Maxim Integrated / Mbed 2 deprecated DeepCover Embedded Security in IoT

MAXREFDES143#: DeepCover Embedded Security in IoT Authenticated Sensing & Notification

Dependencies:   MaximInterface mbed

The MAXREFDES143# is an Internet of Things (IoT) embedded security reference design, built to protect an industrial sensing node by means of authentication and notification to a web server. The hardware includes a peripheral module representing a protected sensor node monitoring operating temperature and remaining life of a filter (simulated through ambient light sensing) and an mbed shield representing a controller node responsible for monitoring one or more sensor nodes. The design is hierarchical with each controller node communicating data from connected sensor nodes to a web server that maintains a centralized log and dispatches notifications as necessary. The mbed shield contains a Wi-Fi module, a DS2465 coprocessor with 1-Wire® master function, an LCD, LEDs, and pushbuttons. The protected sensor node contains a DS28E15 authenticator, a DS7505 temperature sensor, and a MAX44009 light sensor. The mbed shield communicates to a web server by the onboard Wi-Fi module and to the protected sensor node with I2C and 1-Wire. The MAXREFDES143# is equipped with a standard shield connector for immediate testing using an mbed board such as the MAX32600MBED#. The simplicity of this design enables rapid integration into any star-topology IoT network requiring the heightened security with low overhead provided by the SHA-256 symmetric-key algorithm.

More information about the MAXREFDES143# is available on the Maxim Integrated website.

Factory.cpp@7:e24f0b29f1f7, 2016-05-13 (annotated)

Committer:
IanBenzMaxim
Date:
Fri May 13 14:54:04 2016 -0500
Revision:
7:e24f0b29f1f7
Parent:
6:b6bafd0a7013
Child:
8:594529956266
Updated following downstream restructuring in OneWire library.

Who changed what in which revision?

UserRevisionLine numberNew contents of line
IanBenzMaxim 1:e1c7c1c636af 1 /*******************************************************************************
IanBenzMaxim 1:e1c7c1c636af 2 * Copyright (C) 2016 Maxim Integrated Products, Inc., All Rights Reserved.
IanBenzMaxim 1:e1c7c1c636af 3 *
IanBenzMaxim 1:e1c7c1c636af 4 * Permission is hereby granted, free of charge, to any person obtaining a
IanBenzMaxim 1:e1c7c1c636af 5 * copy of this software and associated documentation files (the "Software"),
IanBenzMaxim 1:e1c7c1c636af 6 * to deal in the Software without restriction, including without limitation
IanBenzMaxim 1:e1c7c1c636af 7 * the rights to use, copy, modify, merge, publish, distribute, sublicense,
IanBenzMaxim 1:e1c7c1c636af 8 * and/or sell copies of the Software, and to permit persons to whom the
IanBenzMaxim 1:e1c7c1c636af 9 * Software is furnished to do so, subject to the following conditions:
IanBenzMaxim 1:e1c7c1c636af 10 *
IanBenzMaxim 1:e1c7c1c636af 11 * The above copyright notice and this permission notice shall be included
IanBenzMaxim 1:e1c7c1c636af 12 * in all copies or substantial portions of the Software.
IanBenzMaxim 1:e1c7c1c636af 13 *
IanBenzMaxim 1:e1c7c1c636af 14 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
IanBenzMaxim 1:e1c7c1c636af 15 * OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
IanBenzMaxim 1:e1c7c1c636af 16 * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
IanBenzMaxim 1:e1c7c1c636af 17 * IN NO EVENT SHALL MAXIM INTEGRATED BE LIABLE FOR ANY CLAIM, DAMAGES
IanBenzMaxim 1:e1c7c1c636af 18 * OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
IanBenzMaxim 1:e1c7c1c636af 19 * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
IanBenzMaxim 1:e1c7c1c636af 20 * OTHER DEALINGS IN THE SOFTWARE.
IanBenzMaxim 1:e1c7c1c636af 21 *
IanBenzMaxim 1:e1c7c1c636af 22 * Except as contained in this notice, the name of Maxim Integrated
IanBenzMaxim 1:e1c7c1c636af 23 * Products, Inc. shall not be used except as stated in the Maxim Integrated
IanBenzMaxim 1:e1c7c1c636af 24 * Products, Inc. Branding Policy.
IanBenzMaxim 1:e1c7c1c636af 25 *
IanBenzMaxim 1:e1c7c1c636af 26 * The mere transfer of this software does not imply any licenses
IanBenzMaxim 1:e1c7c1c636af 27 * of trade secrets, proprietary technology, copyrights, patents,
IanBenzMaxim 1:e1c7c1c636af 28 * trademarks, maskwork rights, or any other form of intellectual
IanBenzMaxim 1:e1c7c1c636af 29 * property whatsoever. Maxim Integrated Products, Inc. retains all
IanBenzMaxim 1:e1c7c1c636af 30 * ownership rights.
IanBenzMaxim 1:e1c7c1c636af 31 *******************************************************************************
IanBenzMaxim 1:e1c7c1c636af 32 */
IanBenzMaxim 1:e1c7c1c636af 33
IanBenzMaxim 1:e1c7c1c636af 34 #include "Factory.hpp"
IanBenzMaxim 1:e1c7c1c636af 35 #include "SensorNode.hpp"
IanBenzMaxim 1:e1c7c1c636af 36 #include "common.hpp"
IanBenzMaxim 6:b6bafd0a7013 37 #include "Masters/DS2465/DS2465.h"
IanBenzMaxim 6:b6bafd0a7013 38 #include "Authenticators/DS28E15_22_25/DS28E15_22_25.h"
IanBenzMaxim 6:b6bafd0a7013 39 #include "wait_api.h"
IanBenzMaxim 1:e1c7c1c636af 40
IanBenzMaxim 6:b6bafd0a7013 41 using OneWire::Masters::OneWireMaster;
IanBenzMaxim 6:b6bafd0a7013 42 using OneWire::Masters::DS2465;
IanBenzMaxim 6:b6bafd0a7013 43 using OneWire::OneWireSlave;
IanBenzMaxim 6:b6bafd0a7013 44 using OneWire::Authenticators::DS28E15_22_25;
IanBenzMaxim 6:b6bafd0a7013 45 using OneWire::Authenticators::ISha256MacCoproc;
IanBenzMaxim 6:b6bafd0a7013 46
IanBenzMaxim 6:b6bafd0a7013 47 const uint8_t Factory::masterSecret[] = { 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1A, 0x1B, 0x1C, 0x1D, 0x1E, 0x1F, 0x21,
IanBenzMaxim 1:e1c7c1c636af 48 0x22, 0x23, 0x24, 0x25, 0x26, 0x27, 0x28, 0x29, 0x2A, 0x2B, 0x2C, 0x2D, 0x2E, 0x2F, 0x31, 0x32 };
IanBenzMaxim 6:b6bafd0a7013 49 const uint8_t Factory::invalidMasterSecret[] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
IanBenzMaxim 1:e1c7c1c636af 50 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
IanBenzMaxim 1:e1c7c1c636af 51
IanBenzMaxim 1:e1c7c1c636af 52 bool Factory::provision(DS2465 & ds2465)
IanBenzMaxim 1:e1c7c1c636af 53 {
IanBenzMaxim 6:b6bafd0a7013 54 bool result = (ds2465.setMasterSecret(masterSecret) == ISha256MacCoproc::Success);
IanBenzMaxim 1:e1c7c1c636af 55 if (result)
IanBenzMaxim 1:e1c7c1c636af 56 {
IanBenzMaxim 1:e1c7c1c636af 57 SensorNode::AuthData authData;
IanBenzMaxim 1:e1c7c1c636af 58 DS28E15_22_25::Page pageData;
IanBenzMaxim 1:e1c7c1c636af 59 std::memset(pageData, SensorNode::defaultPaddingByte, pageData.length);
IanBenzMaxim 1:e1c7c1c636af 60 std::memcpy(pageData, authData.segment, authData.segment.length);
IanBenzMaxim 1:e1c7c1c636af 61 result = (ds2465.writeScratchpad(pageData, pageData.length) == OneWireMaster::Success);
IanBenzMaxim 1:e1c7c1c636af 62 }
IanBenzMaxim 1:e1c7c1c636af 63 if (result)
IanBenzMaxim 1:e1c7c1c636af 64 {
IanBenzMaxim 1:e1c7c1c636af 65 result = (ds2465.copyScratchpadToPage(0) == OneWireMaster::Success);
IanBenzMaxim 1:e1c7c1c636af 66 if (result)
IanBenzMaxim 1:e1c7c1c636af 67 wait_ms(DS2465::eepromPageWriteDelayMs);
IanBenzMaxim 1:e1c7c1c636af 68 }
IanBenzMaxim 1:e1c7c1c636af 69
IanBenzMaxim 1:e1c7c1c636af 70 return result;
IanBenzMaxim 1:e1c7c1c636af 71 }
IanBenzMaxim 1:e1c7c1c636af 72
IanBenzMaxim 1:e1c7c1c636af 73 bool Factory::provision(SensorNode & sensorNode, bool validSecret)
IanBenzMaxim 1:e1c7c1c636af 74 {
IanBenzMaxim 1:e1c7c1c636af 75 const int blockNum = sensorNode.authData.pageNum / 2;
IanBenzMaxim 1:e1c7c1c636af 76 const DS28E15_22_25::BlockProtection desiredProtection(false, false, false, true, blockNum); // Authentication Protection only
IanBenzMaxim 1:e1c7c1c636af 77
IanBenzMaxim 1:e1c7c1c636af 78 // Reset to starting defaults
IanBenzMaxim 1:e1c7c1c636af 79 sensorNode.authData.reset();
IanBenzMaxim 1:e1c7c1c636af 80
IanBenzMaxim 1:e1c7c1c636af 81 // Read current protection status
IanBenzMaxim 1:e1c7c1c636af 82 DS28E15_22_25::BlockProtection protectionStatus;
IanBenzMaxim 1:e1c7c1c636af 83 bool result;
IanBenzMaxim 1:e1c7c1c636af 84 // Select device through Skip ROM
IanBenzMaxim 7:e24f0b29f1f7 85 result = (sensorNode.ds2465.OWSkipRom() == OneWireMaster::Success);
IanBenzMaxim 1:e1c7c1c636af 86 if (result)
IanBenzMaxim 1:e1c7c1c636af 87 result = (sensorNode.ds28e15_22_25.readBlockProtection(blockNum, protectionStatus) == OneWireSlave::Success);
IanBenzMaxim 1:e1c7c1c636af 88 // Check if invalid protections are set
IanBenzMaxim 1:e1c7c1c636af 89 if (result)
IanBenzMaxim 1:e1c7c1c636af 90 result = ((protectionStatus.statusByte() & ~(desiredProtection.statusByte())) == 0x00);
IanBenzMaxim 1:e1c7c1c636af 91 // Select device through Skip ROM
IanBenzMaxim 1:e1c7c1c636af 92 if (result)
IanBenzMaxim 7:e24f0b29f1f7 93 result = (sensorNode.ds2465.OWSkipRom() == OneWireMaster::Success);
IanBenzMaxim 1:e1c7c1c636af 94 // Load secret into scratchpad
IanBenzMaxim 1:e1c7c1c636af 95 if (result)
IanBenzMaxim 1:e1c7c1c636af 96 result = (sensorNode.ds28e15_22_25.writeScratchpad(validSecret ? masterSecret : invalidMasterSecret) == OneWireSlave::Success);
IanBenzMaxim 1:e1c7c1c636af 97 // Select device through Skip ROM
IanBenzMaxim 1:e1c7c1c636af 98 if (result)
IanBenzMaxim 7:e24f0b29f1f7 99 result = (sensorNode.ds2465.OWSkipRom() == OneWireMaster::Success);
IanBenzMaxim 1:e1c7c1c636af 100 // Load master secret from scratchpad without locking
IanBenzMaxim 1:e1c7c1c636af 101 if (result)
IanBenzMaxim 1:e1c7c1c636af 102 result = (sensorNode.ds28e15_22_25.loadSecret(false) == OneWireSlave::Success);
IanBenzMaxim 1:e1c7c1c636af 103
IanBenzMaxim 1:e1c7c1c636af 104 // Setup is complete if not using a valid secret
IanBenzMaxim 1:e1c7c1c636af 105 if (!validSecret)
IanBenzMaxim 1:e1c7c1c636af 106 return result;
IanBenzMaxim 1:e1c7c1c636af 107
IanBenzMaxim 1:e1c7c1c636af 108 // Create constant partial secret
IanBenzMaxim 1:e1c7c1c636af 109 DS28E15_22_25::Scratchpad partialSecret;
IanBenzMaxim 1:e1c7c1c636af 110 DS28E15_22_25::Page pageData;
IanBenzMaxim 1:e1c7c1c636af 111 std::memset(partialSecret, SensorNode::defaultPaddingByte, partialSecret.length);
IanBenzMaxim 1:e1c7c1c636af 112
IanBenzMaxim 1:e1c7c1c636af 113 // Select device through Skip ROM
IanBenzMaxim 1:e1c7c1c636af 114 if (result)
IanBenzMaxim 7:e24f0b29f1f7 115 result = (sensorNode.ds2465.OWSkipRom() == OneWireMaster::Success);
IanBenzMaxim 1:e1c7c1c636af 116 // Read page data
IanBenzMaxim 1:e1c7c1c636af 117 if (result)
IanBenzMaxim 1:e1c7c1c636af 118 result = (sensorNode.ds28e15_22_25.readPage(sensorNode.authData.pageNum, pageData, false) == OneWireSlave::Success);
IanBenzMaxim 1:e1c7c1c636af 119 // Select device through Skip ROM
IanBenzMaxim 1:e1c7c1c636af 120 if (result)
IanBenzMaxim 7:e24f0b29f1f7 121 result = (sensorNode.ds2465.OWSkipRom() == OneWireMaster::Success);
IanBenzMaxim 1:e1c7c1c636af 122 // Load partial secret into scratchpad
IanBenzMaxim 1:e1c7c1c636af 123 if (result)
IanBenzMaxim 1:e1c7c1c636af 124 result = (sensorNode.ds28e15_22_25.writeScratchpad(partialSecret) == OneWireSlave::Success);
IanBenzMaxim 1:e1c7c1c636af 125 // Select device through Skip ROM
IanBenzMaxim 1:e1c7c1c636af 126 if (result)
IanBenzMaxim 7:e24f0b29f1f7 127 result = (sensorNode.ds2465.OWSkipRom() == OneWireMaster::Success);
IanBenzMaxim 1:e1c7c1c636af 128 // Compute secret
IanBenzMaxim 1:e1c7c1c636af 129 if (result)
IanBenzMaxim 1:e1c7c1c636af 130 result = (sensorNode.ds28e15_22_25.computeSecret(sensorNode.authData.pageNum, false) == OneWireSlave::Success);
IanBenzMaxim 1:e1c7c1c636af 131 // Configure slave secret on DS2465
IanBenzMaxim 1:e1c7c1c636af 132 if (result)
IanBenzMaxim 6:b6bafd0a7013 133 result = (DS28E15_22_25::computeNextSecret(sensorNode.ds2465, pageData, sensorNode.authData.pageNum, partialSecret, sensorNode.ds28e15_22_25.romId, sensorNode.ds28e15_22_25.manId) == ISha256MacCoproc::Success);
IanBenzMaxim 1:e1c7c1c636af 134 // Select device through Skip ROM
IanBenzMaxim 1:e1c7c1c636af 135 if (result)
IanBenzMaxim 7:e24f0b29f1f7 136 result = (sensorNode.ds2465.OWSkipRom() == OneWireMaster::Success);
IanBenzMaxim 1:e1c7c1c636af 137 // Enable authentication protection if not set
IanBenzMaxim 1:e1c7c1c636af 138 if (result && (protectionStatus != desiredProtection))
IanBenzMaxim 1:e1c7c1c636af 139 result = (sensorNode.ds28e15_22_25.writeAuthBlockProtection(sensorNode.ds2465, desiredProtection, protectionStatus) == OneWireSlave::Success);
IanBenzMaxim 1:e1c7c1c636af 140 // Select device through Skip ROM
IanBenzMaxim 1:e1c7c1c636af 141 if (result)
IanBenzMaxim 7:e24f0b29f1f7 142 result = (sensorNode.ds2465.OWSkipRom() == OneWireMaster::Success);
IanBenzMaxim 1:e1c7c1c636af 143 // Write initial filter life and set all other segments to default value
IanBenzMaxim 1:e1c7c1c636af 144 if (result)
IanBenzMaxim 1:e1c7c1c636af 145 {
IanBenzMaxim 1:e1c7c1c636af 146 DS28E15_22_25::Segment blankSegment;
IanBenzMaxim 1:e1c7c1c636af 147 std::memset(blankSegment, SensorNode::defaultPaddingByte, blankSegment.length);
IanBenzMaxim 6:b6bafd0a7013 148 for (size_t i = 0; i < DS28E15_22_25::segmentsPerPage; i++)
IanBenzMaxim 1:e1c7c1c636af 149 {
IanBenzMaxim 7:e24f0b29f1f7 150 result = (sensorNode.ds2465.OWSkipRom() == OneWireMaster::Success);
IanBenzMaxim 1:e1c7c1c636af 151 if (result)
IanBenzMaxim 1:e1c7c1c636af 152 result = (sensorNode.ds28e15_22_25.writeAuthSegment(sensorNode.ds2465, sensorNode.authData.pageNum, i,
IanBenzMaxim 1:e1c7c1c636af 153 ((i == sensorNode.authData.segmentNum) ? sensorNode.authData.segment : blankSegment),
IanBenzMaxim 2:e67d29a371db 154 pageData.toSegment(i), false) == OneWireSlave::Success);
IanBenzMaxim 1:e1c7c1c636af 155
IanBenzMaxim 1:e1c7c1c636af 156 if (!result)
IanBenzMaxim 1:e1c7c1c636af 157 break;
IanBenzMaxim 1:e1c7c1c636af 158 }
IanBenzMaxim 1:e1c7c1c636af 159 }
IanBenzMaxim 1:e1c7c1c636af 160
IanBenzMaxim 1:e1c7c1c636af 161 // Reload secret with known page values
IanBenzMaxim 1:e1c7c1c636af 162 // Select device through Skip ROM
IanBenzMaxim 1:e1c7c1c636af 163 if (result)
IanBenzMaxim 7:e24f0b29f1f7 164 result = (sensorNode.ds2465.OWSkipRom() == OneWireMaster::Success);
IanBenzMaxim 1:e1c7c1c636af 165 // Load master secret into scratchpad
IanBenzMaxim 1:e1c7c1c636af 166 if (result)
IanBenzMaxim 1:e1c7c1c636af 167 result = (sensorNode.ds28e15_22_25.writeScratchpad(masterSecret) == OneWireSlave::Success);
IanBenzMaxim 1:e1c7c1c636af 168 // Select device through Skip ROM
IanBenzMaxim 1:e1c7c1c636af 169 if (result)
IanBenzMaxim 7:e24f0b29f1f7 170 result = (sensorNode.ds2465.OWSkipRom() == OneWireMaster::Success);
IanBenzMaxim 1:e1c7c1c636af 171 // Load master secret
IanBenzMaxim 1:e1c7c1c636af 172 if (result)
IanBenzMaxim 1:e1c7c1c636af 173 result = (sensorNode.ds28e15_22_25.loadSecret(false) == OneWireSlave::Success);
IanBenzMaxim 1:e1c7c1c636af 174 // Select device through Skip ROM
IanBenzMaxim 1:e1c7c1c636af 175 if (result)
IanBenzMaxim 7:e24f0b29f1f7 176 result = (sensorNode.ds2465.OWSkipRom() == OneWireMaster::Success);
IanBenzMaxim 1:e1c7c1c636af 177 // Read page data
IanBenzMaxim 1:e1c7c1c636af 178 if (result)
IanBenzMaxim 1:e1c7c1c636af 179 result = (sensorNode.ds28e15_22_25.readPage(sensorNode.authData.pageNum, pageData, false) == OneWireSlave::Success);
IanBenzMaxim 1:e1c7c1c636af 180 // Select device through Skip ROM
IanBenzMaxim 1:e1c7c1c636af 181 if (result)
IanBenzMaxim 7:e24f0b29f1f7 182 result = (sensorNode.ds2465.OWSkipRom() == OneWireMaster::Success);
IanBenzMaxim 1:e1c7c1c636af 183 // Write partial secret to scratchpad
IanBenzMaxim 1:e1c7c1c636af 184 if (result)
IanBenzMaxim 1:e1c7c1c636af 185 result = (sensorNode.ds28e15_22_25.writeScratchpad(partialSecret) == OneWireSlave::Success);
IanBenzMaxim 1:e1c7c1c636af 186 // Select device through Skip ROM
IanBenzMaxim 1:e1c7c1c636af 187 if (result)
IanBenzMaxim 7:e24f0b29f1f7 188 result = (sensorNode.ds2465.OWSkipRom() == OneWireMaster::Success);
IanBenzMaxim 1:e1c7c1c636af 189 // Compute secret
IanBenzMaxim 1:e1c7c1c636af 190 if (result)
IanBenzMaxim 1:e1c7c1c636af 191 result = (sensorNode.ds28e15_22_25.computeSecret(sensorNode.authData.pageNum, false) == OneWireSlave::Success);
IanBenzMaxim 1:e1c7c1c636af 192 // Configure slave secret on DS2465
IanBenzMaxim 1:e1c7c1c636af 193 if (result)
IanBenzMaxim 6:b6bafd0a7013 194 result = (DS28E15_22_25::computeNextSecret(sensorNode.ds2465, pageData, sensorNode.authData.pageNum, partialSecret, sensorNode.ds28e15_22_25.romId, sensorNode.ds28e15_22_25.manId) == ISha256MacCoproc::Success);
IanBenzMaxim 1:e1c7c1c636af 195
IanBenzMaxim 1:e1c7c1c636af 196 return result;
IanBenzMaxim 1:e1c7c1c636af 197 }