MAXREFDES143#: DeepCover Embedded Security in IoT Authenticated Sensing & Notification
Dependencies: MaximInterface mbed
The MAXREFDES143# is an Internet of Things (IoT) embedded security reference design, built to protect an industrial sensing node by means of authentication and notification to a web server. The hardware includes a peripheral module representing a protected sensor node monitoring operating temperature and remaining life of a filter (simulated through ambient light sensing) and an mbed shield representing a controller node responsible for monitoring one or more sensor nodes. The design is hierarchical with each controller node communicating data from connected sensor nodes to a web server that maintains a centralized log and dispatches notifications as necessary. The mbed shield contains a Wi-Fi module, a DS2465 coprocessor with 1-Wire® master function, an LCD, LEDs, and pushbuttons. The protected sensor node contains a DS28E15 authenticator, a DS7505 temperature sensor, and a MAX44009 light sensor. The mbed shield communicates to a web server by the onboard Wi-Fi module and to the protected sensor node with I2C and 1-Wire. The MAXREFDES143# is equipped with a standard shield connector for immediate testing using an mbed board such as the MAX32600MBED#. The simplicity of this design enables rapid integration into any star-topology IoT network requiring the heightened security with low overhead provided by the SHA-256 symmetric-key algorithm.
More information about the MAXREFDES143# is available on the Maxim Integrated website.
Factory.cpp@1:e1c7c1c636af, 2016-04-14 (annotated)
- Committer:
- IanBenzMaxim
- Date:
- Thu Apr 14 19:48:01 2016 +0000
- Revision:
- 1:e1c7c1c636af
- Child:
- 2:e67d29a371db
Add initial source files.
Who changed what in which revision?
User | Revision | Line number | New contents of line |
---|---|---|---|
IanBenzMaxim | 1:e1c7c1c636af | 1 | /******************************************************************************* |
IanBenzMaxim | 1:e1c7c1c636af | 2 | * Copyright (C) 2016 Maxim Integrated Products, Inc., All Rights Reserved. |
IanBenzMaxim | 1:e1c7c1c636af | 3 | * |
IanBenzMaxim | 1:e1c7c1c636af | 4 | * Permission is hereby granted, free of charge, to any person obtaining a |
IanBenzMaxim | 1:e1c7c1c636af | 5 | * copy of this software and associated documentation files (the "Software"), |
IanBenzMaxim | 1:e1c7c1c636af | 6 | * to deal in the Software without restriction, including without limitation |
IanBenzMaxim | 1:e1c7c1c636af | 7 | * the rights to use, copy, modify, merge, publish, distribute, sublicense, |
IanBenzMaxim | 1:e1c7c1c636af | 8 | * and/or sell copies of the Software, and to permit persons to whom the |
IanBenzMaxim | 1:e1c7c1c636af | 9 | * Software is furnished to do so, subject to the following conditions: |
IanBenzMaxim | 1:e1c7c1c636af | 10 | * |
IanBenzMaxim | 1:e1c7c1c636af | 11 | * The above copyright notice and this permission notice shall be included |
IanBenzMaxim | 1:e1c7c1c636af | 12 | * in all copies or substantial portions of the Software. |
IanBenzMaxim | 1:e1c7c1c636af | 13 | * |
IanBenzMaxim | 1:e1c7c1c636af | 14 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS |
IanBenzMaxim | 1:e1c7c1c636af | 15 | * OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF |
IanBenzMaxim | 1:e1c7c1c636af | 16 | * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. |
IanBenzMaxim | 1:e1c7c1c636af | 17 | * IN NO EVENT SHALL MAXIM INTEGRATED BE LIABLE FOR ANY CLAIM, DAMAGES |
IanBenzMaxim | 1:e1c7c1c636af | 18 | * OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, |
IanBenzMaxim | 1:e1c7c1c636af | 19 | * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR |
IanBenzMaxim | 1:e1c7c1c636af | 20 | * OTHER DEALINGS IN THE SOFTWARE. |
IanBenzMaxim | 1:e1c7c1c636af | 21 | * |
IanBenzMaxim | 1:e1c7c1c636af | 22 | * Except as contained in this notice, the name of Maxim Integrated |
IanBenzMaxim | 1:e1c7c1c636af | 23 | * Products, Inc. shall not be used except as stated in the Maxim Integrated |
IanBenzMaxim | 1:e1c7c1c636af | 24 | * Products, Inc. Branding Policy. |
IanBenzMaxim | 1:e1c7c1c636af | 25 | * |
IanBenzMaxim | 1:e1c7c1c636af | 26 | * The mere transfer of this software does not imply any licenses |
IanBenzMaxim | 1:e1c7c1c636af | 27 | * of trade secrets, proprietary technology, copyrights, patents, |
IanBenzMaxim | 1:e1c7c1c636af | 28 | * trademarks, maskwork rights, or any other form of intellectual |
IanBenzMaxim | 1:e1c7c1c636af | 29 | * property whatsoever. Maxim Integrated Products, Inc. retains all |
IanBenzMaxim | 1:e1c7c1c636af | 30 | * ownership rights. |
IanBenzMaxim | 1:e1c7c1c636af | 31 | ******************************************************************************* |
IanBenzMaxim | 1:e1c7c1c636af | 32 | */ |
IanBenzMaxim | 1:e1c7c1c636af | 33 | |
IanBenzMaxim | 1:e1c7c1c636af | 34 | #include "Factory.hpp" |
IanBenzMaxim | 1:e1c7c1c636af | 35 | #include "SensorNode.hpp" |
IanBenzMaxim | 1:e1c7c1c636af | 36 | #include "common.hpp" |
IanBenzMaxim | 1:e1c7c1c636af | 37 | #include "OneWire_Masters/DS2465/DS2465.hpp" |
IanBenzMaxim | 1:e1c7c1c636af | 38 | #include "OneWire_Memory/Authenticators/DS28E15_22_25/DS28E15_22_25.hpp" |
IanBenzMaxim | 1:e1c7c1c636af | 39 | #include "mbed.h" |
IanBenzMaxim | 1:e1c7c1c636af | 40 | |
IanBenzMaxim | 1:e1c7c1c636af | 41 | const std::uint8_t Factory::masterSecret[] = { 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1A, 0x1B, 0x1C, 0x1D, 0x1E, 0x1F, 0x21, |
IanBenzMaxim | 1:e1c7c1c636af | 42 | 0x22, 0x23, 0x24, 0x25, 0x26, 0x27, 0x28, 0x29, 0x2A, 0x2B, 0x2C, 0x2D, 0x2E, 0x2F, 0x31, 0x32 }; |
IanBenzMaxim | 1:e1c7c1c636af | 43 | const std::uint8_t Factory::invalidMasterSecret[] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, |
IanBenzMaxim | 1:e1c7c1c636af | 44 | 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; |
IanBenzMaxim | 1:e1c7c1c636af | 45 | |
IanBenzMaxim | 1:e1c7c1c636af | 46 | bool Factory::provision(DS2465 & ds2465) |
IanBenzMaxim | 1:e1c7c1c636af | 47 | { |
IanBenzMaxim | 1:e1c7c1c636af | 48 | bool result = (ds2465.setMasterSecret(masterSecret) == ISha256MacCoprocessor::Success); |
IanBenzMaxim | 1:e1c7c1c636af | 49 | if (result) |
IanBenzMaxim | 1:e1c7c1c636af | 50 | { |
IanBenzMaxim | 1:e1c7c1c636af | 51 | SensorNode::AuthData authData; |
IanBenzMaxim | 1:e1c7c1c636af | 52 | DS28E15_22_25::Page pageData; |
IanBenzMaxim | 1:e1c7c1c636af | 53 | std::memset(pageData, SensorNode::defaultPaddingByte, pageData.length); |
IanBenzMaxim | 1:e1c7c1c636af | 54 | std::memcpy(pageData, authData.segment, authData.segment.length); |
IanBenzMaxim | 1:e1c7c1c636af | 55 | result = (ds2465.writeScratchpad(pageData, pageData.length) == OneWireMaster::Success); |
IanBenzMaxim | 1:e1c7c1c636af | 56 | } |
IanBenzMaxim | 1:e1c7c1c636af | 57 | if (result) |
IanBenzMaxim | 1:e1c7c1c636af | 58 | { |
IanBenzMaxim | 1:e1c7c1c636af | 59 | result = (ds2465.copyScratchpadToPage(0) == OneWireMaster::Success); |
IanBenzMaxim | 1:e1c7c1c636af | 60 | if (result) |
IanBenzMaxim | 1:e1c7c1c636af | 61 | wait_ms(DS2465::eepromPageWriteDelayMs); |
IanBenzMaxim | 1:e1c7c1c636af | 62 | } |
IanBenzMaxim | 1:e1c7c1c636af | 63 | |
IanBenzMaxim | 1:e1c7c1c636af | 64 | return result; |
IanBenzMaxim | 1:e1c7c1c636af | 65 | } |
IanBenzMaxim | 1:e1c7c1c636af | 66 | |
IanBenzMaxim | 1:e1c7c1c636af | 67 | bool Factory::provision(SensorNode & sensorNode, bool validSecret) |
IanBenzMaxim | 1:e1c7c1c636af | 68 | { |
IanBenzMaxim | 1:e1c7c1c636af | 69 | const int blockNum = sensorNode.authData.pageNum / 2; |
IanBenzMaxim | 1:e1c7c1c636af | 70 | const DS28E15_22_25::BlockProtection desiredProtection(false, false, false, true, blockNum); // Authentication Protection only |
IanBenzMaxim | 1:e1c7c1c636af | 71 | |
IanBenzMaxim | 1:e1c7c1c636af | 72 | // Reset to starting defaults |
IanBenzMaxim | 1:e1c7c1c636af | 73 | sensorNode.authData.reset(); |
IanBenzMaxim | 1:e1c7c1c636af | 74 | |
IanBenzMaxim | 1:e1c7c1c636af | 75 | // Read current protection status |
IanBenzMaxim | 1:e1c7c1c636af | 76 | DS28E15_22_25::BlockProtection protectionStatus; |
IanBenzMaxim | 1:e1c7c1c636af | 77 | bool result; |
IanBenzMaxim | 1:e1c7c1c636af | 78 | // Select device through Skip ROM |
IanBenzMaxim | 1:e1c7c1c636af | 79 | result = (sensorNode.ds2465.OWSkipROM() == OneWireMaster::Success); |
IanBenzMaxim | 1:e1c7c1c636af | 80 | if (result) |
IanBenzMaxim | 1:e1c7c1c636af | 81 | result = (sensorNode.ds28e15_22_25.readBlockProtection(blockNum, protectionStatus) == OneWireSlave::Success); |
IanBenzMaxim | 1:e1c7c1c636af | 82 | // Check if invalid protections are set |
IanBenzMaxim | 1:e1c7c1c636af | 83 | if (result) |
IanBenzMaxim | 1:e1c7c1c636af | 84 | result = ((protectionStatus.statusByte() & ~(desiredProtection.statusByte())) == 0x00); |
IanBenzMaxim | 1:e1c7c1c636af | 85 | // Select device through Skip ROM |
IanBenzMaxim | 1:e1c7c1c636af | 86 | if (result) |
IanBenzMaxim | 1:e1c7c1c636af | 87 | result = (sensorNode.ds2465.OWSkipROM() == OneWireMaster::Success); |
IanBenzMaxim | 1:e1c7c1c636af | 88 | // Load secret into scratchpad |
IanBenzMaxim | 1:e1c7c1c636af | 89 | if (result) |
IanBenzMaxim | 1:e1c7c1c636af | 90 | result = (sensorNode.ds28e15_22_25.writeScratchpad(validSecret ? masterSecret : invalidMasterSecret) == OneWireSlave::Success); |
IanBenzMaxim | 1:e1c7c1c636af | 91 | // Select device through Skip ROM |
IanBenzMaxim | 1:e1c7c1c636af | 92 | if (result) |
IanBenzMaxim | 1:e1c7c1c636af | 93 | result = (sensorNode.ds2465.OWSkipROM() == OneWireMaster::Success); |
IanBenzMaxim | 1:e1c7c1c636af | 94 | // Load master secret from scratchpad without locking |
IanBenzMaxim | 1:e1c7c1c636af | 95 | if (result) |
IanBenzMaxim | 1:e1c7c1c636af | 96 | result = (sensorNode.ds28e15_22_25.loadSecret(false) == OneWireSlave::Success); |
IanBenzMaxim | 1:e1c7c1c636af | 97 | |
IanBenzMaxim | 1:e1c7c1c636af | 98 | // Setup is complete if not using a valid secret |
IanBenzMaxim | 1:e1c7c1c636af | 99 | if (!validSecret) |
IanBenzMaxim | 1:e1c7c1c636af | 100 | return result; |
IanBenzMaxim | 1:e1c7c1c636af | 101 | |
IanBenzMaxim | 1:e1c7c1c636af | 102 | // Create constant partial secret |
IanBenzMaxim | 1:e1c7c1c636af | 103 | DS28E15_22_25::Scratchpad partialSecret; |
IanBenzMaxim | 1:e1c7c1c636af | 104 | DS28E15_22_25::Page pageData; |
IanBenzMaxim | 1:e1c7c1c636af | 105 | std::memset(partialSecret, SensorNode::defaultPaddingByte, partialSecret.length); |
IanBenzMaxim | 1:e1c7c1c636af | 106 | |
IanBenzMaxim | 1:e1c7c1c636af | 107 | // Select device through Skip ROM |
IanBenzMaxim | 1:e1c7c1c636af | 108 | if (result) |
IanBenzMaxim | 1:e1c7c1c636af | 109 | result = (sensorNode.ds2465.OWSkipROM() == OneWireMaster::Success); |
IanBenzMaxim | 1:e1c7c1c636af | 110 | // Read page data |
IanBenzMaxim | 1:e1c7c1c636af | 111 | if (result) |
IanBenzMaxim | 1:e1c7c1c636af | 112 | result = (sensorNode.ds28e15_22_25.readPage(sensorNode.authData.pageNum, pageData, false) == OneWireSlave::Success); |
IanBenzMaxim | 1:e1c7c1c636af | 113 | // Select device through Skip ROM |
IanBenzMaxim | 1:e1c7c1c636af | 114 | if (result) |
IanBenzMaxim | 1:e1c7c1c636af | 115 | result = (sensorNode.ds2465.OWSkipROM() == OneWireMaster::Success); |
IanBenzMaxim | 1:e1c7c1c636af | 116 | // Load partial secret into scratchpad |
IanBenzMaxim | 1:e1c7c1c636af | 117 | if (result) |
IanBenzMaxim | 1:e1c7c1c636af | 118 | result = (sensorNode.ds28e15_22_25.writeScratchpad(partialSecret) == OneWireSlave::Success); |
IanBenzMaxim | 1:e1c7c1c636af | 119 | // Select device through Skip ROM |
IanBenzMaxim | 1:e1c7c1c636af | 120 | if (result) |
IanBenzMaxim | 1:e1c7c1c636af | 121 | result = (sensorNode.ds2465.OWSkipROM() == OneWireMaster::Success); |
IanBenzMaxim | 1:e1c7c1c636af | 122 | // Compute secret |
IanBenzMaxim | 1:e1c7c1c636af | 123 | if (result) |
IanBenzMaxim | 1:e1c7c1c636af | 124 | result = (sensorNode.ds28e15_22_25.computeSecret(sensorNode.authData.pageNum, false) == OneWireSlave::Success); |
IanBenzMaxim | 1:e1c7c1c636af | 125 | // Configure slave secret on DS2465 |
IanBenzMaxim | 1:e1c7c1c636af | 126 | if (result) |
IanBenzMaxim | 1:e1c7c1c636af | 127 | result = (DS28E15_22_25::computeNextSecret(sensorNode.ds2465, pageData, sensorNode.authData.pageNum, partialSecret, sensorNode.ds28e15_22_25.romId, sensorNode.ds28e15_22_25.manId) == ISha256MacCoprocessor::Success); |
IanBenzMaxim | 1:e1c7c1c636af | 128 | // Select device through Skip ROM |
IanBenzMaxim | 1:e1c7c1c636af | 129 | if (result) |
IanBenzMaxim | 1:e1c7c1c636af | 130 | result = (sensorNode.ds2465.OWSkipROM() == OneWireMaster::Success); |
IanBenzMaxim | 1:e1c7c1c636af | 131 | // Enable authentication protection if not set |
IanBenzMaxim | 1:e1c7c1c636af | 132 | if (result && (protectionStatus != desiredProtection)) |
IanBenzMaxim | 1:e1c7c1c636af | 133 | result = (sensorNode.ds28e15_22_25.writeAuthBlockProtection(sensorNode.ds2465, desiredProtection, protectionStatus) == OneWireSlave::Success); |
IanBenzMaxim | 1:e1c7c1c636af | 134 | // Select device through Skip ROM |
IanBenzMaxim | 1:e1c7c1c636af | 135 | if (result) |
IanBenzMaxim | 1:e1c7c1c636af | 136 | result = (sensorNode.ds2465.OWSkipROM() == OneWireMaster::Success); |
IanBenzMaxim | 1:e1c7c1c636af | 137 | // Write initial filter life and set all other segments to default value |
IanBenzMaxim | 1:e1c7c1c636af | 138 | if (result) |
IanBenzMaxim | 1:e1c7c1c636af | 139 | { |
IanBenzMaxim | 1:e1c7c1c636af | 140 | DS28E15_22_25::Segment blankSegment; |
IanBenzMaxim | 1:e1c7c1c636af | 141 | std::memset(blankSegment, SensorNode::defaultPaddingByte, blankSegment.length); |
IanBenzMaxim | 1:e1c7c1c636af | 142 | for (std::size_t i = 0; i < (DS28E15_22_25::Page::length / DS28E15_22_25::Segment::length); i++) |
IanBenzMaxim | 1:e1c7c1c636af | 143 | { |
IanBenzMaxim | 1:e1c7c1c636af | 144 | result = (sensorNode.ds2465.OWSkipROM() == OneWireMaster::Success); |
IanBenzMaxim | 1:e1c7c1c636af | 145 | if (result) |
IanBenzMaxim | 1:e1c7c1c636af | 146 | result = (sensorNode.ds28e15_22_25.writeAuthSegment(sensorNode.ds2465, sensorNode.authData.pageNum, i, |
IanBenzMaxim | 1:e1c7c1c636af | 147 | ((i == sensorNode.authData.segmentNum) ? sensorNode.authData.segment : blankSegment), |
IanBenzMaxim | 1:e1c7c1c636af | 148 | reinterpret_cast<const DS28E15_22_25::Segment::Buffer &>(static_cast<const DS28E15_22_25::Page::Buffer &>(pageData)[i * sizeof(DS28E15_22_25::Segment::Buffer)]), false) == OneWireSlave::Success); |
IanBenzMaxim | 1:e1c7c1c636af | 149 | |
IanBenzMaxim | 1:e1c7c1c636af | 150 | if (!result) |
IanBenzMaxim | 1:e1c7c1c636af | 151 | break; |
IanBenzMaxim | 1:e1c7c1c636af | 152 | } |
IanBenzMaxim | 1:e1c7c1c636af | 153 | } |
IanBenzMaxim | 1:e1c7c1c636af | 154 | |
IanBenzMaxim | 1:e1c7c1c636af | 155 | // Reload secret with known page values |
IanBenzMaxim | 1:e1c7c1c636af | 156 | // Select device through Skip ROM |
IanBenzMaxim | 1:e1c7c1c636af | 157 | if (result) |
IanBenzMaxim | 1:e1c7c1c636af | 158 | result = (sensorNode.ds2465.OWSkipROM() == OneWireMaster::Success); |
IanBenzMaxim | 1:e1c7c1c636af | 159 | // Load master secret into scratchpad |
IanBenzMaxim | 1:e1c7c1c636af | 160 | if (result) |
IanBenzMaxim | 1:e1c7c1c636af | 161 | result = (sensorNode.ds28e15_22_25.writeScratchpad(masterSecret) == OneWireSlave::Success); |
IanBenzMaxim | 1:e1c7c1c636af | 162 | // Select device through Skip ROM |
IanBenzMaxim | 1:e1c7c1c636af | 163 | if (result) |
IanBenzMaxim | 1:e1c7c1c636af | 164 | result = (sensorNode.ds2465.OWSkipROM() == OneWireMaster::Success); |
IanBenzMaxim | 1:e1c7c1c636af | 165 | // Load master secret |
IanBenzMaxim | 1:e1c7c1c636af | 166 | if (result) |
IanBenzMaxim | 1:e1c7c1c636af | 167 | result = (sensorNode.ds28e15_22_25.loadSecret(false) == OneWireSlave::Success); |
IanBenzMaxim | 1:e1c7c1c636af | 168 | // Select device through Skip ROM |
IanBenzMaxim | 1:e1c7c1c636af | 169 | if (result) |
IanBenzMaxim | 1:e1c7c1c636af | 170 | result = (sensorNode.ds2465.OWSkipROM() == OneWireMaster::Success); |
IanBenzMaxim | 1:e1c7c1c636af | 171 | // Read page data |
IanBenzMaxim | 1:e1c7c1c636af | 172 | if (result) |
IanBenzMaxim | 1:e1c7c1c636af | 173 | result = (sensorNode.ds28e15_22_25.readPage(sensorNode.authData.pageNum, pageData, false) == OneWireSlave::Success); |
IanBenzMaxim | 1:e1c7c1c636af | 174 | // Select device through Skip ROM |
IanBenzMaxim | 1:e1c7c1c636af | 175 | if (result) |
IanBenzMaxim | 1:e1c7c1c636af | 176 | result = (sensorNode.ds2465.OWSkipROM() == OneWireMaster::Success); |
IanBenzMaxim | 1:e1c7c1c636af | 177 | // Write partial secret to scratchpad |
IanBenzMaxim | 1:e1c7c1c636af | 178 | if (result) |
IanBenzMaxim | 1:e1c7c1c636af | 179 | result = (sensorNode.ds28e15_22_25.writeScratchpad(partialSecret) == OneWireSlave::Success); |
IanBenzMaxim | 1:e1c7c1c636af | 180 | // Select device through Skip ROM |
IanBenzMaxim | 1:e1c7c1c636af | 181 | if (result) |
IanBenzMaxim | 1:e1c7c1c636af | 182 | result = (sensorNode.ds2465.OWSkipROM() == OneWireMaster::Success); |
IanBenzMaxim | 1:e1c7c1c636af | 183 | // Compute secret |
IanBenzMaxim | 1:e1c7c1c636af | 184 | if (result) |
IanBenzMaxim | 1:e1c7c1c636af | 185 | result = (sensorNode.ds28e15_22_25.computeSecret(sensorNode.authData.pageNum, false) == OneWireSlave::Success); |
IanBenzMaxim | 1:e1c7c1c636af | 186 | // Configure slave secret on DS2465 |
IanBenzMaxim | 1:e1c7c1c636af | 187 | if (result) |
IanBenzMaxim | 1:e1c7c1c636af | 188 | result = (DS28E15_22_25::computeNextSecret(sensorNode.ds2465, pageData, sensorNode.authData.pageNum, partialSecret, sensorNode.ds28e15_22_25.romId, sensorNode.ds28e15_22_25.manId) == ISha256MacCoprocessor::Success); |
IanBenzMaxim | 1:e1c7c1c636af | 189 | |
IanBenzMaxim | 1:e1c7c1c636af | 190 | return result; |
IanBenzMaxim | 1:e1c7c1c636af | 191 | } |