchip

Question

My board has a separate Quectel MC66 modem and STM32 microchip. The communication between modem and microchip is AT Commands.
If a hacker connected a wire between modem and microchip, he could have access to transferred data between these two parts.
How can secure these AT commands between the parts, so that hackers could not have accessibility to data transferred and send them to the Server?

Answer 1

I will try to answer your question without going off into the weeds.

This comes down to threat modeling. The modem IC (from what you wrote) exposes an interface that doesn't allow an encrypted & authenticated connection between it and the host (MCU).

Even if you attempt to secure the device/enclosure (anti-tamper measures with sensors, as a start) you have to assume an attacker will be able to "sniff" and log the traffic between the ICs. And as you indicated, at worst, the attacker can "MiTM" or worse, by cutting traces and/or injecting/intercepting traffic.

I work in embedded security but I don't know the market for embedded modem chips. They might all be the same. But have you looked to see if there are modem ICs that support a secure connection (encrypted & authenticated, such as TLS) between host (STM32) and the modem IC?

(Bottom line: if your threat model includes an attacker who can access the signals between the modem & STM32, and the modem IC doesn't support a secure connection, you're going to have a bad day.)

Answer 2

Encrypting a physical data bus between an STM and a modem is hard, like, really hard. Unless (as @Dan mentioned) you're using a modem that supports secure connection of some sort (and we're talking about the physical wired connection in the PCB board, not the wireless connection with the server) then the only choice for that is probably having your own embedded system that would contain both the modem and the microcontroller. Unless you're a big company and gonna mass product these devices for a really big scale then it's gonna be really expensive.

But you probably won't have to do that. You can leave the AT commands unencrypted but send through them the data that is already encrypted on the STM32. This way a hacker can get to know the control AT commands sent to the modem but not the data itself. Of course this way them would also know when the data is being sent and the approximate volume of the data but the data itself would be encrypted. Through the AT commands the hacker would be able to determine the route used by the modem (the AT commands contain things like the IP, port and protocol of the connection with the server). But assuming the data transfer is wireless, that would already be available from just listening (wiresharking) to the wireless data stream between the modem and the router.

The only thing I would be concerned about is to make sure the STM32 doesn't pass any vulnerable information to the modem about the access point within the router like a password to a wifi network. Here you probably have a choice between these two:

1. not passing anything vulnerable between the STM32 and the modem (or maybe pass it only once/few times while configuring the device in place or other moments the device is physically safe)
2. passing it, accept that it can be intercepted and have the security measures configured within the access point (the router) so that a hacker cannot plug into the WLAN using the data transferred to the modem.