3.5.7 Anti-Tamper
Secure Vault High devices provide internal tampers monitoring the system such as voltage, temperature, and electromagnetic pulses
as well as detecting tamper of the security sub-system itself. Additionally, 8 external configurable tamper pins support external tamper
sources, such as case tamper switches.
For each tamper event, the user is able to select the severity of the tamper response ranging from an interrupt, to a reset, to destroying
the PUF reconstruction data which will make all protected key materials un-recoverable and effectively render the device inoperable.
The tamper system also has an internal resettable event counter with programmable trigger threshold and refresh periods to mitigate
false positive tamper events.
For more information about this feature, see
AN1247: Anti-Tamper Protection Configuration and Use
.
3.5.8 Secure Attestation
Secure Vault High products support Secure Attestation, which begins with a secure identity that is created during the Silicon Labs man-
ufacturing process. During device production, each device generates its own public/private keypair and securely stores the wrapped
private key into immutable OTP memory and this key never leaves the device. The corresponding public key is extracted from the de-
vice and inserted into a binary DER-encoded X.509 device certificate, which is signed into a Silicon Labs CA chain and then program-
med back into the chip into an immutable OTP memory.
The secure identity can be used to authenticate the chip at any time in the life of the product. The production certification chain can be
requested remotely from the product. This certification chain can be used to verify that the device was authentically produced by Silicon
Labs. The device unique public key is also bound to the device certificate in the certification chain. A challenge can be sent to the chip
at any point in time to be signed by the device private key. The public key in the device certificate can then be used to verify the chal-
lenge response, proving that the device has access to the securely-stored private key, which prevents counterfeit products or imperso-
nation attacks.
For more information about this feature, see
AN1268: Authenticating Silicon Labs Devices Using Device Certificates
.
MGM210P Wireless Gecko Multi-Protocol Module Data Sheet
System Overview
silabs.com
| Building a more connected world.
Rev. 1.2 | 9