Secure Authentication Knowledge Base

cancel
Showing results for 
Search instead for 
Did you mean: 

Secure Authentication Knowledge Base

Labels

Discussions

This documentation shows how to connect with SE050 based on NFC Cockpit tool and a PNEV5180B dev board.
View full article
This example shows all steps for a onboarding process of a device to AWS IoT Core using the pre-provisioned credentials of the EdgeLock SE050 secure element. AWS IoT authenticates client certificates using the TLS protocol's client authentication mode. In TLS client authentication, AWS IoT requests an X.509 client certificate and validates the certificate's status against a registry of certificates in the AWS account. It challenges the client for proof of ownership of the private key that corresponds to the public key contained in the certificate. The secure element EdgeLock SE050 is used to securely store the private client keys and perform the client authentication. AWS IoT supports these types of X.509 client certificates, all are supported by Edgelock SE050: X.509 certificates generated by AWS IoT X.509 certificates signed by a CA registered with AWS IoT. X.509 certificates signed by a CA that is not registered with AWS IoT. Client certificates must be registered with AWS IoT before a client can communicate with AWS IoT. Only Option 3 supports the onboarding process of a device to AWS IoT Core using pre-provisioned credentials of a generic EdgeLock SE050. This option is known as “AWS IoT Core Multi-Account Registration” and generally available since 30th April 2020 and supported by the AWS CLI interface. Customer-specific configurations of Edgelock SE050 can even use Option 2 with pre-provisioned certificates. Hardware setup Hardware Prerequisite The following hardware will be used for this demo:      Raspberry Pi 3 Model B+      OM-SE050ARD development kit (NXP 12NC 935383282598)       Optional - OM-SE050RPI adapter board for Raspberry Pi (12NC 935379833598) [1] https://www.nxp.com/products/security-and-authentication/authentication/edgelock-se050-development-kit:OM-SE050X [1] .. For further details see NXP “AN12570 Quick start guide with Raspberry Pi” chapter “2 Prepare your Raspberry Pi”. In the following sections, we will use the OM-SE050RPI adapter board. Connecting the OM-SE050ARD to the Raspberry Pi Make sure the jumpers in your OM-SE050ARD board are configured as shown in the figure below (equal to the default configuration of OM-SE050ARD): Stack the OM-SE050ARD with the adapter board to the Raspberry Pi Alternative it is possible to connect the OM-SE050ARD via wires to the Raspberry Pi board as shown in the figure below: Software Setup This section explains how to get your Raspberry Pi ready to execute the EdgeLock  SE050 Plug & Trust middleware. Prerequisite AWS account a current Raspbian should be running on Raspberry Pi. The detailed Raspberry Pi software setup is described in the “AN12570 Quick start guide with Raspberry Pi” chapter “2.2 Software setup”. Enable I2C if not yet enabled on your Raspberry Pi. ls /sys/bus/i2c/devices If does not list i2c-1, I2C needs to be enabled for your board. sudo raspi-config Use the down arrow to select Interfacing Options. Follow instructions and Enable I2C. Create a new folder called se050_ middleware: cd ~ mkdir se050_middleware cd se050_middleware EdgeLock SE050 Plug & Trust middleware - Build Instructions   Install the required build tools, if the image does not have them already. sudo apt-get install cmake cmake-curses-gui cmake-gui libssl-dev   Download the EdgeLock SE050 Plug & Trust middleware (nxp.com login needed) from the NXP website  .   Unzip the EdgeLock SE050 Plug & Trust middleware in the se050_middleware folder: unzip ~/Downloads/SE050-PLUG-TRUST-MW.zip -d ~/se050_middleware   Run the following commands to build OpenSSL engine for SE050. For further details see please “AN12570 Quick start guide with Raspberry Pi” chapter “3.2 Build EdgeLock SE050 Plug & Trust middleware”. If the hostname is “raspberrypi” automatically the config for a Raspberry Pi is created: cd simw-top python3 scripts/create_cmake_projects.py cd ~/se050_middleware/simw-top_build/raspbian_native_se050_t1oi2c cmake --build . sudo make install sudo ldconfig /usr/local/lib Install the ssscli tool In this example, the SE050 Python-based ssscli tool is used to extract the credentials of the EdgeLock SE050 . The following steps are needed before running the ssscli tool and needed are needed once per installation.   sudo apt-get install python3-pip sudo apt-get install libffi-dev cd ~/se050_middleware/simw-top/pycli pip3 install -r requirements.txt     To install ssscli tool, run the following commands once:  pip3 install --editable src   Install AWS CLI To install the AWS CLI tool, run the following commands once: pip3 install awscli --upgrade –user Add AWS CLI executable to your Command-Line Path: export PATH=/home/pi/.local/bin:$PATH Confirm the AWS CLI tool was successful installed: aws --version   Configure AWS Get access key ID and secret access key To access AWS, you will need to sign up for an AWS account. Access keys consist of an access key ID and secret access key, which are used to sign programmatic requests that you make to AWS. If you don't have access keys, you can create them by using the IAM console at https://console.aws.amazon.com/iam/-. To get your access key ID and secret access key:       Open the IAM console at https://console.aws.amazon.com/iam/ .       On the navigation menu, choose Users.       Choose your IAM user name (not the checkbox).       Open the Security credentials tab, and then choose to Create an access key.       To see the new access key, choose Show. Your credentials resemble the following:      Access key ID:     Secret access key:        To download the key pair, choose the Download .csv file. Store the .csv file with keys in a secure location. Set AWS crededentials in AWS cli You can save your frequently used configuration settings and credentials in files that are maintained by the AWS CLI. Run the following command to quickly set your credentials, region, and output format: aws configure Example: $ aws configure AWS Access Key ID [None]: <access key ID> AWS Secret Access Key [None]: <secret access key> Default region name [None]: <aws region name> Default output format [None]: json   Using credentials from EdgeLock SE050 We will be using ECC credentials in this example, the key with ID 0xF0000100 and the corresponding certificate at ID 0xF0000101. You can use any of the available certificates that are pre-provisioned in your EdgeLock SE050. Please refer to AN12436 - SE050 Configurations for a list of available key and certificate IDs.   Create a folder to store the EdgeLock SE050 credentials: cd ~/se050_middleware/ mkdir se050_device_credentials cd se050_device_credentialsls Extracting the EdgeLock SE050 Device Certificate Using pySSSCLI Tool, read out the device certificate. ssscli connect se050 t1oi2c none ssscli get cert 0xF0000101 se050_device_cert0_ecc.cer Creating the EdgeLock SE050 Device Key Reference The private device key is securely stored inside the EdgeLock SE050 and cannot be readout. The EdgeLock SE050 Device Reference Key is used by the OpenSSL Engine to invoke the SE050 private key operation.   Using pySSSCLI Tool, read out the device reference key. sudo ssscli refpem ecc pair 0xF0000100 se050_device_key_ref0_ecc.pem ssscli disconnect Registering Device Certificate Use the AWS CLI Tool to register the extracted device certificate on to your AWS IoT Console. The command line options are: aws iot register-certificate-without-ca --certificate-pem <certificate-filename>   Execute the following command: aws iot register-certificate-without-ca --certificate-pem file://se050_device_cert0_ecc.cer --status ACTIVE   This command returns the certificate ANR and ANR ID. A certificate Amazon Resource Name (ARN) uniquely identifies this certificate. You can open the AWS IoT console to check if the certificate was successfully registered.   Create an AWS IoT policy. First, create a JSON document “se050_raspi_policy.json” with the following content. Note: this policy allows for demo purpose access to all iot actions on all resources. {   "Version": "2012-10-17",   "Statement": [     {       "Effect": "Allow",       "Action": "iot:*",       "Resource": "*"     }   ] }   using for example the nano editor. The following command creates an empty file. nano se050_raspi_policy.json Copypaste the content into the text editor and save the file.     Use the AWS CLI Tool to create the policy on your AWS IoT Console. aws iot create-policy --policy-name se050_raspi_policy --policy-document file://se050_raspi_policy.json   You can open the AWS IoT console to check if the policy was successfully created.       Attach AWS IoT policy to certificate. Attaching an AWS IoT Core policy to a certificate gives the device connecting with this certificate the permissions specified in the policy.   Use the AWS CLI Tool to attach the policy to the device certificate.  aws iot attach-policy --target <certificate ARN> --policy-name se050_raspi_policy      Obtain the custom AWS IoT endpoint URL Run the following command to print out your AWS’ user’s endpoint address. This will be used later: aws iot describe-endpoint --endpoint-type iot:Data-ATS   Alterative you can obtain the customer AWS IoT endpoint using the AWS IoT console .        Run the IoT demo MQTT Example Navigate to demos/linux/aws_eou directory and execute the buildScript.sh. This will build the project iot_demo_mqtt.  cd ~/se050_middleware/simw-top/demos/linux/aws_eou/ chmod +x buildScript.sh ./buildScript.sh Copy all SE50 credentials into the example output/bin folder: cd ~/se050_middleware/simw-top/demos/linux/aws_eou/aws-iot-device-sdk-embedded-C/build/output/bin cp ~/se050_middleware/simw-top/demos/linux/aws_eou/AmazonRootCA1.pem ~/se050_middleware/simw-top/demos/linux/aws_eou/aws-iot-device-sdk-embedded-C/build/output/bin cp ~/se050_middleware/se050_device_credentials/se050_device_cert0_ecc.cer ~/se050_middleware/simw-top/demos/linux/aws_eou/aws-iot-device-sdk-embedded-C/build/output/bin cp ~/se050_middleware/se050_device_credentials/se050_device_key_ref0_ecc.pem ~/se050_middleware/simw-top/demos/linux/aws_eou/aws-iot-device-sdk-embedded-C/build/output/bin To let openSSL use the engine set the openssl config path to point to the preconfigured config file: export OPENSSL_CONF=/home/pi/se050_middleware/simw-top/demos/linux/common/openssl11_sss_se050.cnf   Navigate to demos binary folder: cd ~/se050_middleware/simw-top/demos/linux/aws_eou/aws-iot-device-sdk-embedded-C/build/output/bin Run the demo with specifying your endpoint URL and certificate + key files: ./iot_demo_mqtt -i "ThingName" -h <endpoint> -r AmazonRootCA1.pem -c <certificate-filename> -k <ref-filename> For example: ./iot_demo_mqtt -i "myRaspiSE050" -h <endpoint> -r AmazonRootCA1.pem -c se050_device_cert0_ecc.cer -k se050_device_key_ref0_ecc.pem   Go to the AWS IoT Core dashboard and subscribe to the following topic: iotdemo/#     The MQTT topic you subscribed will now appear in the Subscriptions section as shown in the figure below.  
View full article
Introduction This is an exercise porting one of the SE050 examples from the NXP Secure Element Host library (se_hostlib) to another NXP MCU.  Appnote AN12448 EdgeLockTM SE050 Plug & Trust middleware porting guidelines is a great resource for porting the library to other targets.  This exercise provides additional details porting a project for MCUXpresso IDE to a different MCU.  The se_hostlib example used here is the se05x_get_info project.  The library provides this example for the RT1050 devices, and this exercise ports to the similar RT1060.  A simpler method might be to take the existing se_hostlib project, and change the device for the new target MCU, and tweak some other project settings.  But this exercise builds the ported project from scratch, to demonstrate how se_hostlib project can be created or added to another application.  NXP’s MCUXpresso IDE is used for this, but these general steps should also apply to other IDEs.    The projects and software used here are included in NXP’s MCUXpresso Software Development Kit (SDK), and can be download from https://mcuxpresso.nxp.com/, using SDK version 2.7.0.  The se_hostlib is provided in the SDK package for EVKB-IMXRT1050, and the example ported is \SDK_2.7.0\boards\evkbimxrt1050\se_hostlib_examples\se_SE05x_Get_Info.  The targeted MCU for the port uses the SDK package for EVK-MIMXRT1060, and the initial project used to start the port is hello_world at \SDK_2.7.0\boards\evkmimxrt1060\demo_apps\hello_world.  MCUXpresso IDE v 11.1.1 is used in this exercise.   Change application source files The hello_world demo for RT1060 is imported into MCUXpresso IDE using the default project settings.  The new project is renamed evkmimxrt1060_se_hostlib_se05x_get_info.  Then the following changes are made:   Removed: Source/hello_world.c   Copied the following source folders from evkbimxrt1050_se_hostlib_se05x_get_info: Doc MbedTLS se_hostlib source   For the RT1060 app, I kept these files from hello_world: Board CMSIS Component Device Drivers Startup Utilities Xip   And added these additional driver files used in the RT1050 example from \SDK_2.7.0\devices\MIMXRT1062\drivers to project \evkmimxrt1060_se_hostlib_se05x_get_info\drivers fsl_dcp.c fsl_dcp.h fsl_lpi2c.c fsl_lpi2c.h fsl_pit.c fsl_pit.h fsl_trng.c fsl_trng.h     Copy project preprocessor definitions The se_hostlib uses many preprocessor definitions to configure the library.  Updated the project properties for the compiler preprocessor definitions from the RT1050 example are used, and made the following changes to the RT1060 project:   Added: SDK_DEBUGCONSOLE_UART PHDRIVER_IMXRT1050RC663_BOARD IMX_RT MBEDTLS_CONFIG_FILE='&quot;a71ch_mbedtls_evkbimxrt1050_config.h&quot;' MBEDTLS SCP_MODE=C_MAC_C_ENC_R_MAC_R_ENC T1oI2C T1oI2C_UM1225_SE050 SSS_USE_FTR_FILE NO_SECURE_CHANNEL_SUPPORT __NEWLIB__ (MCUXpresso IDE does this automatically with the linker changes below)   Changed: PRINTF_ADVANCED_ENABLE=1   Removed:                                                                                                                           __REDLIB__ (MCUXpresso IDE does this automatically with the linker changes below)     Change linker settings Based on the preprocessor definitions above, I realized the RT1050 project used the NewLibNano runtime library in the IDE.  The linker settings were updated to change the library from RedLib to NewLibNano (this step could have been done during the SDK project import into MCUXpresso IDE).  Also the linker placement of all RAM is changed to the RT1060 SRAM_DTC region, and heap and stack sizes updated to match the RT1050 example.     Change compiler include paths Added the following paths for se_hostlib and mbedTLS to the compiler includes: "${workspace_loc:/${ProjName}/mbedtls/port/ksdk}" "${workspace_loc:/${ProjName}/se_hostlib/hostlib/hostLib/inc}" "${workspace_loc:/${ProjName}/se_hostlib/sss/inc}" "${workspace_loc:/${ProjName}/se_hostlib/sss/port/ksdk}" "${workspace_loc:/${ProjName}/se_hostlib/hostlib/hostLib/platform/inc}" "${workspace_loc:/${ProjName}/se_hostlib/hostlib/hostLib/libCommon/smCom/T1oI2C}" "${workspace_loc:/${ProjName}/se_hostlib/hostlib/hostLib/libCommon/smCom}" "${workspace_loc:/${ProjName}/se_hostlib/hostlib/hostLib/libCommon/infra}" "${workspace_loc:/${ProjName}/se_hostlib/sss/ex/inc}" "${workspace_loc:/${ProjName}/se_hostlib/sss/ex/src}" "${workspace_loc:/${ProjName}/se_hostlib/hostlib/hostLib/se05x_03_xx_xx}" "${workspace_loc:/${ProjName}/se_hostlib/hostlib/hostLib/mbedtls/inc}" "${workspace_loc:/${ProjName}/se_hostlib/sss/plugin/mbedtls}" "${workspace_loc:/${ProjName}/mbedtls/include}"     Port macros in source code Some of the application source configures for the RT1050 MCU using macros defined in the preprocessor settings.  This code should all apply to the RT1060 as well, but needs to be modified to use different macros.  Source updated the following in a few places.  Search for CPU_MIMXRT1052DVL6B to find these: #ifdefined(CPU_MIMXRT1052DVL6B)   Changed to #if(defined(CPU_MIMXRT1052DVL6B) || defined(CPU_MIMXRT1062DVL6A))   In the following locations: axReset_HostConfigure () In ax_reset.c i2c_imxrt10xx.c ex_ss_main_inc_imx_rt.h in the header file includes se_reset_config.h   Configure RT1060 pins To interface to the SE050, the example uses I2C peripheral and a GPIO pin for reset.  The new project needs to enable these pins in the pinmux settings, configured in pinmux.c.  Copying I2CPins() from RT1050 pinmux.c, and adding to RT1060 pinmux.c.  Then add call to I2CPins() in BOARD_InitBootPins() in pinmux.c, and add declaration of I2CPins() to pinmux.h   For the GPIO reset pin, the RT1050 example set the pinmux in spiPins().  Since SPI is not used, I just added this pin to the existing BOARD_InitPins().  Copy the line below from RT1050 pinmux.c, and add to BOARD_InitPins() for RT1060.       //Reset       IOMUXC_SetPinMux(       IOMUXC_GPIO_AD_B0_10_GPIO1_IO10,        /* GPIO_AD_B0_10 is configured as GPIO1_IO10 */       0U);                                    /* Software Input On Field: Input Path is determined by functionality */   Summary With these changes, the RT1060 project builds without any errors or warnings, and runs on the RT1060 as documented in the readme files from the RT1050 project.  The completed ported project for RT1060 is attached here.
View full article
This article is a collection of frequently asked questions (FAQs) around A71CH solution, NXP's IoT security IC supporting the 'Plug & Trust' approach to IoT security . How can I get started? How can I start a development with A71CH?  How can I get started with i.MX6UltraLite?   How can I get started if I want to onboard my device to Google Cloud IoT core?  How can I get started if I want to onboard my device to AWS IoT Core?  Features Which type of credentials can be stored in A71CH?  How can I use A71CH for mutual authentication?  Support package Where can I find A71CH support material?  What does the A71CH support package include?  Ordering details How can I order an A71CH Arduino compatible development kit?   How can I order A71CH ICs? 
View full article