TrustFLEX for IP Protection

Last modified by Microchip on 2024/06/24 06:29

Getting Started with TrustFLEX for IP Protection

Please note this page is for Trust Platform Design Suite version 1. Training for Trust Platform Design Suite version 2 can be found here: Trust Platform Design Suite v2.

This page shows you how to use TrustFLEX to prevent your product from being counterfeited. The MCU will verify if a secret key in the TrustFLEX device is the same secret key stored in the MCU (symmetric authentication). If not, the application code in the MCU will not run.

TrustFLEX is one of three secure element families in the Trust Platform. It's pre-configured and partially pre-provisioned to support many different security use cases. It also comes with an overwritable generic certificate for TLS-based authentication to a cloud platform.

Trust Flex logo

The CryptoAuth Trust Platform development kit includes three secure elements: Trust&GO, TrustFLEX, and TrustCUSTOM. This board comes pre-programmed with firmware allowing it to communicate with the Jupyter Notebook application running on your computer. The Trust Platform Python scripts running on Jupyter Notebook take care of the complex provisioning process allowing you to focus your efforts on your end application.

Table of Contents

Reference Materials

MPLAB®X IDE

MPLAB®X XC32

Trust Platform Design Suite

CryptoAuth Trust Platform
Evaluation Kit

MPLAB X IDE v3.35 has a bug that prevents it from connecting to the CryptoAuth Trust Platform board. Please use a previous or later version of the IDE.

Device Customization Process

There are five steps involved in customizing the TrustFLEX device:

  1. Select a Pre-defined Use Case(s) from the TrustFLEX use case library.

  2. Generate the development keys and certificates using the Jupyter Notebook resource generator.

  3. Prototype the Use Case(s) in the Jupyter Notebook.

  4. Test the Use Case(s) on an embedded platform using the MPLAB® X IDE projects provided in the suite.

  5. Generate the secret exchange for production.

Open Jupyter Notebook
1. Click the Start Jupyter button to open Jupyter Notebook in your web browser.

This is used to provision a secure element on the CryptoAuth Trust Platform board. See the user guides (in the docs folder) for detailed instructions on running Jupyter Notebook for each use case.

Start Jupyter Dialog

Jupyter Notebook is an open-source web application that allows you to create documents that contain code and narrative text that can be executed in place. It provides Graphical User Interface (GUI) elements, the ability to add images, and gives the interactive look that is absent in normal code files.

The cells of the Jupyter Notebook can be used to write code or text using markdown. The code cells contain executable code and the text cells contain the explanation of the code's functionality.

Assets folder:

  • CryptoAuth Trust Platform board firmware.
  • WINC1500 board firmware.

Docs folder:

  • Datasheets.
  • CryptoAuth Trust Platform board user's guide.
  • Detailed use-case guides.

TrustFLEX folder:

  • Jupyter notebook packages
  • C-based projects

TrustnGO folder:

  • Jupyter notebook packages
  • C-based projects

Jupyter Notebook

TrustFLEX Resource Generator

The Resource Generator Notebook supports the development of Cryptographic Keys, Custom Root, and Signer Keys to issue device certificates and prototype the TrustFLEX devices with development keys and certificates.

TrustFLEX devices come with pre-programmed certificates in slots 10, 11, and 12. Slots zero through four have pre-generated private keys, other than these mentioned slots all the other slots have no data in them.

The Resource Generator Notebook will create development keys and certificates for all slots that can be further customized. Keys and certificate chains are stored in the PC filesystem and not generated in a secure environment.

Note: This tool is used for development purposes only and not for mass production. The keys and certificate chains are not generated in a secure environment.

3.1 Setting up the Hardware
  • Plug in the CryptoAuth Trust Platform to the PC using the USB cable.

  • The Design Suite is set up such that it communicates with the TrustFLEX device only.
3.2 Using the Trust Platform Suite for TrustFLEX
  • Open Jupyter Notebook, navigate to the TrustFLEX resource generator notebook, and click to open it.

    • Trust Platform repository folder: TrustFLEX\00_resource_generation\
    • File: TFLXTLS_resource_generator.ipynb

TrustFLEX resource generator notebook

TrustFLEX resource generator Introduction

Crypto Resource Generator

  • Execute each cell by clicking Cell > Run Cell, and observe the output to ensure each cell is executed successfully.
  • If the Notebook has already been executed before, then restart the kernel by selecting Kernel > Restart and Clear Output.

Some cells take a bit of time to execute. The circle in the images below indicates if the kernel is still working on a cell (full circle) or idle (empty circle).

TrustFLEX Kernal Idle and Busy Indicators

Jupyter Notebook Layout

This is a brief guide for the Jupyter interface.

  • Once all the cells are executed, you are asked to select the certificate type you need.
    • Select MCHP Cert to use the standard Microchip certificate.
    • Select Custom Cert to use a custom certificate. If using a custom certificate, you will need to enter the organization name to include in the custom certificates being generated.
  • For this example, select Custom Cert.
    • A prompt will open asking you to enter the Organization Name. If you don't know the organization name you can make one up but make sure the name does not exceed 24 characters.

Enter the Organization Name

TrustFLEX devices only use custom certificates for the custom PKI use cases. For all other TrustFLEX use cases, this selection is irrelevant because they don't use certificates.

  • Once the organization name has been entered, certificate data will be outputed and a manifest file to be uploaded into the public cloud of your choice (Google GCP, AWS IoT, and Microsoft® Azure) will be generated.

After running this Notebook, it generates the required resources and program data zone with required secrets, keys, and certificates. For this use case, the secret key is loaded into the TrustFLEX device in slot 5.

Use Case Prototyping

This hands-on lab is intended to demonstrate the usage of IP protection by authenticating the TrustFLEX device connected to the host. It uses symmetric authentication where both the host and TrustFLEX devices share a common secret.

This process uses a challenge-response model. In this model, the host authenticates the TrustFLEX device based on Message Authentication Code (MAC) response. MAC is calculated on the TrustFLEX device to prove that it holds the secret key that is shared by the host. Then the calculated MAC will be verified by the host to continue using IP.

MAC calculation on TrustFLEX includes device serial number, nonce (number used once), and shared secret key. By including serial number and nonce, the host can get a unique MAC from each TrustFLEX every time, thereby avoiding replay attacks.

The following sections provide detailed steps to execute this use case on Jupyter Notebook and an embedded project.

4.1 Running IP Protection example on Jupyter Notebook
  • From the Jupyter Home page, navigate to the TFLXTLS_Use_Cases\notebooks\ ipprotection\IP Protection with ECC608A-TFLXTLS Tutorial.ipynb notebook file and open it.

File Navigation Dialog

Opening the notebook from the Jupyter home page should load the following on the browser:

Junpyter Notebook Hompage

  • Run All Cells by selecting Kernel > Restart & Run All.

Restart & Run All

  • It may take a while for the cells to complete processing. The circle beside the "Python 3" text in the graphics accompanying indicate if the kernel is running (full circle) or idle (empty circle).

Kernel is running indicator

  • Navigate through different cells output for the description of the step and result from the execution
4.1.1 Generate MAC from the TrustFLEX device

The code block of this step generates a random challenge and expects TrustFLEX to provide the MAC for this challenge. The accessory calculates the MAC value by including its serial number, shared secret, and the challenge received from the host.

  • Calculate Nonce
    • To calculate the MAC, a nonce is used. The nonce is calculated based on the challenge which is initiated by the host. Then the calculated nonce will be stored in tempkey on TrustFLEX and on the host.
  • Calculate MAC on the accessory device
    • The MAC is calculated on the accessory device to prove that the accessory device has access and holds the secret key which is shared by the host. The accessory device MAC is calculated with the accessory device serial number, calculated nonce, and secret key.
  • The calculated MAC will be sent to the host to authenticate the accessory device.
  • The screenshot shows the accessory device MAC.

Sccessory Device MAC

4.1.2 Verify the expected MAC on the host

The code block of this step generates the Verify MAC button. Clicking the button performs a checkmac operation to verify if the MAC received from the accessory matches the host challenge, accessory serial number, and shared secret key. If any of these don't match, the checkmac operation fails indicating the accessory is not authentic.

Verify MAC Button

  • In Jupyter Notebook, run cells till the end of the notebook. You will see a Verify MAC button appear. Press the button. It will turn green if the accessory device is authenticated by the MCU or it will turn red indicating a failure to verify.
4.2 Running Accessory-Authentication on Embedded platform

This use case can also be executed on an embedded platform. Once the resources are generated, both Atmel Studio 7 and MPLAB X IDE projects provided can be used to run the application on the CryptoAuth Trust Platform.

Remember to provision the TrustFLEX device (execute the TrustFLEX Resource Generator notebook) before using these projects.

Select the IDE of your choice from the links below:

MPLAB X
Studio 7

MPLAB® X IDE

Open the example project in MPAB X IDE
Start the MPLAB X IDE and open the Accessory Authentication project.

  • Select File > Open Project.
  • Look in the trust_platform\DesignTools\TFLXTLS_Use_Cases\c\ip_protect\mplab folder.

  • Select the ip_protect.X file.

  • Click the Open Project button.

Open Project Dialog

The application source file ip_protect.c is found in this folder:
TFLXTLS_Use_Cases\c\ip_protect

The application source file ip_protect.c is found in this folder

Program the CryptoAuth Trust Platform
Click the Make and Program Device icon and wait for the "Programming complete” message to be displayed in the Output window.

Click the Make and Program Device icon

Programming Complete Dialog

Studio 7

Open the example project in MPLAB X  IDE
Open the IP protection project by double-clicking on it. You will find it here:
TFLXTLS_Use_Cases\c\ip_protect\studio\ip_protect.atsln.
The application source file ip_protect.c can be found in this folder:
TFLXTLS_Use_Cases\c\ip_protect.
Other supporting files can be found in the TFLXTLS_Use_Cases\c\dependencies folder.

Open Project Dialoag

Program the CryptoAuth Trust Platform
Click the Start Without Debugging icon and wait for the "Programming complete” message to be displayed in the Output window.

Program the CryptoAuth Trust Platform Dialog

Once the programming is done, the firmware will perform the IP Protection operation. Depending on the IP Protection operation’s output, the Cryptoauth Trust Platform board’s status LED will blink at different rates.

  • Success: LED blinks once every second.
  • Fail: LED blinks five times every second.

It is also possible to view the console messages by using a terminal emulation program (i.e., TeraTerm). Open the application with the COM port related to the CryptoAuth Trust Platform with 115200-8-N-1 settings.

Console messages using the terminal emulation program

CryptoAuth Trust Platform factory reset

Programming the CryptoAuth Trust Platform evaluation kit with this example project overwrites the project that was programmed onto the board when you received it. This project enables the board to be configured with the Jupyter Notebook.

To reprogram your board with the original project from the factory, see the "CryptoAuth Trust Platform Factory Reset" page.