Digital Identity
Secure Provisioning
in production

A fully focused and cost-effective solution

Overview

Many industry standards and regulations now require the provisioning of a first and strong digital identity into an electronic device during manufacturing. These include the Cyber Resilient Act (CRA) in Europe, Matter for Smart Home, ISO15118-2/20 for EV-charging, and more.

Assigning each device with an identity means the provisioning of a unique digital certificate per device.
Today’s solutions for certificate provisioning in production are time consuming, expensive and difficult to scale.
Trusted Objects provides tops micro, a solution that enhances security, reduces complexity and lowers cost by fully automating the provisioning of the first digital identity.

Challenges

In practice a unique and strong digital identity per device does mean the usage of digital certificate, the most popular standard being the X.509 certificate.

When referring to digital certificate, devices manufacturers face some challenges:

• how to generate unique digital certificate per device?
• how to select and operate a PKI infrastructure for certificate generation?
• how to inject securely device certificate at factory even in an untrusted environment?

tops micro

tops micro has been developed to address these challenges, providing a local secure provisioning solution at factory.

tops micro is a simple and cost-effective secure provisioning product dedicated to digital identity secure provisioning.

tops micro enables trusted controls at all stages of the provisioning operations at factory and provides the following range of services:

• Secure generation of certificates: certificates, secret keys,
• Management of a PKI tree: internal CA, cross-signed CA
• Secure provisioning: serial number, certificates, and symmetric keys injection into the MCU
• Secure storage of all certificates and keys in the programming facility (uncontrolled environment)
• Secure programming of provisioning data into the MCU in a standalone mode (no Internet connection needed),
• Secure commissioning of the application server, through whitelists,
• Signed batch report to control the number of devices provisioned or programmed.

Integration

tops micro will be installed close to the industrial programmer, inside the programming facility.
It is an industrial computer, secured by Trusted Objects' software.

tops micro is connected through ethernet to a programming computer, typically on programming / test bench.

tops micro is easily integrated in production computer using tops-sdk (free source code),
as it automatically generates and format data ready to program in devices.

tops-client (Windows/Linux/Mac OS desktop application) further simplifies the process by directly managing up to 10 MCU programmers.

Product features and services

Secure Computer

• Portable industrial computer
• 128 GB SSD
• Protection with TPM 2.0 / HSM
• Secure Software with SW update
• REST API over authenticated TLS to connect to programming bench
• Configuration Webapp to administer production
• Dimensions:
  L = 196 mm / H= 36.75 mm / W = 120.8 mm
  L = 7.72'' / H= 1.45'' / W = 4.76''

Services

tops micro can be parameterized before production using its configuration webapp.

• Data Generation per device:
  • Unique Serial Number per device:
    world wide 10 bytes serial number
  • 1 certificate and private key per device:
    asymmetric key generation (RSA, ECC)
  • 2 unique AES keys per device:
    Master key injection, AES derivated key.
    typical use: Encryption and CMAC keys
• Data Generation per production (same for all devices of same production):
  • 1 AES key
  • 1 Customizable string
  • CA authority (private and public keys)
• Possibility to cross-sign Production CA
• Secure storage:
  of all certificates and keys in the programming facility
• Overproduction control:
  production batches signed reports

Resources

• Credits* for a preset number devices to be provisioned
• Full set of documentation
• tops-sdk source code for integration in programming bench
• tops-client as option

* More Credits can be ordered separately