Maxim Integrated / Mbed 2 deprecated DeepCover Embedded Security in IoT

MAXREFDES143#: DeepCover Embedded Security in IoT Authenticated Sensing & Notification

Dependencies:   MaximInterface mbed

The MAXREFDES143# is an Internet of Things (IoT) embedded security reference design, built to protect an industrial sensing node by means of authentication and notification to a web server. The hardware includes a peripheral module representing a protected sensor node monitoring operating temperature and remaining life of a filter (simulated through ambient light sensing) and an mbed shield representing a controller node responsible for monitoring one or more sensor nodes. The design is hierarchical with each controller node communicating data from connected sensor nodes to a web server that maintains a centralized log and dispatches notifications as necessary. The mbed shield contains a Wi-Fi module, a DS2465 coprocessor with 1-Wire® master function, an LCD, LEDs, and pushbuttons. The protected sensor node contains a DS28E15 authenticator, a DS7505 temperature sensor, and a MAX44009 light sensor. The mbed shield communicates to a web server by the onboard Wi-Fi module and to the protected sensor node with I2C and 1-Wire. The MAXREFDES143# is equipped with a standard shield connector for immediate testing using an mbed board such as the MAX32600MBED#. The simplicity of this design enables rapid integration into any star-topology IoT network requiring the heightened security with low overhead provided by the SHA-256 symmetric-key algorithm.

More information about the MAXREFDES143# is available on the Maxim Integrated website.

SensorNode.cpp@11:aeaa77b488c0, 2016-05-16 (annotated)

Committer:
IanBenzMaxim
Date:
Mon May 16 15:19:54 2016 -0500
Revision:
11:aeaa77b488c0
Parent:
9:bc3d211d75ce
Child:
14:0962f818bf7f
Updated following downstream restructuring in OneWire library.

Who changed what in which revision?

UserRevisionLine numberNew contents of line
IanBenzMaxim 1:e1c7c1c636af 1 /*******************************************************************************
IanBenzMaxim 1:e1c7c1c636af 2 * Copyright (C) 2016 Maxim Integrated Products, Inc., All Rights Reserved.
IanBenzMaxim 1:e1c7c1c636af 3 *
IanBenzMaxim 1:e1c7c1c636af 4 * Permission is hereby granted, free of charge, to any person obtaining a
IanBenzMaxim 1:e1c7c1c636af 5 * copy of this software and associated documentation files (the "Software"),
IanBenzMaxim 1:e1c7c1c636af 6 * to deal in the Software without restriction, including without limitation
IanBenzMaxim 1:e1c7c1c636af 7 * the rights to use, copy, modify, merge, publish, distribute, sublicense,
IanBenzMaxim 1:e1c7c1c636af 8 * and/or sell copies of the Software, and to permit persons to whom the
IanBenzMaxim 1:e1c7c1c636af 9 * Software is furnished to do so, subject to the following conditions:
IanBenzMaxim 1:e1c7c1c636af 10 *
IanBenzMaxim 1:e1c7c1c636af 11 * The above copyright notice and this permission notice shall be included
IanBenzMaxim 1:e1c7c1c636af 12 * in all copies or substantial portions of the Software.
IanBenzMaxim 1:e1c7c1c636af 13 *
IanBenzMaxim 1:e1c7c1c636af 14 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
IanBenzMaxim 1:e1c7c1c636af 15 * OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
IanBenzMaxim 1:e1c7c1c636af 16 * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
IanBenzMaxim 1:e1c7c1c636af 17 * IN NO EVENT SHALL MAXIM INTEGRATED BE LIABLE FOR ANY CLAIM, DAMAGES
IanBenzMaxim 1:e1c7c1c636af 18 * OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
IanBenzMaxim 1:e1c7c1c636af 19 * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
IanBenzMaxim 1:e1c7c1c636af 20 * OTHER DEALINGS IN THE SOFTWARE.
IanBenzMaxim 1:e1c7c1c636af 21 *
IanBenzMaxim 1:e1c7c1c636af 22 * Except as contained in this notice, the name of Maxim Integrated
IanBenzMaxim 1:e1c7c1c636af 23 * Products, Inc. shall not be used except as stated in the Maxim Integrated
IanBenzMaxim 1:e1c7c1c636af 24 * Products, Inc. Branding Policy.
IanBenzMaxim 1:e1c7c1c636af 25 *
IanBenzMaxim 1:e1c7c1c636af 26 * The mere transfer of this software does not imply any licenses
IanBenzMaxim 1:e1c7c1c636af 27 * of trade secrets, proprietary technology, copyrights, patents,
IanBenzMaxim 1:e1c7c1c636af 28 * trademarks, maskwork rights, or any other form of intellectual
IanBenzMaxim 1:e1c7c1c636af 29 * property whatsoever. Maxim Integrated Products, Inc. retains all
IanBenzMaxim 1:e1c7c1c636af 30 * ownership rights.
IanBenzMaxim 1:e1c7c1c636af 31 *******************************************************************************
IanBenzMaxim 1:e1c7c1c636af 32 */
IanBenzMaxim 1:e1c7c1c636af 33
IanBenzMaxim 1:e1c7c1c636af 34 #include "SensorNode.hpp"
IanBenzMaxim 1:e1c7c1c636af 35 #include "common.hpp"
IanBenzMaxim 6:b6bafd0a7013 36 #include "Masters/DS2465/DS2465.h"
IanBenzMaxim 6:b6bafd0a7013 37 #include "I2C.h"
IanBenzMaxim 1:e1c7c1c636af 38
IanBenzMaxim 1:e1c7c1c636af 39 #ifdef TARGET_MAX32600
IanBenzMaxim 1:e1c7c1c636af 40 #include "max32600.h"
IanBenzMaxim 1:e1c7c1c636af 41 #include "clkman_regs.h"
IanBenzMaxim 1:e1c7c1c636af 42 #include "tpu_regs.h"
IanBenzMaxim 1:e1c7c1c636af 43 #else
IanBenzMaxim 1:e1c7c1c636af 44 #include <cstdlib>
IanBenzMaxim 1:e1c7c1c636af 45 #endif
IanBenzMaxim 1:e1c7c1c636af 46
IanBenzMaxim 8:594529956266 47 using namespace OneWire;
IanBenzMaxim 6:b6bafd0a7013 48
IanBenzMaxim 1:e1c7c1c636af 49 bool SensorNode::rngInitialized = false;
IanBenzMaxim 1:e1c7c1c636af 50
IanBenzMaxim 1:e1c7c1c636af 51 void SensorNode::initializeRng()
IanBenzMaxim 1:e1c7c1c636af 52 {
IanBenzMaxim 1:e1c7c1c636af 53 #ifdef TARGET_MAX32600
IanBenzMaxim 1:e1c7c1c636af 54 MXC_CLKMAN->clk_config |= (MXC_F_CLKMAN_CLK_CONFIG_CRYPTO_ENABLE | MXC_F_CLKMAN_CLK_CONFIG_CRYPTO_RESET_N); // Enable crypto oscillator
IanBenzMaxim 1:e1c7c1c636af 55 while ((MXC_CLKMAN->intfl & MXC_F_CLKMAN_INTFL_CRYPTO_STABLE) != MXC_F_CLKMAN_INTFL_CRYPTO_STABLE) ; // Wait for crypto oscillator stability
IanBenzMaxim 1:e1c7c1c636af 56 MXC_CLKMAN->clk_ctrl |= MXC_F_CLKMAN_CLK_CTRL_CRYPTO_GATE_N; // Disable crypto clock gating
IanBenzMaxim 1:e1c7c1c636af 57 MXC_CLKMAN->crypt_clk_ctrl_2_prng = MXC_CLKMAN->clk_ctrl_10_prng = 1; // Set PRNG clock to crypto clock
IanBenzMaxim 1:e1c7c1c636af 58 MXC_CLKMAN->clk_gate_ctrl2 |= (1 << MXC_F_CLKMAN_CLK_GATE_CTRL2_TPU_CLK_GATER_POS); // Use dynamic clock gating
IanBenzMaxim 1:e1c7c1c636af 59 #endif
IanBenzMaxim 1:e1c7c1c636af 60 }
IanBenzMaxim 1:e1c7c1c636af 61
IanBenzMaxim 6:b6bafd0a7013 62 SensorNode::SensorNode(mbed::I2C & i2c, uint8_t ds7505_i2c_addr, uint8_t max44009_i2c_addr, DS2465 & ds2465)
IanBenzMaxim 9:bc3d211d75ce 63 : m_initialLux(1),ds2465(ds2465), selector(ds2465), ds28e15_22_25(selector), ds7505(i2c, ds7505_i2c_addr), max44009(i2c, max44009_i2c_addr)
IanBenzMaxim 1:e1c7c1c636af 64 {
IanBenzMaxim 1:e1c7c1c636af 65 if (!rngInitialized)
IanBenzMaxim 1:e1c7c1c636af 66 {
IanBenzMaxim 1:e1c7c1c636af 67 initializeRng();
IanBenzMaxim 1:e1c7c1c636af 68 rngInitialized = true;
IanBenzMaxim 1:e1c7c1c636af 69 }
IanBenzMaxim 1:e1c7c1c636af 70 }
IanBenzMaxim 1:e1c7c1c636af 71
IanBenzMaxim 1:e1c7c1c636af 72 bool SensorNode::initializeSensors()
IanBenzMaxim 1:e1c7c1c636af 73 {
IanBenzMaxim 1:e1c7c1c636af 74 return (max44009.read_current_lux(m_initialLux) == MAX44009::Success);
IanBenzMaxim 1:e1c7c1c636af 75 }
IanBenzMaxim 1:e1c7c1c636af 76
IanBenzMaxim 1:e1c7c1c636af 77 bool SensorNode::setSecret()
IanBenzMaxim 1:e1c7c1c636af 78 {
IanBenzMaxim 1:e1c7c1c636af 79 DS28E15_22_25::Scratchpad scratchpad;
IanBenzMaxim 1:e1c7c1c636af 80 DS28E15_22_25::Page pageData;
IanBenzMaxim 1:e1c7c1c636af 81
IanBenzMaxim 1:e1c7c1c636af 82 // Create constant partial secret
IanBenzMaxim 1:e1c7c1c636af 83 std::memset(scratchpad, defaultPaddingByte, scratchpad.length);
IanBenzMaxim 1:e1c7c1c636af 84 // Read page data
IanBenzMaxim 11:aeaa77b488c0 85 bool result = (ds2465.readMemory(DS2465::UserMemoryPage0, pageData, pageData.length, false) == OneWireMaster::Success);
IanBenzMaxim 1:e1c7c1c636af 86 // Calculate secret
IanBenzMaxim 1:e1c7c1c636af 87 if (result)
IanBenzMaxim 1:e1c7c1c636af 88 {
IanBenzMaxim 6:b6bafd0a7013 89 result = (DS28E15_22_25::computeNextSecret(ds2465, pageData, authData.pageNum, scratchpad, ds28e15_22_25.romId, ds28e15_22_25.manId) == ISha256MacCoproc::Success);
IanBenzMaxim 1:e1c7c1c636af 90 }
IanBenzMaxim 1:e1c7c1c636af 91 return result;
IanBenzMaxim 1:e1c7c1c636af 92 }
IanBenzMaxim 1:e1c7c1c636af 93
IanBenzMaxim 1:e1c7c1c636af 94 bool SensorNode::checkProvisioned(bool & provisioned)
IanBenzMaxim 1:e1c7c1c636af 95 {
IanBenzMaxim 1:e1c7c1c636af 96 DS28E15_22_25::BlockProtection protectionStatus;
IanBenzMaxim 1:e1c7c1c636af 97 bool result;
IanBenzMaxim 1:e1c7c1c636af 98
IanBenzMaxim 9:bc3d211d75ce 99
IanBenzMaxim 9:bc3d211d75ce 100 result = (ds28e15_22_25.readBlockProtection(0, protectionStatus) == OneWireSlave::Success);
IanBenzMaxim 1:e1c7c1c636af 101 if (result)
IanBenzMaxim 1:e1c7c1c636af 102 {
IanBenzMaxim 1:e1c7c1c636af 103 if (!protectionStatus.noProtection())
IanBenzMaxim 1:e1c7c1c636af 104 {
IanBenzMaxim 9:bc3d211d75ce 105 result = (ds28e15_22_25.readSegment(authData.pageNum, authData.segmentNum, authData.segment) == OneWireSlave::Success);
IanBenzMaxim 1:e1c7c1c636af 106 if (result)
IanBenzMaxim 1:e1c7c1c636af 107 provisioned = true;
IanBenzMaxim 1:e1c7c1c636af 108 }
IanBenzMaxim 1:e1c7c1c636af 109 else
IanBenzMaxim 1:e1c7c1c636af 110 {
IanBenzMaxim 1:e1c7c1c636af 111 provisioned = false;
IanBenzMaxim 1:e1c7c1c636af 112 }
IanBenzMaxim 1:e1c7c1c636af 113 }
IanBenzMaxim 1:e1c7c1c636af 114 return result;
IanBenzMaxim 1:e1c7c1c636af 115 }
IanBenzMaxim 1:e1c7c1c636af 116
IanBenzMaxim 1:e1c7c1c636af 117 bool SensorNode::checkAuthentic(unsigned int userEntropy)
IanBenzMaxim 1:e1c7c1c636af 118 {
IanBenzMaxim 1:e1c7c1c636af 119 DS28E15_22_25::Scratchpad challenge;
IanBenzMaxim 1:e1c7c1c636af 120 DS28E15_22_25::Page pageData;
IanBenzMaxim 1:e1c7c1c636af 121
IanBenzMaxim 1:e1c7c1c636af 122 // Read page data
IanBenzMaxim 1:e1c7c1c636af 123 if (ds28e15_22_25.readPage(authData.pageNum, pageData, false) != OneWireSlave::Success)
IanBenzMaxim 1:e1c7c1c636af 124 return false;
IanBenzMaxim 1:e1c7c1c636af 125
IanBenzMaxim 1:e1c7c1c636af 126 // Create random challenge
IanBenzMaxim 1:e1c7c1c636af 127 // Use hardare RNG on MAX32600
IanBenzMaxim 1:e1c7c1c636af 128 #ifdef TARGET_MAX32600
IanBenzMaxim 1:e1c7c1c636af 129 MXC_TPU->prng_user_entropy = userEntropy;
IanBenzMaxim 1:e1c7c1c636af 130 #else
IanBenzMaxim 1:e1c7c1c636af 131 std::srand(userEntropy);
IanBenzMaxim 1:e1c7c1c636af 132 #endif
IanBenzMaxim 6:b6bafd0a7013 133 for (size_t i = 0; i < challenge.length; i++)
IanBenzMaxim 1:e1c7c1c636af 134 {
IanBenzMaxim 1:e1c7c1c636af 135 #ifdef TARGET_MAX32600
IanBenzMaxim 1:e1c7c1c636af 136 challenge[i] = MXC_TPU->prng_rnd_num;
IanBenzMaxim 1:e1c7c1c636af 137 #else
IanBenzMaxim 1:e1c7c1c636af 138 challenge[i] = std::rand();
IanBenzMaxim 1:e1c7c1c636af 139 #endif
IanBenzMaxim 1:e1c7c1c636af 140 }
IanBenzMaxim 1:e1c7c1c636af 141
IanBenzMaxim 1:e1c7c1c636af 142 // Write challenge to scratchpad
IanBenzMaxim 1:e1c7c1c636af 143 if (ds28e15_22_25.writeScratchpad(challenge) != OneWireSlave::Success)
IanBenzMaxim 1:e1c7c1c636af 144 return false;
IanBenzMaxim 1:e1c7c1c636af 145 // Have device compute MAC
IanBenzMaxim 1:e1c7c1c636af 146 DS28E15_22_25::Mac nodeMac;
IanBenzMaxim 1:e1c7c1c636af 147 if (ds28e15_22_25.computeReadPageMac(0, false, nodeMac) != OneWireSlave::Success)
IanBenzMaxim 1:e1c7c1c636af 148 return false;
IanBenzMaxim 1:e1c7c1c636af 149 // Compute expected MAC
IanBenzMaxim 1:e1c7c1c636af 150 DS28E15_22_25::Mac controllerMac;
IanBenzMaxim 6:b6bafd0a7013 151 if (DS28E15_22_25::computeAuthMac(ds2465, pageData, authData.pageNum, challenge, ds28e15_22_25.romId, ds28e15_22_25.manId, controllerMac) != ISha256MacCoproc::Success)
IanBenzMaxim 1:e1c7c1c636af 152 return false;
IanBenzMaxim 1:e1c7c1c636af 153 // Check if authentic
IanBenzMaxim 1:e1c7c1c636af 154 return (nodeMac == controllerMac);
IanBenzMaxim 1:e1c7c1c636af 155 }
IanBenzMaxim 1:e1c7c1c636af 156
IanBenzMaxim 1:e1c7c1c636af 157 bool SensorNode::readSensorData(SensorData & sensorData)
IanBenzMaxim 1:e1c7c1c636af 158 {
IanBenzMaxim 1:e1c7c1c636af 159 bool result;
IanBenzMaxim 1:e1c7c1c636af 160 std::int8_t temp;
IanBenzMaxim 1:e1c7c1c636af 161
IanBenzMaxim 1:e1c7c1c636af 162 // Read temperature sensor
IanBenzMaxim 1:e1c7c1c636af 163 result = (ds7505.read_current_temp(temp) == DS7505::Success);
IanBenzMaxim 1:e1c7c1c636af 164
IanBenzMaxim 1:e1c7c1c636af 165 if (result)
IanBenzMaxim 1:e1c7c1c636af 166 {
IanBenzMaxim 1:e1c7c1c636af 167 sensorData.temp = temp;
IanBenzMaxim 1:e1c7c1c636af 168
IanBenzMaxim 1:e1c7c1c636af 169 // Read light sensor
IanBenzMaxim 1:e1c7c1c636af 170 double currentLux;
IanBenzMaxim 1:e1c7c1c636af 171 result = (max44009.read_current_lux(currentLux) == MAX44009::Success);
IanBenzMaxim 1:e1c7c1c636af 172 if (result)
IanBenzMaxim 1:e1c7c1c636af 173 {
IanBenzMaxim 1:e1c7c1c636af 174 // Convert lux to remaining filter life
IanBenzMaxim 1:e1c7c1c636af 175 sensorData.filterLife = (unsigned int)((currentLux / m_initialLux) * 100);
IanBenzMaxim 1:e1c7c1c636af 176 }
IanBenzMaxim 1:e1c7c1c636af 177 }
IanBenzMaxim 1:e1c7c1c636af 178
IanBenzMaxim 1:e1c7c1c636af 179 return result;
IanBenzMaxim 1:e1c7c1c636af 180 }
IanBenzMaxim 1:e1c7c1c636af 181
IanBenzMaxim 1:e1c7c1c636af 182 bool SensorNode::checkAndWriteAuthData(SensorData & sensorData)
IanBenzMaxim 1:e1c7c1c636af 183 {
IanBenzMaxim 1:e1c7c1c636af 184 bool result = true;
IanBenzMaxim 1:e1c7c1c636af 185
IanBenzMaxim 1:e1c7c1c636af 186 if (sensorData.filterLife > authData.filterLife)
IanBenzMaxim 1:e1c7c1c636af 187 {
IanBenzMaxim 1:e1c7c1c636af 188 sensorData.filterLife = authData.filterLife;
IanBenzMaxim 1:e1c7c1c636af 189 }
IanBenzMaxim 1:e1c7c1c636af 190 else if (sensorData.filterLife < authData.filterLife)
IanBenzMaxim 1:e1c7c1c636af 191 {
IanBenzMaxim 1:e1c7c1c636af 192 AuthData oldAuthData(authData);
IanBenzMaxim 1:e1c7c1c636af 193 authData.filterLife = sensorData.filterLife;
IanBenzMaxim 1:e1c7c1c636af 194 // Write new filter life to DS28E15
IanBenzMaxim 9:bc3d211d75ce 195 result = (ds28e15_22_25.writeAuthSegment(ds2465, authData.pageNum, authData.segmentNum, authData.segment, oldAuthData.segment, false) == OneWireSlave::Success);
IanBenzMaxim 1:e1c7c1c636af 196 }
IanBenzMaxim 1:e1c7c1c636af 197
IanBenzMaxim 1:e1c7c1c636af 198 return result;
IanBenzMaxim 1:e1c7c1c636af 199 }
IanBenzMaxim 1:e1c7c1c636af 200
IanBenzMaxim 1:e1c7c1c636af 201 SensorNode::State SensorNode::detect(unsigned int userEntropy)
IanBenzMaxim 1:e1c7c1c636af 202 {
IanBenzMaxim 1:e1c7c1c636af 203 bool provisioned;
IanBenzMaxim 1:e1c7c1c636af 204
IanBenzMaxim 7:e24f0b29f1f7 205 ds2465.OWSetSpeed(DS2465::OverdriveSpeed);
IanBenzMaxim 1:e1c7c1c636af 206
IanBenzMaxim 9:bc3d211d75ce 207 if (ds2465.OWReadRom(ds28e15_22_25.romId) != OneWireMaster::Success)
IanBenzMaxim 1:e1c7c1c636af 208 return UnableToCommunicate;
IanBenzMaxim 1:e1c7c1c636af 209
IanBenzMaxim 1:e1c7c1c636af 210 if (!checkProvisioned(provisioned))
IanBenzMaxim 1:e1c7c1c636af 211 return UnableToCommunicate;
IanBenzMaxim 1:e1c7c1c636af 212
IanBenzMaxim 1:e1c7c1c636af 213 if (!provisioned)
IanBenzMaxim 1:e1c7c1c636af 214 return NotProvisioned;
IanBenzMaxim 1:e1c7c1c636af 215
IanBenzMaxim 1:e1c7c1c636af 216 if (!setSecret())
IanBenzMaxim 1:e1c7c1c636af 217 return UnableToCommunicate;
IanBenzMaxim 1:e1c7c1c636af 218
IanBenzMaxim 1:e1c7c1c636af 219 if (!checkAuthentic(userEntropy))
IanBenzMaxim 1:e1c7c1c636af 220 return NotAuthentic;
IanBenzMaxim 1:e1c7c1c636af 221
IanBenzMaxim 1:e1c7c1c636af 222 if (!initializeSensors())
IanBenzMaxim 1:e1c7c1c636af 223 return UnableToCommunicate;
IanBenzMaxim 1:e1c7c1c636af 224
IanBenzMaxim 1:e1c7c1c636af 225 return Authentic;
IanBenzMaxim 1:e1c7c1c636af 226 }
IanBenzMaxim 1:e1c7c1c636af 227
IanBenzMaxim 1:e1c7c1c636af 228 SensorNode::State SensorNode::authenticatedReadSensorData(unsigned int userEntropy, SensorData & sensorData)
IanBenzMaxim 1:e1c7c1c636af 229 {
IanBenzMaxim 7:e24f0b29f1f7 230 ds2465.OWSetSpeed(DS2465::OverdriveSpeed);
IanBenzMaxim 1:e1c7c1c636af 231
IanBenzMaxim 1:e1c7c1c636af 232 if (!setSecret())
IanBenzMaxim 1:e1c7c1c636af 233 return UnableToCommunicate;
IanBenzMaxim 1:e1c7c1c636af 234
IanBenzMaxim 1:e1c7c1c636af 235 if (!checkAuthentic(userEntropy))
IanBenzMaxim 1:e1c7c1c636af 236 return NotAuthentic;
IanBenzMaxim 1:e1c7c1c636af 237
IanBenzMaxim 1:e1c7c1c636af 238 if (!readSensorData(sensorData))
IanBenzMaxim 1:e1c7c1c636af 239 return UnableToCommunicate;
IanBenzMaxim 1:e1c7c1c636af 240
IanBenzMaxim 1:e1c7c1c636af 241 if (!checkAndWriteAuthData(sensorData))
IanBenzMaxim 1:e1c7c1c636af 242 return NotAuthentic;
IanBenzMaxim 1:e1c7c1c636af 243
IanBenzMaxim 1:e1c7c1c636af 244 return Authentic;
IanBenzMaxim 1:e1c7c1c636af 245 }