SILICON LABS HD680 IoT Security 2TB External Hard Drive User Guide

SILICON LABS HD680 IoT Security 2TB External Hard Drive

Product Information

Specifications

• Secure Engine: Hardware Secure Engine (HSE) or Virtual Secure Engine (VSE)
• Secure Vault Levels
  • Secure Vault Base (SVB)
  • Secure Vault Mid (SVM)
  • Secure Vault High (SVH)
• Supported Devices
  • MCU: EFM32JG1, EFM32PG1, EFM32JG12, EFM32PG12, EFM32GG11, EFM32GG12, EFM32TG11 EFM32PG22, EFM32PG23A, EFM32PG23B
  • Wireless SoC: EFR32xG1, EFR32xG12, EFR32xG13, EFR32xG14, EFR32xG22, EFR32xG21A, EFR32xG23A, EFR32xG24A, EFR32xG21B, EFR32xG23B, EFR32xG24B

Product Usage Instructions

1. Using IoT Security Features
   Silicon Labs offers a range of security features depending on the part you are using and your application and production needs.

2. Getting Started with Silicon Labs IoT Security Features on Series 2 Devices

3. On Series 1 devices, the security features are implemented by the TRNG (if available) and CRYPTO peripherals.

4. On Series 2 devices, the security features are implemented by the Secure Engine and CRYPTOACC (if available). The Secure Engine may be hardware-based or virtual (software-based).

5. Additional security features are provided by Secure Vault. Three levels of Secure Vault feature support are available, depending on the part and SE implementation.

Abbreviations:

• HSE – Hardware Secure Engine
• VSE – Virtual Secure Engine
• SE – Secure Engine (either HSE or VSE)

Security Level SE Support:

Secure Vault Features

Secure Vault Mid:

• Secure Boot : Process where the initial boot phase is executed from an immutable memory (such as ROM) and where code is authenticated before being authorized for execution.
• Secure Debug access control : The ability to lock access to the debug ports for operational security, and to securely unlock them when access is required by an authorized entity.

Secure Vault High:

• Secure Key Storage: Protects cryptographic keys by wrapping or encrypting the keys using a root key known only to the HSE-SVH.
• Anti-Tamper protection: A configurable module to protect the device against tamper attacks.
• Device authentication: Functionality that uses a secure device identity certificate along with digital signatures to verify the source or target of device communications.

FAQ

• Q: What security features does Silicon Labs offer?
  A: Silicon Labs offers a range of security features depending on the part you are using and your application and production needs.

• Q: What devices are supported by Silicon Labs IoT Security Features?
  A: Silicon Labs IoT Security Features are supported on MCU devices such as EFM32JG1, EFM32PG1, EFM32JG12, EFM32PG12, EFM32GG11, EFM32GG12, EFM32TG11, EFM32PG22, EFM32PG23A, EFM32PG23B, and Wireless SoC devices such as EFR32xG1, EFR32xG12, EFR32xG13, EFR32xG14, EFR32xG22, EFR32xG21A, EFR32xG23A, EFR32xG24A, EFR32xG21B, EFR32xG23B, EFR32xG24B.

IoT Security

• Using IoT Security Features Getting Started
• IoT Security Fundamentals PDF Developer’s Guide

Overview

• Series 2 Secure Debug PDF
• Series 2 TrustZone PDF
• Production Programming of Series 2 Devices PDF
• Anti-Tamper Protection Configuration and Use PDF
• Authenticating Silicon Labs Devices using Device Certificates PDF Secure Key Storage PDF
• Programming Series 2 Devices Using the DCI and SWD PDF Integrating Crypto Functionality with PSA Crypto vs. Mbed TLS PDF Protocol-Specific Information

Using IoT Security Features

Using Silicon Labs IoT Security Features

• Silicon Labs offers a range of security features depending on the part you are using and your application and production needs.
• The content on these pages is intended for those who want to implement security features as part of your IoT device management. If you are looking for an introduction to Silicon
• Labs Security features and to security issues that confront those implementing IoT systems, see the Silabs.com Security page.
• For details about this release: Links to release notes are available on the silabs.com Gecko SDK page as part of the Gecko Platform release notes.
• For background on security issues in general: IoT Security Fundamentals explains some security basics.
• To get started with implementing security: See the Getting Started page for help determining what features you want to implement based on the series 2 part you are working with.
• Series 2 devices are the preferred choice for secure system implementation.
• If you are already in development: See the Developer’s Guide for details. Security APIs are documented in the Gecko Platform API Reference.

Using IoT Security Features
For detailed information about implementing some security features with specific protocols: See the protocol-specific pages. An extensive body of other protocol-specific content can be accessed through the docs.silabs.com homepage.

Getting Started

Getting Started with Silicon Labs IoT Security Features on Series 2 Devices

• Protecting IoT devices against security threats is central to a quality product. Silicon Labs offers several security options to help developers build secure devices, secure application software, and secure paths of communication to manage those devices. Silicon Labs’ security offerings were significantly enhanced by the introduction of the Series 2 products that included a Secure Engine. The Secure Engine is a tamper-resistant component used to securely store sensitive data and keys, and to execute cryptographic functions and secure services.
• On Series 1 devices, the security features are implemented by the TRNG (if available) and CRYPTO peripherals.
• On Series 2 devices, the security features are implemented by the Secure Engine and CRYPTOACC (if available). The Secure Engine may be hardware-based or virtual (software-based). Here the following abbreviations are used:
  • HSE – Hardware Secure Engine
  • VSE – Virtual Secure Engine
  • SE – Secure Engine (either HSE or VSE)
• Additional security features are provided by Secure Vault. Three levels of Secure Vault feature support are available, depending on the part and SE implementation, as reflected in the following table:

Security Level (1)|

SE Support

|

MCU

|

Wireless SoC (2)

---|---|---|---
Secure Vault Base (SVB)| N/A| EFM32JG1, EFM32PG1, EFM32JG12, EFM32PG12, EFM32GG11, EFM32GG12, EFM32TG11| EFR32xG1, EFR32xG12, EFR32xG13, EFR32xG14
Secure Vault Mid (SVM)| VSE (VSE- SVM)| EFM32PG22| EFR32xG22
”| HSE (HSE- SVM)| EFM32PG23A| EFR32xG21A, EFR32xG23A, EFR32xG24A
Secure Vault High (SVH)| HSE only (HSE-SVH)| EFM32PG23B| EFR32xG21B, EFR32xG23B, EFR32xG24B

Note:

1. The features of different Secure Vault levels can be found in https://www.silabs.com/security  .
2.  The x is a letter B, F, M, or Z.

Secure Vault Mid consists of two core security functions:

• Secure Boot: Process where the initial boot phase is executed from an immutable memory (such as ROM) and where code is authenticated before being authorized for execution.
• Secure Debug access control: The ability to lock access to the debug ports for operational security, and to securely unlock them when access is required by an authorized entity.

Secure Vault High offers additional security options:

• Secure Key Storage: Protects cryptographic keys by “wrapping” or encrypting the keys using a root key known only to the HSE-SVH.
• Anti-Tamper protection: A configurable module to protect the device against tamper attacks.

Getting Started

• Device authentication: Functionality that uses a secure device identity certificate along with digital signatures to verify the source or target of device communications.
• A Secure Engine Manager and other tools allow users to configure and control their devices both in-house during testing and manufacturing, and after the device is in the field.
  Silicon Labs strongly recommends installing the latest SE firmware on Series 2 devices to support the required security features. The latest SE firmware image (.seu and .hex) and release notes can be found in these Windows folders of the GSDK.

**C:\Users\